Automatic translations update

The previous image versions set ANSIBLE_WORKER_SESSION_ISOLATION=False in an
attempt to restore SSH prompts on Ansible 2.21. That setting does not bring
the prompts back — it makes Ansible hang silently at the first SSH connection
whenever a prompt would have been needed. See
https://github.com/devture/docker-ansible/issues/6

The new image auto-accepts the SSH host keys of previously unknown hosts
instead. The docs stop recommending ANSIBLE_WORKER_SESSION_ISOLATION=False
for direct (non-Docker) runs for the same reason, and now explain how to use
an ssh-agent for passphrase-protected SSH keys.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.codespellrc

@@ -1,2 +1,2 @@
 [codespell]
-ignore-words-list = aNULL,brose,doub,Udo,re-use,re-used,registr,shema,commet,Commet
+ignore-words-list = aNULL,brose,doub,Udo,re-use,re-used,registr,shema,commet,Commet,Bloks

.devcontainer/Dockerfile

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2025 Jonah Aragon
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+FROM ghcr.io/devture/ansible:14.0.0-r0-3
+
+# Install additional packages
+RUN apk add --no-cache \
+	pwgen
+
+# Preserve command history across container restarts
+RUN SNIPPET="export HISTFILE=/commandhistory/.ash_history" \
+	&& echo "$SNIPPET" >> "/root/.profile"

.devcontainer/devcontainer.json

@@ -0,0 +1,27 @@
+{
+	"name": "matrix-docker-ansible-deploy",
+	"build": {
+		"dockerfile": "Dockerfile",
+		"context": ".."
+	},
+	"postCreateCommand": {
+		"Fix Volume Permissions": "chown -R $(whoami): /commandhistory"
+	},
+	"mounts": [
+		{
+			"source": "matrix-docker-ansible-deploy-bashhistory",
+			"target": "/commandhistory",
+			"type": "volume"
+		}
+	],
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"EditorConfig.EditorConfig",
+				"redhat.ansible",
+				"redhat.vscode-yaml",
+				"ms-python.python"
+			]
+		}
+	}
+}

.devcontainer/devcontainer.json.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2025 Jonah Aragon
+
+SPDX-License-Identifier: AGPL-3.0-or-later

.github/renovate.json

@@ -1,7 +1,8 @@
 {
 	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
 	"extends": [
-		"config:recommended"
+		"config:recommended",
+		"helpers:pinGitHubActionDigests"
 	],
 	"labels": [
 		"dependencies"
@@ -32,9 +33,27 @@
 				"dock.mau.dev/mautrix/**"
 			],
 			"allowedVersions": "/^v0\\./"
+		},
+		{
+			"matchFileNames": [
+				".github/workflows/close-stale-issues.yml",
+				".github/workflows/lock-threads.yml",
+				".github/workflows/matrix.yml",
+				".github/workflows/update-translations.yml",
+				"flake.lock",
+				"i18n/requirements.txt",
+				"mise.toml"
+			],
+			"automerge": true
 		}
 	],
 	"pre-commit": {
 		"enabled": true
+	},
+	"nix": {
+		"enabled": true,
+		"lockFileMaintenance": {
+			"enabled": true
+		}
 	}
 }

.github/workflows/close-stale-issues.yml

@@ -19,7 +19,7 @@ jobs:
     if: github.repository == 'spantaleev/matrix-docker-ansible-deploy'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11
         with:
           ######################################################################
           # Issues/PRs

.github/workflows/lock-threads.yml

@@ -23,7 +23,7 @@ jobs:
     if: github.repository == 'spantaleev/matrix-docker-ansible-deploy'
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v6
+      - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6
         with:
           add-issue-labels: 'outdated'
           process-only: 'issues, prs'

.github/workflows/matrix.yml

@@ -26,10 +26,10 @@ jobs:
         run: pacman -Sy --noconfirm git
 
       - name: Check out
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Restore prek cache
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: var/prek
           key: arch-prek-v1-${{ hashFiles('.pre-commit-config.yaml') }}

.github/workflows/update-translations.yml

@@ -24,23 +24,23 @@ jobs:
     name: Update translations
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
 
       # Setting up recommended prerequisites
       # See: i18n/README.md
-      - uses: astral-sh/setup-uv@v8.2.0
-      - uses: extractions/setup-just@v4
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
 
       # TODO: optimize when we start publishing translations and integrate a Weblate instance
       - name: Update translation catalog templates (POT) files
         run: just --justfile i18n/justfile extract-translation-templates
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8.1.1
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>  # Same as committer
           body: This is an automatic pull request to update translation files.

.pre-commit-config.yaml

@@ -15,7 +15,7 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: v2.4.3
     hooks:
       - id: codespell
         args: ["--skip=*.po,*.pot,i18n/"]
@@ -24,7 +24,7 @@ repos:
     hooks:
       - id: reuse
   - repo: https://github.com/ansible/ansible-lint
-    rev: v26.4.0
+    rev: v26.8.0
     hooks:
       - id: ansible-lint
         files: '^roles/custom/'

.yamllint

@@ -1,5 +1,16 @@
 ---
 extends: default
 
+# Keep this custom configuration compatible with ansible-lint's `yaml` rule.
+# See https://docs.ansible.com/projects/lint/rules/yaml/#yamllint-configuration
 rules:
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
   line-length: disable
+  octal-values:
+    forbid-explicit-octal: true
+    forbid-implicit-octal: true

AGENTS.md

@@ -0,0 +1,39 @@
+<!--
+SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Guidance for AI agents
+
+This file gives AI coding agents the minimum context for working on this repository. Human contributors may find it a useful summary too.
+
+## What this is
+
+An Ansible playbook that installs and manages a Matrix homeserver and dozens of related services, each running as a Docker container wrapped in a systemd service.
+
+## Layout
+
+- `setup.yml`: the main playbook, listing all roles.
+- `roles/custom/`: roles maintained in this repository.
+- `roles/galaxy/`: external roles, downloaded according to `requirements.yml` via [agru](https://github.com/etkecc/agru) (preferred) or `ansible-galaxy`. Run `just roles` to install them (or `just update` to also pull the playbook itself). Editing these roles locally is fine while preparing or testing a fix, but the changes get wiped on the next roles update, so they must be synced back to the role's upstream repository, followed by a version pin update in `requirements.yml`.
+- `group_vars/matrix_servers`: wires roles together (feeding one role's variables into another). Values a role can construct by itself belong in the role's `defaults/main.yml`, not here.
+- `docs/`: user-facing documentation, one page per component.
+- `i18n/`: translation infrastructure. Do not edit locale files by hand; they are managed by automation.
+- `CHANGELOG.md`: user-facing announcements, newest first.
+
+## Conventions
+
+Follow the [style guide for playbook developers](docs/style-guide.md). In particular:
+
+- Variable prefixes match the role directory name.
+- Playbook-extensible list variables use the `_auto` + `_custom` split; `_custom` is reserved for users.
+- Renamed or removed variables get a validation entry, so stale user configuration produces an error instead of being silently ignored. Each role deprecates its own variables in its `validate_config.yml`; the `matrix_playbook_migration` role covers eliminated roles and very-early validation, and also gates breaking changes via `matrix_playbook_migration_expected_version` (see the style guide).
+- Every file carries SPDX license headers ([REUSE](https://reuse.software/) specification).
+- New components must be registered in `setup.yml`, `group_vars/matrix_servers`, `docs/README.md`, `README.md`, `docs/container-images.md`, and get a `CHANGELOG.md` entry.
+
+## Other notes
+
+- Documentation examples use `example.com`, `@alice:example.com`, and the other placeholder values listed in the style guide.
+- Write role tasks concurrency-safe: use `ansible.builtin.tempfile` for temporary files (removed in an `always` block), never fixed shared paths.
+- One logical change per commit.

CHANGELOG.md

@@ -1,3 +1,316 @@
+# 2026-08-20
+
+## MatrixRTC transports are advertised in the client well-known again
+
+This only affects you if you have the [Matrix RTC stack](docs/configuring-playbook-matrix-rtc.md) or [Element Call](docs/configuring-playbook-element-call.md) enabled.
+
+Yesterday's changelog entry announced that the `org.matrix.msc4143.rtc_foci` property was gone from the `/.well-known/matrix/client` file. That turned out to be premature and has been reverted, so the property is published again as it always was.
+
+The property is indeed dropped from [MSC4143](https://github.com/matrix-org/matrix-spec-proposals/pull/4143) and [Element Call v0.24.0](https://github.com/element-hq/element-call/releases/tag/v0.24.0) no longer reads it, but Element Web (and likely other clients who move slowly or are otherwise outdated) does not ship that version of Element Call yet. Element Web v1.12.26 bundles Element Call v0.22.0, which still discovers your transport through the well-known property. It cannot use the homeserver's `/_matrix/client/unstable/org.matrix.msc4143/rtc/transports` API instead, because Element Call runs as a widget there and a widget holds no access token, while that API requires authentication. Newer Element Call versions ask their host client for the transports over the widget API ([MSC4515](https://github.com/matrix-org/matrix-spec-proposals/pull/4515)), which is what will eventually make the property unnecessary.
+
+Dropping the property therefore broke Element Call for Element Web and Element Desktop users, with a `MISSING_MATRIX_RTC_TRANSPORT` error when starting a call. Re-running the playbook (`just install-all`) brings the property back and fixes calls.
+
+If you worked around this by publishing the property yourself via `matrix_static_files_file_matrix_client_configuration_extension_json`, you can drop that from your `vars.yml` file now. The `matrix_static_files_file_matrix_client_property_org_matrix_msc4143_rtc_foci_custom` variable and its companions are back as well.
+
+# 2026-08-13
+
+## The homeserver root path redirects to clients other than Element Web
+
+Visiting `https://matrix.example.com/` used to redirect you to [Element Web](docs/configuring-playbook-client-element-web.md), but only if Element Web was the client installed by the playbook. With any of the other web clients (Cinny, Commet, FluffyChat, Hydrogen, SchildiChat, Sable), you would land on a bare Synapse page.
+
+The redirection now follows whichever of these clients you have enabled. When several are enabled, Element Web wins, followed by the others in the order that [`group_vars/matrix_servers`](group_vars/matrix_servers) lists them.
+
+To send people somewhere else (or nowhere at all), define `matrix_playbook_public_client_root_redirection_url` in your `vars.yml` file. An empty value disables the redirection.
+
+## Support for Meowlnir
+
+The playbook can now install [Meowlnir](https://github.com/maunium/meowlnir), an opinionated Matrix moderation bot, optimized for Synapse.
+
+Meowlnir joins [Draupnir](docs/configuring-playbook-bot-draupnir.md) and [Mjolnir](docs/configuring-playbook-bot-mjolnir.md) as a 3rd moderation option, speaking the same [policy list](https://the-draupnir-project.github.io/draupnir-documentation/concepts/policy-lists) protocol so that it can subscribe to the same community ban lists. Unlike the others, it can override individual policies coming from lists you do not control (by way of an unban policy in a list of your own which is ordered ahead of other policy lists).
+
+You can run it alongside Draupnir while evaluating it — see the documentation for the caveats, the main one being that both want the [synapse-http-antispam](https://github.com/maunium/synapse-http-antispam) module, which only reports to a single consumer.
+
+To get started, see the [Setting up Meowlnir](docs/configuring-playbook-bot-meowlnir.md) documentation page.
+
+
+# 2026-08-06
+
+## (Backward Compatibility Break) Jitsi no longer uses Colibri WebSockets
+
+This only affects you if you have [Jitsi](docs/configuring-playbook-jitsi.md) enabled.
+
+Jitsi has been updated to `stable-11146-1`, which [removes Colibri WebSocket support](https://github.com/jitsi/docker-jitsi-meet/pull/2285) in favour of SCTP data channels. The Jitsi Video Bridge no longer serves HTTP at all, so a few `jitsi_jvb_*` variables are gone. The playbook will tell you which ones, if your configuration still sets them.
+
+If you run [additional JVBs on other hosts](https://github.com/mother-of-all-self-hosting/ansible-role-jitsi/blob/main/docs/configuring-jitsi.md#set-up-additional-jvbs-for-more-video-conferences-optional), the Traefik configuration which routed `/colibri-ws/<server-id>/` to them is now dead and can be removed. Nothing will warn you about that one, as it lives in a free-form `traefik_provider_configuration_extension_yaml` block.
+
+# 2026-07-28
+
+## (Backward Compatibility Break) ntfy users are now declared with hashed passwords
+
+This only affects you if you have enabled authentication for [ntfy](docs/configuring-playbook-ntfy.md) via `ntfy_credentials`.
+
+The ntfy role used to create users by invoking `ntfy user` commands against the running container. Since v2.14.0, ntfy can provision users and access-control entries from its own configuration file, so the role now does that instead. Besides being a lot simpler, this fixes passwords containing spaces never arriving intact.
+
+Replace `ntfy_credentials` with `ntfy_auth_users_custom`, which takes bcrypt password hashes rather than plaintext passwords:
+
+```yaml
+ntfy_auth_users_custom:
+  - username: alice
+    password_hash: $2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C
+    role: admin
+```
+
+Generate a hash for each of your passwords by running the following command on any machine which has Docker installed. It asks for the password and prints its hash:
+
+```sh
+docker run --rm -it docker.io/binwiederhier/ntfy:latest user hash
+```
+
+The playbook will let you know if your configuration still uses `ntfy_credentials`.
+
+Your existing ntfy users are left alone and keep working until you declare them again this way. Note that ntfy manages declared users and access-control entries declaratively, so removing one from your configuration later deletes it from ntfy's user database.
+
+Users with the `admin` role get access to all topics. Others start with no access at all, and can be granted access to specific topics via `ntfy_auth_access_custom`. It is also now possible to control what unauthenticated visitors may do (`ntfy_auth_default_access`) and whether users may log in at all (`ntfy_enable_login`, which follows your authentication setup by default). See the role's [documentation on access control](https://github.com/mother-of-all-self-hosting/ansible-role-ntfy/blob/main/docs/configuring-ntfy.md#enable-access-control-with-authentication-optional) for details.
+
+## Support for bridging to LinkedIn via mautrix-linkedin
+
+Thanks to [Aine](https://gitlab.com/etke.cc) of [etke.cc](https://etke.cc/), the playbook now supports bridging to [LinkedIn](https://www.linkedin.com/) via [mautrix-linkedin](https://github.com/mautrix/linkedin).
+
+Logging in requires copying a request out of your browser's developer tools, and only works with Chrome or another Chrome-based browser. To learn more, see our [Setting up Mautrix LinkedIn bridging](./docs/configuring-playbook-bridge-mautrix-linkedin.md) documentation page.
+
+This bridge supersedes [beeper-linkedin](./docs/configuring-playbook-bridge-beeper-linkedin.md), which is now considered unmaintained (its [upstream repository](https://github.com/beeper/linkedin) has been archived). The old bridge remains installable, but you may wish to switch. Both bridges claim the same appservice namespaces, so the playbook refuses to install mautrix-linkedin while beeper-linkedin is still enabled.
+
+## Support for bridging to LINE via beeper-line
+
+Thanks to [Co van Leeuwen](https://github.com/c00), the playbook can now bridge [LINE](https://line.me/) via [beeper-line](https://github.com/beeper/line), a bridge based on the modern mautrix bridge framework. It supports LINE accounts with Letter Sealing enabled or disabled and bridges messages, media, reactions, replies, receipts, and other common chat features.
+
+The bridge identifies itself as a LINE Chrome Extension client, so it cannot be used at the same time as the real LINE Chrome Extension. See [Setting up Beeper LINE bridging](docs/configuring-playbook-bridge-beeper-line.md) to get started.
+
+
+# 2026-07-19
+
+## Tuwunel now exposes its administration and /_tuwunel API paths
+
+The [Tuwunel](docs/configuring-playbook-tuwunel.md) role previously routed only the `/_matrix` path through the reverse proxy. It now also exposes the two other API paths that Tuwunel serves.
+
+The Synapse-compatible administration API (`/_synapse/admin`) powers administration dashboards and moderation bots. As with Synapse and Dendrite, the playbook now exposes it automatically when such a tool is installed: publicly for [Ketesa](docs/configuring-playbook-ketesa.md) or [Element Admin](docs/configuring-playbook-element-admin.md), and on the internal entrypoint for [Draupnir](docs/configuring-playbook-bot-draupnir.md). To expose it yourself, set `matrix_tuwunel_container_labels_public_client_synapse_admin_api_enabled: true` (or the `internal_` variant).
+
+Tuwunel also serves first-party routes under `/_tuwunel`, including its native OpenID Connect provider endpoints, which the reverse proxy must route for OIDC login to work. This path is now routed on the public entrypoint by default. To keep it off the public entrypoint, set `matrix_tuwunel_container_labels_public_tuwunel_api_enabled: false`.
+
+
+# 2026-07-18
+
+## LiveKit Server port configuration must be unambiguous now
+
+This only affects you if you have configured a LiveKit Server RTC port range (`livekit_server_config_rtc_port_range_start` and `livekit_server_config_rtc_port_range_end`).
+
+LiveKit only uses one of the two port configuration mechanisms: when a port range is defined, the multiplexed UDP port (`livekit_server_config_rtc_udp_port`) is ignored entirely. Previously, the role would silently render its default UDP port (7882) into the configuration alongside your port range, misleadingly suggesting that both are in effect.
+
+The role now asks you to make the choice explicit: if you define a port range, unset the UDP port by adding `livekit_server_config_rtc_udp_port: ''` to your `vars.yml` file. A validation error will guide you, if your configuration is affected.
+
+
+# 2026-07-17
+
+## prometheus-nginxlog-exporter metric names have changed
+
+If you have enabled [metrics for nginx logs](docs/configuring-playbook-prometheus-grafana.md) (`prometheus_nginxlog_exporter_enabled: true`), note that the exporter's metric names have changed.
+
+The exporter's configuration used to ship a leftover `myprefix` placeholder as the metric name prefix, producing metrics like `myprefix_http_response_count_total`. The bundled Grafana dashboard queries unprefixed metric names (`http_response_count_total`), so it could never show any data (reported in [#3380](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3380)).
+
+Metric names are now unprefixed, matching the bundled dashboard, which should start working. Each metric carries a `namespace` label, whose value is now `nginx` (previously `matrix`); it is configurable via `prometheus_nginxlog_exporter_config_namespace_name`. If you have built custom dashboards or alerts on top of the old `myprefix_*` metric names, adjust them accordingly, or restore the old behavior by setting `prometheus_nginxlog_exporter_config_namespace_metrics_prefix: myprefix` in your `vars.yml` file.
+
+
+# 2026-07-16
+
+## (Backward Compatibility Break) Bridge variables have been renamed
+
+All bridge roles (`roles/custom/matrix-bridge-*`) now use a uniform variable naming scheme, where the variable prefix matches the role directory name. This adopts the naming policy proposed in [#4705](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4705) and requested in [#5096](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5096).
+
+Previously, bridge variable prefixes were all over the place (`matrix_mautrix_telegram_*`, `matrix_heisenbridge_*`, `matrix_steam_bridge_*`, etc.). Now, they all follow the same pattern that bot roles (`matrix_bot_<name>_*`) have been using for years: the `matrix-bridge-mautrix-telegram` role uses `matrix_bridge_mautrix_telegram_*` variables, the `matrix-bridge-steam` role uses `matrix_bridge_steam_*` variables, and so on.
+
+Only Ansible variables were renamed. Systemd service names, container names, `/matrix/*` directories, database names and usernames, and appservice registration contents (tokens, bot usernames) all remain the same. No data migration is necessary and bridges keep working as before, once you rename the variables in your `vars.yml` configuration file.
+
+The playbook will let you know if your configuration still uses old-style variable names.
+
+Here is the full rename map:
+
+| Old variable prefix | New variable prefix |
+|---------------------|---------------------|
+| `matrix_appservice_discord_` | `matrix_bridge_appservice_discord_` |
+| `matrix_appservice_irc_` | `matrix_bridge_appservice_irc_` |
+| `matrix_beeper_linkedin_` | `matrix_bridge_beeper_linkedin_` |
+| `matrix_heisenbridge_` | `matrix_bridge_heisenbridge_` |
+| `matrix_hookshot_` | `matrix_bridge_hookshot_` |
+| `matrix_mautrix_androidsms_` | `matrix_bridge_mautrix_wsproxy_androidsms_` |
+| `matrix_mautrix_bluesky_` | `matrix_bridge_mautrix_bluesky_` |
+| `matrix_mautrix_discord_` | `matrix_bridge_mautrix_discord_` |
+| `matrix_mautrix_gmessages_` | `matrix_bridge_mautrix_gmessages_` |
+| `matrix_mautrix_googlechat_` | `matrix_bridge_mautrix_googlechat_` |
+| `matrix_mautrix_gvoice_` | `matrix_bridge_mautrix_gvoice_` |
+| `matrix_mautrix_imessage_` | `matrix_bridge_mautrix_wsproxy_imessage_` |
+| `matrix_mautrix_meta_instagram_` | `matrix_bridge_mautrix_meta_instagram_` |
+| `matrix_mautrix_meta_messenger_` | `matrix_bridge_mautrix_meta_messenger_` |
+| `matrix_mautrix_signal_` | `matrix_bridge_mautrix_signal_` |
+| `matrix_mautrix_slack_` | `matrix_bridge_mautrix_slack_` |
+| `matrix_mautrix_telegram_` | `matrix_bridge_mautrix_telegram_` |
+| `matrix_mautrix_twitter_` | `matrix_bridge_mautrix_twitter_` |
+| `matrix_mautrix_whatsapp_` | `matrix_bridge_mautrix_whatsapp_` |
+| `matrix_mautrix_wsproxy_` | `matrix_bridge_mautrix_wsproxy_` |
+| `matrix_meshtastic_relay_` | `matrix_bridge_meshtastic_relay_` |
+| `matrix_mx_puppet_groupme_` | `matrix_bridge_mx_puppet_groupme_` |
+| `matrix_mx_puppet_steam_` | `matrix_bridge_mx_puppet_steam_` |
+| `matrix_postmoogle_` | `matrix_bridge_postmoogle_` |
+| `matrix_rustpush_bridge_` | `matrix_bridge_rustpush_` |
+| `matrix_sms_bridge_` | `matrix_bridge_sms_` |
+| `matrix_steam_bridge_` | `matrix_bridge_steam_` |
+| `matrix_wechat_` | `matrix_bridge_wechat_` |
+
+A few special cases beyond the prefix map:
+
+- `matrix_mautrix_signal_wsproxy_syncproxy_connection_string` (a variable of the mautrix-wsproxy role, despite its name) is now `matrix_bridge_mautrix_wsproxy_syncproxy_connection_string`
+- `matrix_playbook_migration_matrix_postmoogle_migration_validation_enabled` is now `matrix_playbook_migration_matrix_bridge_postmoogle_migration_validation_enabled`
+
+You can update your `vars.yml` file automatically with this `sed` command (on macOS, use `sed -i ''` instead of `sed -i`):
+
+```sh
+sed -i \
+  -e 's/matrix_appservice_discord_/matrix_bridge_appservice_discord_/g' \
+  -e 's/matrix_appservice_irc_/matrix_bridge_appservice_irc_/g' \
+  -e 's/matrix_beeper_linkedin_/matrix_bridge_beeper_linkedin_/g' \
+  -e 's/matrix_heisenbridge_/matrix_bridge_heisenbridge_/g' \
+  -e 's/matrix_hookshot_/matrix_bridge_hookshot_/g' \
+  -e 's/matrix_mautrix_androidsms_/matrix_bridge_mautrix_wsproxy_androidsms_/g' \
+  -e 's/matrix_mautrix_bluesky_/matrix_bridge_mautrix_bluesky_/g' \
+  -e 's/matrix_mautrix_discord_/matrix_bridge_mautrix_discord_/g' \
+  -e 's/matrix_mautrix_gmessages_/matrix_bridge_mautrix_gmessages_/g' \
+  -e 's/matrix_mautrix_googlechat_/matrix_bridge_mautrix_googlechat_/g' \
+  -e 's/matrix_mautrix_gvoice_/matrix_bridge_mautrix_gvoice_/g' \
+  -e 's/matrix_mautrix_imessage_/matrix_bridge_mautrix_wsproxy_imessage_/g' \
+  -e 's/matrix_mautrix_meta_instagram_/matrix_bridge_mautrix_meta_instagram_/g' \
+  -e 's/matrix_mautrix_meta_messenger_/matrix_bridge_mautrix_meta_messenger_/g' \
+  -e 's/matrix_mautrix_signal_wsproxy_syncproxy_connection_string/matrix_bridge_mautrix_wsproxy_syncproxy_connection_string/g' \
+  -e 's/matrix_mautrix_signal_/matrix_bridge_mautrix_signal_/g' \
+  -e 's/matrix_mautrix_slack_/matrix_bridge_mautrix_slack_/g' \
+  -e 's/matrix_mautrix_telegram_/matrix_bridge_mautrix_telegram_/g' \
+  -e 's/matrix_mautrix_twitter_/matrix_bridge_mautrix_twitter_/g' \
+  -e 's/matrix_mautrix_whatsapp_/matrix_bridge_mautrix_whatsapp_/g' \
+  -e 's/matrix_mautrix_wsproxy_/matrix_bridge_mautrix_wsproxy_/g' \
+  -e 's/matrix_meshtastic_relay_/matrix_bridge_meshtastic_relay_/g' \
+  -e 's/matrix_mx_puppet_groupme_/matrix_bridge_mx_puppet_groupme_/g' \
+  -e 's/matrix_mx_puppet_steam_/matrix_bridge_mx_puppet_steam_/g' \
+  -e 's/matrix_postmoogle_/matrix_bridge_postmoogle_/g' \
+  -e 's/matrix_rustpush_bridge_/matrix_bridge_rustpush_/g' \
+  -e 's/matrix_sms_bridge_/matrix_bridge_sms_/g' \
+  -e 's/matrix_steam_bridge_/matrix_bridge_steam_/g' \
+  -e 's/matrix_wechat_/matrix_bridge_wechat_/g' \
+  -e 's/matrix_playbook_migration_matrix_postmoogle_migration_validation_enabled/matrix_playbook_migration_matrix_bridge_postmoogle_migration_validation_enabled/g' \
+  vars.yml
+```
+
+The `sed` command only replaces prefixes followed by an underscore, so values that intentionally match old prefixes (like the default database names, e.g. `matrix_mautrix_telegram`) are not affected.
+
+**Note**: if you have defined your own custom variables whose names embed an old prefix (e.g. `vault_matrix_postmoogle_password` referencing a secret in an Ansible Vault file), the `sed` command renames such references too. Either rename your custom variables to match (including their definitions in encrypted vault files, which `sed` cannot reach), or revert those spots manually.
+
+# 2026-07-15
+
+## Google Voice bridging
+
+The playbook can now bridge [Google Voice](https://voice.google.com/) via the [mautrix-gvoice](https://github.com/mautrix/gvoice) bridge. Text and media flow both ways, and portal rooms build themselves for your recent conversations.
+
+Login is by cookie, not a paired phone: you copy the cookies from a browser signed in to voice.google.com and hand them to the bot. Google expires them on its own schedule, so expect to log in again every so often. See [Setting up Mautrix Google Voice bridging](./docs/configuring-playbook-bridge-mautrix-gvoice.md) to get started.
+
+## matrix-appservice-kakaotalk has been removed from the playbook
+
+The [matrix-appservice-kakaotalk](./docs/configuring-playbook-bridge-appservice-kakaotalk.md) bridge has been removed from the playbook. This component could only be installed by self-building its source code, and its upstream repository has become unreachable, which makes installation impossible. The bridge was also based on the unmaintained node-kakao library, and there have been reports that using it may get KakaoTalk accounts banned.
+
+The playbook will let you know if you're using any `matrix_appservice_kakaotalk_*` variables. You'll need to remove them from `vars.yml` and potentially [uninstall the component manually](./docs/configuring-playbook-bridge-appservice-kakaotalk.md#uninstalling-the-component-manually).
+
+## Dedicated CAPTCHA variables for Matrix Authentication Service
+
+[Matrix Authentication Service](./docs/configuring-playbook-matrix-authentication-service.md) can now be protected with CAPTCHA (ReCaptcha v2, Cloudflare Turnstile, or hCaptcha) via dedicated variables, instead of going through `matrix_authentication_service_configuration_extension_yaml`. See the [captcha documentation](./docs/configuring-captcha.md#matrix-authentication-service) for details.
+
+# 2026-07-14
+
+## The playbook no longer ships a custom welcome page for Element Web
+
+Element Web [redesigned its welcome page](https://github.com/element-hq/element-web/pull/33211) (the screen shown at `/#/welcome` before logging in) into a built-in component and no longer loads a custom `welcome.html` file by default. Since the playbook upgraded to an Element Web version containing that change (spring 2026), the custom welcome page the playbook installed (and the variables customizing it) had silently stopped having any effect.
+
+The playbook now embraces the new upstream behavior and no longer ships its own `welcome.html`. The following variables have been removed and the playbook will let you know if you're still using them: `matrix_client_element_welcome_headline`, `matrix_client_element_welcome_text`, `matrix_client_element_welcome_logo_link` and `matrix_client_element_page_template_welcome_path`.
+
+Most welcome page customizations keep working, because they go through Element Web's branding configuration, which the new welcome page still honors:
+
+- a custom logo, via `matrix_client_element_welcome_logo` (or `matrix_client_element_branding_auth_header_logo_url`)
+- a custom background, via `matrix_client_element_branding_welcome_background_url`
+
+If you need a fully custom welcome page, you can self-host an HTML page and point Element Web at it, like this:
+
+```yaml
+matrix_client_element_configuration_extension_json: |
+  {
+    "embedded_pages": {
+      "welcome_url": "https://example.com/my-welcome.html"
+    }
+  }
+```
+
+## BorgBackup now includes Synapse's local thumbnails
+
+For Synapse servers, the built-in [BorgBackup](./docs/configuring-playbook-backup-borg.md) integration no longer excludes the media store's `local_thumbnails` directory from backups.
+
+Synapse only generates thumbnails of local media at upload time (unless `dynamic_thumbnails` is enabled, which the playbook does not do), and there is no tooling to regenerate them. Restoring a backup made with the previous exclusion list therefore left all previously uploaded local images without thumbnails. The [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) recommends backing this directory up, and the playbook now follows that recommendation.
+
+Expect your backups to grow somewhat, depending on how much image media your local users have uploaded. If you prefer the old behavior, you can redefine `backup_borg_location_exclude_patterns` in your `vars.yml`.
+
+# 2026-07-12
+
+## matrix-registration-bot has been removed from the playbook
+
+The [matrix-registration-bot](./docs/configuring-playbook-bot-matrix-registration-bot.md) service has been removed from the playbook, as it has been unmaintained.
+
+The playbook will let you know if you're using any `matrix_bot_matrix_registration_bot_*` variables. You'll need to remove them from `vars.yml` and potentially [uninstall the component manually](./docs/configuring-playbook-bot-matrix-registration-bot.md#uninstalling-the-component-manually).
+
+## Continuwuity v26 no longer supports LDAP
+
+The playbook now installs [Continuwuity](./docs/configuring-playbook-continuwuity.md) v26, a major upgrade from the v0.5.x series which **removes LDAP authentication support** (see the [v26.6.0 release notes](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.0)).
+
+The playbook never exposed dedicated variables for Continuwuity's LDAP support, so most people are unaffected. However, if you had enabled LDAP via `matrix_continuwuity_environment_variables_extension` or a custom configuration template, you'll need to migrate to another authentication method, such as the newly introduced [OpenID Connect support](https://continuwuity.org/guides/oidc).
+
+# 2026-06-29
+
+## Support for running on Synology DSM
+
+Thanks to [cksit](https://github.com/cksit), the playbook can now run on [Synology DSM](https://www.synology.com/dsm) 7 and later.
+
+Synology hosts are detected automatically (via `/etc/synoinfo.conf`), so other systems are unaffected. On DSM, the playbook uses the platform's native user management (`synouser`/`synogroup`), works around a Docker SDK incompatibility, and installs a small boot-fix service that handles a few DSM-specific boot quirks.
+
+To get started, see the new [Configuring Synology DSM](./docs/configuring-playbook-synology.md) documentation page.
+
+## Mautrix bridges now expose their API (for Mautrix Manager and similar tools)
+
+The playbook now exposes the HTTP API of each [mautrix](https://github.com/mautrix) bridge, so tools like [Mautrix Manager](https://github.com/mautrix/manager) can help you log into them. This is especially useful for [mautrix-gmessages](./docs/configuring-playbook-bridge-mautrix-gmessages.md): Google has removed its QR-code login, leaving a [manual cookie-extraction flow](https://docs.mau.fi/bridges/go/gmessages/authentication.html) that tools like Mautrix Manager can streamline.
+
+The API is exposed at `https://matrix.example.com/bridges/SERVICENAME` (for example, `https://matrix.example.com/bridges/gmessages`) and is advertised via a new `/.well-known/matrix/mautrix` file, so compatible tools can discover your bridges automatically. Such tools authenticate with your own Matrix access token, so no bridge secret needs to be shared with them.
+
+This affects all mautrix bridges based on the new bridge framework (bluesky, gmessages, meta-instagram, meta-messenger, signal, slack, telegram, twitter and whatsapp) and is enabled by default.
+
+To learn more (including how to turn it off), see the [Expose the bridge's API](./docs/configuring-playbook-bridge-mautrix-bridges.md#expose-the-bridges-api-for-mautrix-manager-and-similar-tools) section on our common mautrix bridges documentation page.
+
+# 2026-06-28
+
+## baibot now supports Venice, our recommended provider
+
+[baibot](./docs/configuring-playbook-bot-baibot.md) now ships a preset for the [Venice](./docs/configuring-playbook-bot-baibot.md#venice) provider, and it's the one we recommend. It's the most capable provider baibot supports (text generation with vision, file inputs and web search, speech-to-text, text-to-speech, and image generation and editing), and the only one that runs inference with no logging and no training on your data.
+
+Enabling it takes a preset toggle and an API key:
+
+```yaml
+matrix_bot_baibot_config_agents_static_definitions_venice_enabled: true
+
+matrix_bot_baibot_config_agents_static_definitions_venice_config_api_key: "YOUR_API_KEY_HERE"
+```
+
+[OpenAI](https://openai.com/) and baibot's other providers remain fully supported. To get started, see the [Setting up baibot](./docs/configuring-playbook-bot-baibot.md#venice) documentation page.
+
 # 2026-06-24
 
 ## Support for bridging to iMessage via RustPush

Makefile

@@ -2,11 +2,14 @@
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
-.PHONY: roles lint
+.PHONY: roles lint add-inventory-host
 
 help: ## Show this help.
 	@grep -F -h "##" $(MAKEFILE_LIST) | grep -v grep | sed -e 's/\\$$//' | sed -e 's/##//'
 
+add-inventory-host: ## Adds a new host to the inventory, creating the inventory files if necessary (e.g. `make add-inventory-host domain=example.com ip=1.2.3.4`)
+	@./bin/add-inventory-host.sh "$(domain)" "$(ip)"
+
 roles: ## Pull roles
 	rm -rf roles/galaxy
 	ansible-galaxy install -r requirements.yml -p roles/galaxy/ --force

README.md

@@ -68,6 +68,7 @@ Web clients for Matrix that you can host on your own domains.
 | [Sable](https://github.com/SableClient/Sable) | ❌ | Simple, elegant and secure web client | [Link](docs/configuring-playbook-client-sable.md) |
 | [SchildiChat Web](https://schildi.chat/) | ❌ | Based on Element Web, with a more traditional instant messaging experience | [Link](docs/configuring-playbook-client-schildichat-web.md) |
 | [FluffyChat Web](https://fluffychat.im/) | ❌ | The cutest messenger in Matrix | [Link](docs/configuring-playbook-client-fluffychat-web.md) |
+| [Commet](https://github.com/commetchat/commet) | ❌ | Matrix web client | [Link](docs/configuring-playbook-client-commet.md) |
 
 ### Server Components
 
@@ -115,6 +116,8 @@ Bridges can be used to connect your Matrix installation with third-party communi
 | [mautrix-slack](https://github.com/mautrix/slack) | ❌ | Bridge to [Slack](https://slack.com/) | [Link](docs/configuring-playbook-bridge-mautrix-slack.md) |
 | [mautrix-telegram](https://github.com/mautrix/telegram) | ❌ | Bridge to [Telegram](https://telegram.org/) | [Link](docs/configuring-playbook-bridge-mautrix-telegram.md) |
 | [mautrix-gmessages](https://github.com/mautrix/gmessages) | ❌ | Bridge to [Google Messages](https://messages.google.com/) | [Link](docs/configuring-playbook-bridge-mautrix-gmessages.md) |
+| [mautrix-gvoice](https://github.com/mautrix/gvoice) | ❌ | Bridge to [Google Voice](https://voice.google.com/) | [Link](docs/configuring-playbook-bridge-mautrix-gvoice.md) |
+| [mautrix-linkedin](https://github.com/mautrix/linkedin) | ❌ | Bridge to [LinkedIn](https://www.linkedin.com/) | [Link](docs/configuring-playbook-bridge-mautrix-linkedin.md) |
 | [mautrix-whatsapp](https://github.com/mautrix/whatsapp) | ❌ | Bridge to [WhatsApp](https://www.whatsapp.com/) | [Link](docs/configuring-playbook-bridge-mautrix-whatsapp.md) |
 | [mautrix-wsproxy](https://github.com/mautrix/wsproxy) | ❌ | Bridge to Android SMS or Apple iMessage | [Link](docs/configuring-playbook-bridge-mautrix-wsproxy.md) |
 | [matrix-rustpush-bridge](https://github.com/jasonlaguidice/imessage) | ❌ | Bridge to [iMessage](https://support.apple.com/messages) via Apple Push Notification service | [Link](docs/configuring-playbook-bridge-rustpush.md) |
@@ -123,9 +126,8 @@ Bridges can be used to connect your Matrix installation with third-party communi
 | [mautrix-googlechat](https://github.com/mautrix/googlechat) | ❌ | Bridge to [Google Chat](https://en.wikipedia.org/wiki/Google_Chat) | [Link](docs/configuring-playbook-bridge-mautrix-googlechat.md) |
 | [mautrix-meta](https://github.com/mautrix/meta) | ❌ | Bridge to [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) | Link for [Messenger](docs/configuring-playbook-bridge-mautrix-meta-messenger.md) / [Instagram](docs/configuring-playbook-bridge-mautrix-meta-instagram.md) |
 | [mautrix-signal](https://github.com/mautrix/signal) | ❌ | Bridge to [Signal](https://www.signal.org/) | [Link](docs/configuring-playbook-bridge-mautrix-signal.md) |
-| [beeper-linkedin](https://github.com/beeper/linkedin) | ❌ | Bridge to [LinkedIn](https://www.linkedin.com/) | [Link](docs/configuring-playbook-bridge-beeper-linkedin.md) |
+| [beeper-line](https://github.com/beeper/line) | ❌ | Bridge to [LINE](https://line.me/) | [Link](docs/configuring-playbook-bridge-beeper-line.md) |
 | [matrix-appservice-irc](https://github.com/matrix-org/matrix-appservice-irc) | ❌ | Bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) | [Link](docs/configuring-playbook-bridge-appservice-irc.md) |
-| [matrix-appservice-kakaotalk](https://src.miscworks.net/fair/matrix-appservice-kakaotalk) | ❌ | Bridge to [Kakaotalk](https://www.kakaocorp.com/page/service/service/KakaoTalk?lang=ENG) | [Link](docs/configuring-playbook-bridge-appservice-kakaotalk.md) |
 | [matrix-appservice-discord](https://github.com/matrix-org/matrix-appservice-discord) | ❌ | Bridge to [Discord](https://discordapp.com/) | [Link](docs/configuring-playbook-bridge-appservice-discord.md) |
 | [matrix-hookshot](https://github.com/matrix-org/matrix-hookshot) | ❌ | Bridge for generic webhooks and multiple project management services, such as GitHub, GitLab, Figma, and Jira in particular | [Link](docs/configuring-playbook-bridge-hookshot.md) |
 | [matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) | ❌ | Bridge to SMS | [Link](docs/configuring-playbook-bridge-matrix-bridge-sms.md) |
@@ -145,11 +147,11 @@ Bots provide various additional functionality to your installation.
 | ---- | -------- | ----------- | ------------- |
 | [baibot](https://github.com/etkecc/baibot) | ❌ | Bot that exposes the power of [AI](https://en.wikipedia.org/wiki/Artificial_intelligence) / [Large Language Models](https://en.wikipedia.org/wiki/Large_language_model) to you | [Link](docs/configuring-playbook-bot-baibot.md) |
 | [matrix-reminder-bot](https://github.com/anoadragon453/matrix-reminder-bot) | ❌ | Bot for scheduling one-off & recurring reminders and alarms | [Link](docs/configuring-playbook-bot-matrix-reminder-bot.md) |
-| [matrix-registration-bot](https://github.com/moan0s/matrix-registration-bot) | ❌ | Bot for invitations by creating and managing registration tokens | [Link](docs/configuring-playbook-bot-matrix-registration-bot.md) |
 | [maubot](https://github.com/maubot/maubot) | ❌ | Plugin-based Matrix bot system | [Link](docs/configuring-playbook-bot-maubot.md) |
 | [Honoroit](https://github.com/etkecc/honoroit) | ❌ | Helpdesk bot | [Link](docs/configuring-playbook-bot-honoroit.md) |
 | [Mjolnir](https://github.com/matrix-org/mjolnir) | ❌ | Moderation tool for Matrix | [Link](docs/configuring-playbook-bot-mjolnir.md) |
 | [Draupnir](https://github.com/the-draupnir-project/Draupnir) | ❌ | Moderation tool for Matrix (Fork of Mjolnir) | [Link](docs/configuring-playbook-bot-draupnir.md) (for [appservice mode](docs/configuring-playbook-appservice-draupnir-for-all.md))|
+| [Meowlnir](https://github.com/maunium/meowlnir) | ❌ | Moderation tool for Matrix, running in appservice mode | [Link](docs/configuring-playbook-bot-meowlnir.md) |
 | [Buscarron](https://github.com/etkecc/buscarron) | ❌ | Web forms (HTTP POST) to Matrix | [Link](docs/configuring-playbook-bot-buscarron.md) |
 
 ### Administration

bin/add-inventory-host.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+
+# SPDX-FileCopyrightText: 2026 MDAD project contributors
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+# Adds a new host to the inventory, based on the example files in `examples/`:
+# - creates `inventory/hosts` (or adds the host to it, if it already exists)
+# - creates `inventory/host_vars/matrix.DOMAIN/vars.yml` with strong secrets generated automatically
+#
+# Existing configuration for the same host is never overwritten - the script refuses to run instead.
+#
+# Usage: bin/add-inventory-host.sh <base-domain> <server-address>
+#
+# - <base-domain> is the base domain (`example.com`), not the Matrix server hostname (`matrix.example.com`)
+# - <server-address> is the server's external IP address or domain name
+
+set -euo pipefail
+
+base_path="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+if [ $# -ne 2 ]; then
+	echo "Usage: $0 <base-domain> <server-address>" >&2
+	echo "Example: $0 example.com 1.2.3.4" >&2
+	exit 1
+fi
+
+domain="$1"
+server_address="$2"
+
+if ! printf '%s' "${domain}" | grep -Eq '^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$'; then
+	echo "Error: '${domain}' does not look like a valid domain name" >&2
+	exit 1
+fi
+
+if ! printf '%s' "${server_address}" | grep -Eq '^[A-Za-z0-9.:_-]+$'; then
+	echo "Error: '${server_address}' does not look like a valid server address (IP address or domain name)" >&2
+	exit 1
+fi
+
+case "${domain}" in
+	matrix.*)
+		echo "Warning: you likely need to pass your base domain (example.com), not the Matrix server hostname (matrix.example.com)." >&2
+		echo "Proceeding anyway. Your Matrix server hostname will be: matrix.${domain}" >&2
+		;;
+esac
+
+matrix_hostname="matrix.${domain}"
+hosts_file="${base_path}/inventory/hosts"
+vars_dir="${base_path}/inventory/host_vars/${matrix_hostname}"
+vars_file="${vars_dir}/vars.yml"
+hosts_entry="${matrix_hostname} ansible_host=${server_address} ansible_ssh_user=root"
+
+if [ -e "${vars_dir}" ]; then
+	echo "Error: ${vars_dir} already exists. Refusing to overwrite it." >&2
+	exit 1
+fi
+
+if [ -f "${hosts_file}" ]; then
+	if ! grep -q '^\[matrix_servers\]' "${hosts_file}"; then
+		echo "Error: ${hosts_file} exists, but does not contain a [matrix_servers] section." >&2
+		echo "Unrecognized inventory format. Add the host to it manually:" >&2
+		echo "${hosts_entry}" >&2
+		exit 1
+	fi
+
+	matrix_hostname_pattern="$(printf '%s' "${matrix_hostname}" | sed 's|\.|\\.|g')"
+	if grep -Eq "^${matrix_hostname_pattern}([[:space:]]|$)" "${hosts_file}"; then
+		echo "Error: ${hosts_file} already contains an entry for ${matrix_hostname}. Refusing to modify it." >&2
+		exit 1
+	fi
+fi
+
+generate_secret() {
+	if command -v pwgen >/dev/null 2>&1; then
+		pwgen -s 64 1
+	elif command -v openssl >/dev/null 2>&1; then
+		openssl rand -base64 192 | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c 64
+	else
+		head -c 4096 /dev/urandom | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c 64
+	fi
+}
+
+generic_secret_key="$(generate_secret)"
+postgres_password="$(generate_secret)"
+
+for secret in "${generic_secret_key}" "${postgres_password}"; do
+	if [ "${#secret}" -lt 64 ]; then
+		echo "Error: failed to generate a secret" >&2
+		exit 1
+	fi
+done
+
+mkdir -p "${vars_dir}"
+
+sed \
+	-e "s|^matrix_domain:.*|matrix_domain: ${domain}|" \
+	-e "s|^matrix_homeserver_generic_secret_key:.*|matrix_homeserver_generic_secret_key: '${generic_secret_key}'|" \
+	-e "s|^postgres_connection_password:.*|postgres_connection_password: '${postgres_password}'|" \
+	"${base_path}/examples/vars.yml" > "${vars_file}"
+
+if [ -f "${hosts_file}" ]; then
+	# Insert the new host right after the [matrix_servers] section header.
+	hosts_file_tmp="$(mktemp "${hosts_file}.XXXXXX")"
+	awk -v entry="${hosts_entry}" '{print} $0 ~ /^\[matrix_servers\]/ && !done {print entry; done=1}' \
+		"${hosts_file}" > "${hosts_file_tmp}"
+	mv "${hosts_file_tmp}" "${hosts_file}"
+else
+	sed \
+		-e "s|^matrix\.example\.com .*|${hosts_entry}|" \
+		"${base_path}/examples/hosts" > "${hosts_file}"
+fi
+
+echo "Added host ${matrix_hostname} to the inventory:"
+echo "- ${hosts_file}"
+echo "- ${vars_file}"
+echo ""
+echo "Secrets were generated automatically for matrix_homeserver_generic_secret_key and postgres_connection_password."
+echo "Review and adjust these files before installing."

bin/rebuild-mautrix-meta-instagram.sh

@@ -1,54 +0,0 @@
-#!/bin/bash
-
-# SPDX-FileCopyrightText: 2024 Slavi Pantaleev
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-set -euxo pipefail
-
-# This script rebuilds the mautrix-meta-instagram Ansible role, using the mautrix-meta-messenger role as a source.
-
-if [ $# -eq 0 ]; then
-	echo "Error: No argument supplied. Please provide the path to the roles/custom directory."
-	exit 1
-fi
-
-roles_path=$1
-
-messenger_role_path=$roles_path/matrix-bridge-mautrix-meta-messenger
-instagram_role_path=$roles_path/matrix-bridge-mautrix-meta-instagram
-
-if [ ! -d $messenger_role_path ]; then
-	echo "Cannot find: $messenger_role_path"
-	exit 1
-fi
-
-if [ -d $instagram_role_path ]; then
-	rm -rf $instagram_role_path
-fi
-
-cp -ar $messenger_role_path $instagram_role_path
-
-find "$instagram_role_path" -type f | while read -r file; do
-	sed --in-place 's/matrix_mautrix_meta_messenger_/matrix_mautrix_meta_instagram_/g' "$file"
-	sed --in-place 's/mautrix-meta-messenger/mautrix-meta-instagram/g' "$file"
-done
-
-sed --in-place 's/matrix_mautrix_meta_instagram_meta_mode: \(.*\)/matrix_mautrix_meta_instagram_meta_mode: instagram/g' $instagram_role_path/defaults/main.yml
-sed --in-place 's/matrix_mautrix_meta_instagram_identifier: \(.*\)/matrix_mautrix_meta_instagram_identifier: matrix-mautrix-meta-instagram/g' $instagram_role_path/defaults/main.yml
-
-# Create the README.md file with the license header
-cat > $instagram_role_path/README.md << 'EOF'
-<!--
-SPDX-FileCopyrightText: 2024 - 2025 MDAD Contributors
-
-SPDX-License-Identifier: AGPL-3.0-or-later
--->
-EOF
-
-echo "" >> $instagram_role_path/README.md
-echo "# matrix-mautrix-meta-instagram" >> $instagram_role_path/README.md
-echo "" >> $instagram_role_path/README.md
-echo "This bridge role is derived from the matrix-mautrix-meta-messenger Ansible role via automatic changes (see \`just rebuild-mautrix-meta-instagram\` or \`bin/rebuild-mautrix-meta-instagram.sh\`)." >> $instagram_role_path/README.md
-echo "" >> $instagram_role_path/README.md
-echo "If you'd like to make a change to this role, consider making it to the \`matrix-mautrix-meta-messenger\` role instead." >> $instagram_role_path/README.md

docs/README.md

@@ -76,6 +76,8 @@ If your server and services experience issues, feel free to come to [our support
 
 - [Alternative architectures](alternative-architectures.md)
 
+- [Configuring Synology DSM](configuring-playbook-synology.md)
+
 - [Container images used by the playbook](container-images.md)
 
 - [Obtaining an Access Token](obtaining-access-tokens.md)
@@ -88,6 +90,8 @@ If your server and services experience issues, feel free to come to [our support
 
 - [Self-building](self-building.md)
 
+- [Style guide for playbook developers](style-guide.md)
+
 - [Uninstalling](uninstalling.md)
 
 - [Updating users passwords](updating-users-passwords.md)

docs/ansible.md

@@ -39,6 +39,18 @@ If using the `pip` method, do note that the `ansible-playbook` binary may not be
 
 **Note**: Both of the above methods are a bad way to run system software such as Ansible. If you find yourself needing to resort to such hacks, please consider reporting a bug to your distribution and/or switching to a sane distribution, which provides up-to-date software.
 
+## SSH host key and passphrase prompts
+
+If Ansible fails with `Host key verification failed` (or a similar `Data could not be sent to remote host` error) without asking you to confirm the SSH host key of your server, you're likely on Ansible 2.21 or later.
+
+Since Ansible 2.21, forked workers call `setsid()` and thus lose the controlling terminal. SSH cannot open `/dev/tty` anymore, so it can no longer ask you to confirm an unknown host key or prompt you for the passphrase of an SSH key.
+
+To fix host key errors, connect to the server once (e.g. `ssh root@matrix.example.com`) and confirm the host key. Ansible runs after that will find it in your `known_hosts` file.
+
+If your SSH key is protected by a passphrase, load it into an [ssh-agent](https://man.openbsd.org/ssh-agent) (e.g. `ssh-add ~/.ssh/id_ed25519`), so that SSH does not need to prompt for the passphrase.
+
+**Note**: if you're [using Ansible via Docker](#using-ansible-via-docker), host keys of previously unknown hosts are accepted automatically, so only the passphrase advice above applies to you. For the agent to be reachable inside the container, share its socket by adding `--mount type=bind,src=$SSH_AUTH_SOCK,dst=/ssh-agent --env SSH_AUTH_SOCK=/ssh-agent` to `docker run`. If the key is already loaded into the agent, you do not need to mount the SSH key file into the container at all.
+
 ## Using Ansible via Docker
 
 Alternatively, you can run Ansible inside a Docker container (powered by the [ghcr.io/devture/ansible](https://github.com/devture/docker-ansible/pkgs/container/ansible) Docker image).
@@ -50,6 +62,8 @@ This ensures that:
 
 You can either [run Ansible in a container on the Matrix server itself](#running-ansible-in-a-container-on-the-matrix-server-itself) or [run Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server).
 
+💡 If you use [Visual Studio Code](https://code.visualstudio.com/) or [GitHub Codespaces](https://github.com/features/codespaces), the playbook also ships a [dev container](https://containers.dev/) configuration (see the `.devcontainer/` directory) based on this same Ansible Docker image, which can prepare such a containerized Ansible environment for you automatically.
+
 ### Running Ansible in a container on the Matrix server itself
 
 To run Ansible in a (Docker) container on the Matrix server itself, you need to have a working Docker installation. Docker is normally installed by the playbook, so this may be a bit of a chicken and egg problem. To solve it:
@@ -74,7 +88,7 @@ docker run \
 -w /work \
 --mount type=bind,src=`pwd`,dst=/work \
 --entrypoint=/bin/sh \
-ghcr.io/devture/ansible:11.6.0-r0-0
+ghcr.io/devture/ansible:14.0.0-r0-3
 ```
 
 Once you execute the above command, you'll be dropped into a `/work` directory inside a Docker container. The `/work` directory contains the playbook's code.
@@ -95,7 +109,7 @@ docker run \
 --mount type=bind,src=`pwd`,dst=/work \
 --mount type=bind,src=$HOME/.ssh/id_ed25519,dst=/root/.ssh/id_ed25519,ro \
 --entrypoint=/bin/sh \
-ghcr.io/devture/ansible:11.6.0-r0-0
+ghcr.io/devture/ansible:14.0.0-r0-3
 ```
 
 The above command tries to mount an SSH key (`$HOME/.ssh/id_ed25519`) into the container (at `/root/.ssh/id_ed25519`). If your SSH key is at a different path (not in `$HOME/.ssh/id_ed25519`), adjust that part.

docs/configuring-captcha.md

@@ -15,6 +15,8 @@ Captcha can be enabled for this home server. This file explains how to do that.
 
 The captcha mechanism used is Google's [ReCaptcha](https://www.google.com/recaptcha/). This requires API keys from Google. If your homeserver is Dendrite then [hCapcha](https://www.hcaptcha.com) can be used instead.
 
+If you are using [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md), captcha is configured there instead (it handles registration), and [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) is supported as well. See [Matrix Authentication Service](#matrix-authentication-service) below.
+
 ## ReCaptcha
 
 ### Getting keys
@@ -61,3 +63,16 @@ matrix_dendrite_client_api_recaptcha_api_js_url: 'https://js.hcaptcha.com/1/api.
 matrix_dendrite_client_api_recaptcha_form_field: 'h-captcha-response'
 matrix_dendrite_client_api_recaptcha_sitekey_class: 'h-captcha'
 ```
+
+## Matrix Authentication Service
+
+When [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md) is enabled, registration and other account operations are handled by it, so captcha protection is configured there (the Synapse and Dendrite settings above do not apply).
+
+Matrix Authentication Service supports [ReCaptcha v2](http://www.google.com/recaptcha/admin), [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) and [hCaptcha](https://dashboard.hcaptcha.com/sites/new). Obtain a site/secret key pair from your chosen service, then add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
+
+```yaml
+# Valid values: recaptcha_v2, cloudflare_turnstile, hcaptcha
+matrix_authentication_service_config_captcha_service: recaptcha_v2
+matrix_authentication_service_config_captcha_site_key: 'YOUR_SITE_KEY'
+matrix_authentication_service_config_captcha_secret_key: 'YOUR_SECRET_KEY'
+```

docs/configuring-ipv6.md

@@ -109,7 +109,7 @@ If you do have an IPv6 address, it's still worth [using curl](#with-curl) to con
 The `devture_systemd_docker_base_ipv6_enabled` setting controls whether container networks will be created with IPv6 support.
 
 Changing this setting subsequently requires manual work (deleting all container networks).
-See [I've changed the `devture_systemd_docker_base_ipv6_enabled` setting, but it doesn't seem to have any effect](#i-ve-changed-the-devture_systemd_docker_base_ipv6_enabled-setting-but-it-doesn-t-seem-to-have-any-effect).
+See [I've changed the `devture_systemd_docker_base_ipv6_enabled` setting, but it doesn't seem to have any effect](#ive-changed-the-devture_systemd_docker_base_ipv6_enabled-setting-but-it-doesnt-seem-to-have-any-effect).
 
 #### I've changed the `devture_systemd_docker_base_ipv6_enabled` setting, but it doesn't seem to have any effect.
 

docs/configuring-playbook-bot-baibot.md

@@ -14,7 +14,7 @@ SPDX-License-Identifier: AGPL-3.0-or-later
 
 🤖 [baibot](https://github.com/etkecc/baibot) (pronounced bye-bot) is a [Matrix](https://matrix.org/) bot developed by [etke.cc](https://etke.cc/) that exposes the power of [AI](https://en.wikipedia.org/wiki/Artificial_intelligence) / [Large Language Models](https://en.wikipedia.org/wiki/Large_language_model) to you. 🤖
 
-It supports [OpenAI](https://openai.com/)'s [ChatGPT](https://openai.com/blog/chatgpt/) models, as many well as other [☁️ providers](https://github.com/etkecc/baibot/blob/main/docs/providers.md).
+It supports many [☁️ providers](https://github.com/etkecc/baibot/blob/main/docs/providers.md), including the privacy-first [Venice](#venice) we recommend, [OpenAI](https://openai.com/)'s [ChatGPT](https://openai.com/blog/chatgpt/) models, and more.
 
 It's designed as a more private and [✨ featureful](https://github.com/etkecc/baibot/?tab=readme-ov-file#-features) alternative to [matrix-chatgpt-bot](./configuring-playbook-bot-chatgpt.md). See the [baibot](https://github.com/etkecc/baibot) project and its documentation for more information.
 
@@ -159,7 +159,38 @@ Agents defined statically and those created dynamically (via chat) are named dif
 
 Depending on your propensity for [GitOps](https://en.wikipedia.org/wiki/DevOps#GitOps), you may prefer to define agents statically via Ansible, or you may wish to do it dynamically via chat.
 
-Before proceeding, we recommend reading the upstream documentation on [How to choose a provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#how-to-choose-a-provider). In short, it's probably best to go with [OpenAI](#openai).
+Before proceeding, we recommend reading the upstream documentation on [How to choose a provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#how-to-choose-a-provider) for a side-by-side of what each one can do. In short: we recommend [Venice](#venice), the most capable provider baibot supports and the only one that keeps no logs and trains on nothing. If you'd rather start with the most widely-used option, [OpenAI](#openai) is a solid, well-supported choice too.
+
+#### Venice
+
+[Venice](https://venice.ai/chat?ref=kpXDe6) _(ref link with a $10 bonus for you)_ is the provider we recommend. It's the most capable one baibot supports, and the only one that pairs that full feature set with real privacy: inference runs on Venice's own GPUs or on zero-data-retention partner hardware, so your prompts and replies are stored nowhere and never used for training. It serves both frontier proprietary models and the latest open-source ones.
+
+Venice also leaves the content policy to you instead of imposing its own. Its models answer without the reflexive refusals some hosted services apply, and both text and image generation can handle adult or otherwise sensitive subjects when you need them to. Image generation ships a `safe_mode` that blurs adult content by default; you can turn it off (see the sample config). This pairs naturally with the privacy above: a bot you can speak to candidly, that keeps nothing.
+
+Unlike the [OpenAI Compatible](#openai-compatible) provider (which can also point at Venice, but drops images and can't reach its audio or native image endpoints), this is a first-class integration that exposes Venice's full parameter set: text-generation with vision, file inputs, prompt caching and native web search, plus speech-to-text, text-to-speech, and image generation and editing.
+
+You can statically-define a single [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md) instance powered by the [Venice provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#venice) with the help of the playbook's preset variables.
+
+Here's an example **addition** to your `vars.yml` file:
+
+```yaml
+matrix_bot_baibot_config_agents_static_definitions_venice_enabled: true
+
+matrix_bot_baibot_config_agents_static_definitions_venice_config_api_key: "YOUR_API_KEY_HERE"
+
+# The preset ships sensible defaults for every purpose, so changing only the API key above is enough
+# to get going. Uncomment and adjust any of these if you'd like to use different models:
+# matrix_bot_baibot_config_agents_static_definitions_venice_config_text_generation_model_id: kimi-k2-5
+# matrix_bot_baibot_config_agents_static_definitions_venice_config_image_generation_model_id: chroma
+```
+
+Because this is a [statically](https://github.com/etkecc/baibot/blob/main/docs/configuration/README.md#static-configuration)-defined agent, it will be given a `static/` ID prefix and will be named `static/venice`.
+
+Every Venice knob (sampling, caching, reasoning, web-search behavior, voice and image controls) has a matching `matrix_bot_baibot_config_agents_static_definitions_venice_config_*` variable. The [fully-commented sample config](https://github.com/etkecc/baibot/blob/main/docs/sample-provider-configs/venice.yml) explains every one of them.
+
+If you'd like to use more than one model, take a look at the [Configuring additional agents (without a preset)](#configuring-additional-agents-without-a-preset) section below.
+
+💡 You may also wish to use this new agent for [🤝 Configuring initial default handlers](#-configuring-initial-default-handlers).
 
 #### Anthropic
 
@@ -374,7 +405,7 @@ Example **additional** `vars.yml` configuration:
 # As such, changing any of these values subsequently has no effect on the bot's behavior.
 # Once initially configured, the global configuration is managed via bot commands, not via Ansible.
 
-matrix_bot_baibot_config_initial_global_config_handler_catch_all: static/openai
+matrix_bot_baibot_config_initial_global_config_handler_catch_all: static/venice
 
 # In this example, there's no need to define any of these below.
 # Configuring the catch-all purpose handler is enough.

docs/configuring-playbook-bot-draupnir.md

@@ -16,7 +16,9 @@ See the project's [documentation](https://the-draupnir-project.github.io/draupni
 
 This documentation page is about installing Draupnir in bot mode. As an alternative, you can run a multi-instance Draupnir deployment by installing [Draupnir in appservice mode](./configuring-playbook-appservice-draupnir-for-all.md) (called Draupnir-for-all) instead.
 
-If your migrating from [Mjolnir](configuring-playbook-bot-mjolnir.md), skip to [this section](#migrating-from-mjolnir-only-required-if-migrating).
+**Note**: you can also use the [Meowlnir](configuring-playbook-bot-meowlnir.md) or [Mjolnir](configuring-playbook-bot-mjolnir.md) bots, which speak the same [policy list](https://the-draupnir-project.github.io/draupnir-documentation/concepts/policy-lists) protocol.
+
+When migrating from [Mjolnir](configuring-playbook-bot-mjolnir.md), skip to [this section](#migrating-from-mjolnir-only-required-if-migrating).
 
 ## Prerequisites
 
@@ -37,6 +39,8 @@ Using your own account, create a new invite only room that you will use to manag
 > [!WARNING]
 > Anyone in this room can control the bot so it is important that you only invite trusted users to this room.
 
+The bot also needs at least a Moderator power level (50) in this room. This power level is granted in a [later step](#create-and-invite-the-bot-to-the-management-room-only-when-using-native-login-without-zero-touch-deployment), after the bot gets invited to the room.
+
 It is possible to make the management room encrypted (E2EE). If doing so, then you need to enable the native E2EE support (see [below](#native-e2ee-support)).
 
 E2EE support for the management room is mutually exclusive with Zero Touch Deployment of Draupnir.
@@ -133,6 +137,13 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-use
 
 Then, invite the bot (`@bot.draupnir:example.com`) to its management room which you have created earlier.
 
+After the bot joins, give it at least a Moderator power level (50) in the management room.
+
+> [!WARNING]
+> Draupnir stores each protection's settings as custom state events in the management room, and sending those requires a power level of 50 by default. A bot without this power level cannot save any protection settings. The failure is easy to miss and has nasty consequences: the `PolicyChangeNotification` protection, unable to remember its notifications room, will create a brand new one on every restart of the bot (and the playbook restarts it on every installation run), littering your server with abandoned rooms.
+
+This is not a concern for Zero Touch Deployment, where the bot creates the management room itself and has full control over it.
+
 ### Creating a user account for the bot (when using Zero Touch Deployment)
 
 Since Zero Touch Deployment is not validated with native login, you will need to create the user account manually.

docs/configuring-playbook-bot-matrix-registration-bot.md

@@ -1,103 +1,34 @@
 <!--
-SPDX-FileCopyrightText: 2022 - 2023 Julian-Samuel Gebühr
-SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev
+SPDX-FileCopyrightText: 2019 Edgars Voroboks
+SPDX-FileCopyrightText: 2019 Eduardo Beltrame
+SPDX-FileCopyrightText: 2019-2025 MDAD project contributors
+SPDX-FileCopyrightText: 2019-2025 Slavi Pantaleev
+SPDX-FileCopyrightText: 2020 Chris van Dijk
+SPDX-FileCopyrightText: 2020 Tulir Asokan
+SPDX-FileCopyrightText: 2020 jens quade
 SPDX-FileCopyrightText: 2022 Dennis Ciba
 SPDX-FileCopyrightText: 2022 Erick Wibben
+SPDX-FileCopyrightText: 2022 Kim Brose
 SPDX-FileCopyrightText: 2022 Kolja Lampe
-SPDX-FileCopyrightText: 2023 - 2024 MDAD project contributors
-SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
+SPDX-FileCopyrightText: 2022 Travis Ralston
+SPDX-FileCopyrightText: 2022 Vladimir Panteleev
+SPDX-FileCopyrightText: 2022 Yan Minagawa
+SPDX-FileCopyrightText: 2022, 2023 Julian-Samuel Gebühr
+SPDX-FileCopyrightText: 2024-2026 Suguru Hirahara
 
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
 
-# Setting up matrix-registration-bot (optional)
+# Setting up matrix-registration-bot (optional, removed)
 
-The playbook can install and configure [matrix-registration-bot](https://github.com/moan0s/matrix-registration-bot) for you.
+🪦 The playbook used to be able to install and configure [matrix-registration-bot](https://github.com/moan0s/matrix-registration-bot), but no longer includes this component, as it has been unmaintained.
 
-The bot allows you to easily **create and manage registration tokens** aka. invitation codes. It can be used for an invitation-based server, where you invite someone by sending them a registration token (tokens look like this: `rbalQ0zkaDSRQCOp`). They can register as per normal but have to provide a valid registration token in the final step of the registration process.
+## Uninstalling the component manually
 
-See the project's [documentation](https://github.com/moan0s/matrix-registration-bot/blob/master/README.md) to learn what it does and why it might be useful to you.
-
-## Adjusting the playbook configuration
-
-To enable the bot, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
-
-```yaml
-matrix_bot_matrix_registration_bot_enabled: true
-
-# By default, the playbook will set use the bot with a username like this: `@bot.matrix-registration-bot:example.com`.
-# Uncomment and adjust this part if you'd like to use a username different than the default
-# matrix_bot_matrix_registration_bot_matrix_user_id_localpart: bot.matrix-registration-bot
-
-# Generate a strong password for the bot. You can create one with a command like `pwgen -s 64 1`.
-matrix_bot_matrix_registration_bot_bot_password: PASSWORD_FOR_THE_BOT
-
-# Enables registration
-matrix_synapse_enable_registration: true
-
-# Restrict registration to users with a token
-matrix_synapse_registration_requires_token: true
-
-# Set an optional command prefix for the bot. This can be any arbitrary string, including whitespace.
-# Example: "!regbot "
-matrix_bot_matrix_registration_bot_bot_prefix: ""
-```
-
-The bot account will be created automatically.
-
-### Extending the configuration
-
-There are some additional things you may wish to configure about the bot.
-
-Take a look at:
-
-- `roles/custom/matrix-bot-matrix-registration-bot/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/custom/matrix-bot-matrix-registration-bot/templates/config.yaml.j2` for the bridge's default configuration
-
-## Installing
-
-After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
-
-<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
-```sh
-ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-users-created,start
-```
-
-**Notes**:
-
-- The `ensure-matrix-users-created` playbook tag makes the playbook automatically create the bot's user account.
-
-- The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
-
-  `just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed.
-
-- If you change the bot password (`matrix_bot_matrix_registration_bot_bot_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [Ketesa](configuring-playbook-ketesa.md) to change it, and then update `matrix_bot_matrix_registration_bot_bot_password` to let the bot know its new password.
-
-## Usage
-
-To use the bot, start a chat with `@bot.matrix-registration-bot:example.com` (where `example.com` is your base domain, not the `matrix.` domain).
-
-Send `help` to the bot to see the available commands.
-
-You can also refer to the upstream [Usage documentation](https://github.com/moan0s/matrix-registration-bot#supported-commands).
-
-If you have any questions, or if you need help setting it up, read the [troubleshooting guide](https://github.com/moan0s/matrix-registration-bot/blob/main/docs/troubleshooting.md) or join [#matrix-registration-bot:hyteck.de](https://matrix.to/#/#matrix-registration-bot:hyteck.de).
-
-To clean the cache (session & encryption data) after you changed the bot's username, changed the login method from access_token to password etc… you can use:
+If you still have matrix-registration-bot installed on your Matrix server, the playbook can no longer help you uninstall it and you will need to do it manually. To uninstall manually, run these commands on the server:
 
 ```sh
-just run-tags bot-matrix-registration-bot-clean-cache
-```
+systemctl disable --now matrix-bot-matrix-registration-bot.service
 
-## Troubleshooting
-
-As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-bot-matrix-registration-bot`.
-
-### Increase logging verbosity
-
-The default logging level for this component is `INFO`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
-
-```yaml
-# Valid values: ERROR, INFO, DEBUG
-matrix_bot_matrix_registration_bot_logging_level: DEBUG
+rm -rf /matrix/matrix-registration-bot
 ```

docs/configuring-playbook-bot-meowlnir.md

@@ -0,0 +1,409 @@
+<!--
+SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Setting up Meowlnir (optional)
+
+The playbook can install and configure the [Meowlnir](https://github.com/maunium/meowlnir) moderation bot for you.
+
+See the project's [documentation](https://docs.mau.fi/meowlnir/) to learn what it does and why it might be useful to you.
+
+Meowlnir is an alternative to [Draupnir](configuring-playbook-bot-draupnir.md) and [Mjolnir](configuring-playbook-bot-mjolnir.md). It speaks the same [policy list](https://the-draupnir-project.github.io/draupnir-documentation/concepts/policy-lists) protocol, so it can subscribe to the same community ban lists, but it differs from them in a few ways that may matter to you:
+
+- It runs as an **appservice** and hosts **multiple bots**, each with its own management room. They live in Meowlnir's database, not its configuration file, but you still [declare them in your `vars.yml` file](#declaring-bots).
+- It can **override a policy coming from a list you do not control**, via unban policies combined with the ordering of your watched lists. See [Overriding a policy from someone else's list](#overriding-a-policy-from-someone-elses-list).
+- It is written in Go and is optimized for Synapse, using its database and admin APIs directly.
+
+Meowlnir and Draupnir can run side by side, but not usefully in the *same* room: whichever bot you are migrating away from still watches the same community lists, so it re-applies the very bans your unban policies remove. Migrate room by room. See [Trialling Meowlnir alongside another bot](#trialling-meowlnir-alongside-another-bot).
+
+## Prerequisites
+
+### Postgres
+
+Meowlnir stores its state in a Postgres database. The playbook creates one for you automatically when using the integrated Postgres server.
+
+### Adjusting DNS records
+
+**No DNS changes are necessary.** Meowlnir is reached by the homeserver over the container network, and the paths it optionally serves publicly (abuse reports and the policy server) are routed on your existing `matrix.example.com` domain.
+
+## Adjusting the playbook configuration
+
+To enable Meowlnir, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
+
+```yaml
+matrix_bot_meowlnir_enabled: true
+```
+
+### Declaring bots
+
+That gets the service running, but Meowlnir does nothing until it has at least one bot. Declare the ones you want and the playbook creates them for you:
+
+```yaml
+matrix_bot_meowlnir_bots_custom:
+  - username: meowlnir_bot
+    displayname: Meowlnir
+    avatar_url: ""
+    management_room_auto_create: true
+    management_rooms: []
+    # Left out, the initial managers default to `matrix_bot_meowlnir_initial_managers`,
+    # which is defined in terms of `matrix_admin`.
+    # Uncomment to override that for this bot, or if neither variable is set.
+    # initial_managers:
+    #   - "@alice:example.com"
+    #   - "@bob:example.com"
+```
+
+| Field | Required | Notes |
+|---|---|---|
+| `username` | yes | The localpart of the bot's Matrix user. Awkward to change later, so choose it carefully. |
+| `displayname` | yes | The name shown in rooms. Safe to change at any time. |
+| `avatar_url` | yes | An `mxc://` URI, or `""` for no avatar. |
+| `management_room_auto_create` | yes | Whether the playbook creates the bot's management room. Mutually exclusive with a non-empty `management_rooms`. |
+| `management_rooms` | yes | Rooms you have created yourself, `[]` when auto-creating. See [Supplying your own management room](#supplying-your-own-management-room). |
+| `initial_managers` | no | Who to invite to an auto-created room. Defaults to the instance-wide list below. |
+
+Usernames have to start with `meowlnir_` (the value of `matrix_bot_meowlnir_user_prefix`), so that bots fall inside the user namespace the homeserver lets Meowlnir operate.
+
+Changing `displayname` or `avatar_url` and re-running updates the bot in place. The comparison is against Meowlnir's own record, so profile edits made directly from a Matrix client are not reverted.
+
+#### Initial managers
+
+With `management_room_auto_create: true`, the playbook creates each bot's management room and invites its initial managers to it. You only need to accept the room invitation.
+
+`matrix_admin` is a single playbook variable which affects all bridges and bots, so setting it is usually a better move than setting anything specific to this role — **if it is already configured in your `vars.yml` file, there is nothing to do here**. If neither `matrix_admin` nor `matrix_bot_meowlnir_initial_managers` are set, the playbook would tell you about it.
+
+A per-bot `initial_managers` replaces the instance-wide list. Declaring it empty means nobody, which fails the run for a bot relying on `management_room_auto_create`.
+
+The list is consulted only while the room is being created. Adding a name to it later invites nobody, because the room already exists — invite and promote further moderators from inside the room instead, as described in [Who can command a bot](#who-can-command-a-bot).
+
+#### Rooms the playbook creates
+
+The bot creates the room with the `trusted_private_chat` preset, which gives every invitee the standing to command it. This is an additional room creator on room versions supporting [MSC4289](https://github.com/matrix-org/matrix-spec-proposals/pull/4289) (like v12) and power level 100 on older room versions. Creator status cannot be revoked subsequently.
+
+The room's encryption follows `matrix_bot_meowlnir_config_encryption_enable`, and its name and topic come from `matrix_bot_meowlnir_management_room_name` and `matrix_bot_meowlnir_management_room_topic`.
+
+### Supplying your own management room
+
+If you would rather own the room outright, create it yourself and declare it instead. The bot is then merely an administrator in a room you created:
+
+```yaml
+matrix_bot_meowlnir_bots_custom:
+  - username: meowlnir_bot
+    displayname: Meowlnir
+    avatar_url: ""
+    management_room_auto_create: false
+    management_rooms:
+      - id: "!qporfwt:example.com"
+        encrypted: false
+```
+
+An empty, invite-only room is fine. The order matters, because **each step depends on the one before it**:
+
+1. Declare the room and run the playbook. Do not invite the bot beforehand.
+2. The playbook creates the bot and tells Meowlnir about the room. Meowlnir would try to join right away, but will fail for invite-only rooms (a harmless error in the log).
+3. Invite the bot. It accepts the invitation, because the room is already marked as a management room for it.
+4. Give it power level 50 or more (ideally 100), so that it can store its protected rooms and watched lists there.
+
+Meowlnir supports several management rooms per bot, and `encrypted` is set per room. Marking a room encrypted only means something when [End-to-End Encryption support](#end-to-end-encryption-support) is switched on, which it is not by default.
+
+### Several management rooms for one bot
+
+Protected rooms, watched policy lists, protection settings and who may command the bot are properties of **a management room**, not of the bot. A room can be protected from exactly one management room, so moving a room means `!rooms unprotect` in the old room and `!rooms protect` in the new one, with its settings and subscriptions set up again there.
+
+That is how you hand one room to another moderator without giving them power over everything else the bot moderates: a second management room, the room moved into it, and power level 50 for them there. That last part is revocable, unlike the creator status everyone invited at creation time receives.
+
+Splitting rooms up this way does not split two other things:
+
+- The variables which name a single management room (`matrix_bot_meowlnir_synapse_http_antispam_management_room_id`, `matrix_bot_meowlnir_config_meowlnir_report_room`, `matrix_bot_meowlnir_config_meowlnir_room_ban_room`) keep pointing at the room you named there.
+- A policy list can be written to from any management room watching it, and its policies apply in every room those management rooms protect. Give a delegated management room a list of its own with `!lists create`.
+
+Create the room with `meowlnir-create-management-room` (see [Inspecting and driving Meowlnir directly](#inspecting-and-driving-meowlnir-directly)), then add its ID to `management_rooms` and re-run the playbook, which is what registers it with Meowlnir.
+
+#### Switching a bot from an auto-created room to declared ones
+
+Auto-creation makes exactly one room, and since it is not declared anywhere, [pruning](#bots-which-are-no-longer-declared) leaves such a bot's rooms alone. Declaring a second room means taking over the declaration of all of them: list what Meowlnir knows about with `/matrix/meowlnir/bin/meowlnir-bots`, set `management_room_auto_create: false`, put **every** one of those rooms under `management_rooms`, and re-run the playbook.
+
+> [!WARNING]
+> A room left out of that list is unregistered on the next run. Nothing is destroyed, but the bot stops taking commands there and stops protecting the rooms attached to it, until you declare the room again.
+
+### Who can command a bot
+
+**Management room membership alone is not enough**, which is different from what [Draupnir](configuring-playbook-bot-draupnir.md) does, where everyone in the management room can issue commands.
+
+Meowlnir decides who may drive a bot from power levels in its management room: anyone who can send the `fi.mau.meowlnir.watched_lists` state event (power level 50 by default), plus the room's creators.
+
+### Bots which are no longer declared
+
+The bot list (`matrix_bot_meowlnir_bots_custom`) is authoritative. Removing entries from there will make the playbook unregister them with the Meowlnir instance.
+
+Removal only adjusts Meowlnir's own records. A removed bot's Matrix user remains activated and stays in the rooms it had joined. A removed management room leaves the room and the bot's membership in it intact - it's just that Meowlnir stops taking commands there.
+
+Removal happens under the same `ensure-matrix-users-created` tag that creates bots. It's one Ansible tag for "synchronizing the bots state" (creation, changes, and removal).
+
+To turn removal off entirely, set `matrix_bot_meowlnir_bots_pruning_enabled: false`. As a safety measure, the playbook refuses to prune when *no* bots are declared at all; override that with `matrix_bot_meowlnir_bots_pruning_on_empty_roster_enabled: true`.
+
+### Trialling Meowlnir alongside another bot
+
+Meowlnir has a dry-run mode in which it does everything except take moderation actions:
+
+```yaml
+matrix_bot_meowlnir_config_meowlnir_dry_run: true
+```
+
+> [!WARNING]
+> Dry run does not cover the [synapse-http-antispam](#enabling-synapse-http-antispam-support) integration. It suppresses actions Meowlnir takes itself (bans, server ACLs, rejecting pending invites), but the verdicts it hands back to Synapse still block invites and joins. Leave that integration off while trialling.
+
+Do not expect dry run to preview what Meowlnir would do in rooms another policy-list bot already moderates. Meowlnir only acts on users who are *in* a room, and the other bot has already removed everyone its lists match, so the preview comes out empty. Dry run also skips the power level check described under [Protecting a room](#protecting-a-room), so it will not surface a permissions problem either.
+
+### Abuse reports
+
+Meowlnir can intercept the report endpoints of the client-server API, so that abuse reports are delivered to a management room. This requires integration with the reverse proxy in front of the homeserver, which the playbook sets up for you when using Traefik:
+
+```yaml
+matrix_bot_meowlnir_config_reporting_enabled: true
+
+# The management room that receives the reports.
+matrix_bot_meowlnir_config_meowlnir_report_room: "!qporfwt:example.com"
+```
+
+Only the `v3` report endpoints are routed to Meowlnir. Requests to the legacy `r0` endpoints continue to reach the homeserver, because Meowlnir does not serve them.
+
+### Enabling synapse-http-antispam support
+
+Meowlnir can block invites and joins before they happen. This requires the [synapse-http-antispam](https://github.com/maunium/synapse-http-antispam) module, which the playbook can enable for you:
+
+```yaml
+matrix_bot_meowlnir_synapse_http_antispam_enabled: true
+
+# The management room whose policies the module consults.
+matrix_bot_meowlnir_synapse_http_antispam_management_room_id: "!qporfwt:example.com"
+```
+
+> [!WARNING]
+> The playbook wires the module up to a single consumer, so this cannot be enabled at the same time as `matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled`. The playbook fails the run if both are enabled.
+
+With the module in place, you can also block invitations to specific users outright, which is useful for accounts that attract spam:
+
+```yaml
+matrix_bot_meowlnir_config_antispam_block_invites_to_custom:
+  - "@alice:example.com"
+```
+
+Such an invitation can still be let through case by case with the `!allow-invite` command.
+
+### End-to-End Encryption support
+
+To let Meowlnir's bots participate in encrypted rooms:
+
+```yaml
+matrix_bot_meowlnir_config_encryption_enable: true
+```
+
+When using Synapse, the playbook turns on the experimental features this depends on (`msc2409_to_device_messages_enabled` and `msc3202_transaction_extensions`) for you.
+
+### Policy server (MSC4284)
+
+Meowlnir can act as a [policy server](https://github.com/matrix-org/matrix-spec-proposals/pull/4284), letting rooms ask it to vet events before they are accepted:
+
+```yaml
+matrix_bot_meowlnir_policy_server_enabled: true
+```
+
+This exposes `/_matrix/policy` on your Matrix federation endpoint, so that other servers participating in a room can reach it.
+
+That only stands the policy server up, though — no room is put behind it until you say so from the management room:
+
+```
+!policyserver enable !qporfwt:example.com
+```
+
+Given no room, `enable` applies to every protected room. Rooms which are not protected are skipped, with `Skipped ... as it is not a protected room`, so [protect a room](#protecting-a-room) before enabling it here. `!policyserver` on its own reports whether the policy server is available and prints its public key, and `!policyserver disable` reverses the change.
+
+The playbook derives a stable signing key for you from `matrix_homeserver_generic_secret_key`. If you would rather use an independently generated one, produce it with the command below and set it as `matrix_bot_meowlnir_config_policy_server_signing_key`:
+
+```sh
+python3 -c "import os, base64; print('ed25519 policy_server ' + base64.b64encode(os.urandom(32)).decode().rstrip('='))"
+```
+
+### Synapse admin API access (optional)
+
+A few of Meowlnir's features go through Synapse's admin API, not the client-server API — suspending or deactivating users, and deleting rooms during a takedown. Those calls require the caller to be a Synapse **server admin**, which bots are not by default, so they come back as `M_FORBIDDEN` ("You are not a server admin"). Nothing else is affected: bans, server ACLs, protecting rooms and watching policy lists all go through the client-server API, where a sufficient power level is the only requirement.
+
+To grant that access, point each bot at a token belonging to a server admin:
+
+```yaml
+matrix_bot_meowlnir_config_meowlnir_admin_tokens:
+  "@meowlnir_bot:example.com": "ADMIN_TOKEN_HERE"
+```
+
+The key is the bot the token is used for; the token itself belongs to an administrator account, not to the bot.
+
+If you have more than one management room, note that room bans are only processed in the one named by `matrix_bot_meowlnir_config_meowlnir_room_ban_room`, and ignored elsewhere.
+
+Where the token comes from depends on how your homeserver authenticates. Ordinarily you [obtain an access token](obtaining-access-tokens.md) for an account which is a Synapse server admin. When [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md) is enabled, Synapse no longer decides who is an admin, so the token has to be issued by MAS with admin privileges:
+
+```sh
+/matrix/matrix-authentication-service/bin/mas-cli manage issue-compatibility-token --yes-i-want-to-grant-synapse-admin-privileges alice
+```
+
+Note that bot users are created by the appservice and are not known to Matrix Authentication Service, so the token cannot be issued for the bot itself — use an administrator account.
+
+### Access to the Synapse database (optional)
+
+Some room takedown features rely on Meowlnir reading room IDs directly from the Synapse database. Upstream expects a user with read-only permissions, which the playbook does not create. Enabling the integration below hands Meowlnir the same credentials Synapse itself uses, which also grant write access:
+
+```yaml
+matrix_bot_meowlnir_synapse_database_integration_enabled: true
+```
+
+If you would rather not do that, create a read-only Postgres user yourself and point Meowlnir at it with `matrix_bot_meowlnir_synapse_database_uri`.
+
+### Adopting an existing Meowlnir installation
+
+If you already run Meowlnir outside the playbook and want to bring it under this role, two things need attention before the first run.
+
+Your bots exist in Meowlnir's database but not in your `vars.yml` file, and [pruning](#bots-which-are-no-longer-declared) is on by default, so the first run would remove them. Declare them in `matrix_bot_meowlnir_bots_custom` — with `management_room_auto_create: false` and their existing rooms under `management_rooms` — or set `matrix_bot_meowlnir_bots_pruning_enabled: false`.
+
+If the installation uses encryption, also copy the `pickle_key` from its old configuration file into `matrix_bot_meowlnir_config_encryption_pickle_key`. The crypto store cannot be read with a different key than it was written with, so leaving the playbook's default in place costs your bots their existing encryption sessions.
+
+### Extending the configuration
+
+There are some additional things you may wish to configure about the bot.
+
+Take a look at:
+
+- `roles/custom/matrix-bot-meowlnir/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bot_meowlnir_configuration_extension_yaml` variable
+
+> [!WARNING]
+> Do not set any of Meowlnir's secrets to the literal value `generate`. Meowlnir re-runs its configuration upgrader on every start, so a `generate` placeholder would produce a brand new secret on every restart. The playbook derives stable values for you, and fails the run if it finds a `generate` placeholder.
+
+## Installing
+
+After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
+
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-users-created,start
+```
+
+With `management_room_auto_create`, you then have an invitation waiting for you — accept it and start sending commands. If you supplied the management room yourself, carry on from step 3 of [Supplying your own management room](#supplying-your-own-management-room): invite the bot, then give it power level 50 or more.
+
+**Notes**:
+
+- The `ensure-matrix-users-created` tag is what creates the bots declared in `matrix_bot_meowlnir_bots_custom`, registers their management rooms, and removes the ones you no longer declare. It deliberately does not run as part of `setup-all`, so that installing onto a server whose database you are about to restore from a backup does not write anything.
+
+- Re-running is safe and idempotent, so adding a bot later is a matter of extending the list and running the same command again.
+
+- If the homeserver turns out to be running without Meowlnir's appservice registration (which is the normal state of affairs on the run that first enables Meowlnir), the playbook restarts the homeserver during bot provisioning, so that everything completes in a single run.
+
+- The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
+
+## Usage
+
+You can refer to the upstream [documentation](https://docs.mau.fi/meowlnir/) for a more detailed usage guide.
+
+Below is a **non-exhaustive quick-start guide** for the impatient.
+
+### Inspecting and driving Meowlnir directly
+
+The playbook drives Meowlnir's management API for you based on `matrix_bot_meowlnir_bots_custom`, which is the recommended way. For anything it does not cover, helper scripts are installed under `/matrix/meowlnir/bin`, which find the management secret and reach the API inside the container:
+
+```sh
+# Show the bots, their management rooms, protected rooms and watched policy lists
+/matrix/meowlnir/bin/meowlnir-bots
+
+# Call any endpoint: meowlnir-api <METHOD> <PATH> [JSON body]
+/matrix/meowlnir/bin/meowlnir-api GET /_meowlnir/v1/bots
+
+# Create another management room for an existing bot, with the given users able to command it there
+/matrix/meowlnir/bin/meowlnir-create-management-room meowlnir_bot @alice:example.com
+
+# Ask the homeserver who Meowlnir's appservice token belongs to.
+# A 401 response means the homeserver is running without Meowlnir's appservice registration, which is also what Meowlnir's own "Failed to connect to homeserver" log messages usually mean.
+/matrix/meowlnir/bin/meowlnir-whoami
+```
+
+`meowlnir-create-management-room` prints the new room's ID, which you then register with `meowlnir-api PUT /_meowlnir/v1/management_room/<room ID>`.
+
+See the upstream [bot creation documentation](https://docs.mau.fi/meowlnir/bot-create.html) for the full set of endpoints. Bear in mind that bots you create this way are not declared in your `vars.yml` file, so the next playbook run will remove them again (see [Bots which are no longer declared](#bots-which-are-no-longer-declared)).
+
+If you have enabled encryption, each bot also needs verifying once. That step is left manual because it returns a recovery key you need to store somewhere safe:
+
+```sh
+/matrix/meowlnir/bin/meowlnir-api POST /_meowlnir/v1/bot/meowlnir_bot/verify '{"generate": true}'
+```
+
+### Protecting a room
+
+Invite the bot to a room, give it a power level high enough to act (see below), and then tell it to protect the room by sending this command to its management room:
+
+```
+!rooms protect !qporfwt:example.com
+```
+
+If the bot has more than one management room, send this to the one that should own the room: a room can only be protected from a single management room. See [Several management rooms for one bot](#several-management-rooms-for-one-bot).
+
+Meowlnir refuses to protect a room unless its power level reaches that room's own `ban` and `redact` levels (50 in a default room). That is only enough for user bans, though: writing `m.room.server_acl` usually requires 100, and without it the server rules in your watched lists have no effect — which is most of what a list like [CME](https://matrix.to/#/%23community-moderation-effort-bl:neko.dev) carries. **Give the bot power level 100** unless you only care about user bans.
+
+Set the power level *before* protecting the room. Meowlnir re-sends server ACLs when it starts and when a watched list changes, but not when its own power level goes up subsequently, so raising it afterwards leaves the room without ACLs until you restart the bot (`systemctl restart matrix-bot-meowlnir` or via the playbook's Ansible `start` tag).
+
+### Subscribing to a policy list
+
+Policy lists are maintained in Matrix rooms. Popular public ones are:
+
+- `#community-moderation-effort-bl:neko.dev`
+- `#huginn-muninn-active-threats:feline.support`
+
+Subscribe to one by sending the following command to the management room:
+
+```
+!lists subscribe #community-moderation-effort-bl:neko.dev cme
+```
+
+The last argument is a shortcode, which you use to refer to the list in later commands.
+
+### Overriding a policy from someone else's list
+
+This is the main capability Meowlnir has that Draupnir does not.
+
+When several watched lists carry a policy for the same user, **the first match wins**, and "first" means the order in which the lists are watched. So to be able to override a community list's ban, your own list has to come before it.
+
+`!lists subscribe` appends, which makes subscription order the precedence order. Subscribe to your own list first, and to community lists afterwards:
+
+```
+!lists create my-ban-exceptions
+!lists subscribe #community-moderation-effort-bl:neko.dev cme
+```
+
+> [!NOTE]
+> To subscribe somewhere other than the end of the list, pass `--insert-before <shortcode>`.
+
+You can then publish an unban policy into your own list, which takes precedence over the community list's ban:
+
+```
+!add-unban my-bans @alice:example.com false-positive
+```
+
+> [!NOTE]
+> Unlike `!ban`, the `!add-unban` command does not treat its reason as a trailing argument, so a reason containing spaces is discarded. Use a single word (or hyphenate) until that is fixed upstream.
+
+> [!IMPORTANT]
+> An unban policy stops a ban from being **re-applied**; it does not undo one that is already in place unless Meowlnir applied it itself and still has it on record. A ban placed by a human moderator, or by the Draupnir or Mjolnir you are migrating away from, stays. Unban such a user once by hand — from then on the policy keeps them unbanned, while you remain subscribed to the list that banned them.
+
+Use `!match @alice:example.com` to see which policies currently apply to a user and which list each came from.
+
+> [!NOTE]
+> Unban policies use a Meowlnir-specific recommendation (`fi.mau.meowlnir.unban`) which is not part of the Matrix specification. If you publish your policy list for other people to subscribe to, subscribers running Draupnir or Mjolnir will ignore your unban policies.
+
+There is also a blunter, server-wide escape hatch for policies that are too wide to tolerate at all — `matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_custom`, which makes Meowlnir ignore any policy matching the listed entities.
+
+## Troubleshooting
+
+As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by running a command like `journalctl -fu matrix-bot-meowlnir`.
+
+If bots appear to do nothing, check that they have an Administrator power level in the rooms they are meant to protect, and that the room has been added with `!rooms protect`.
+
+If commands in a management room get no reply at all, check the bot's power level *there* too — it needs at least 50 to record its own configuration.
+
+A bare `!lists` returns nothing in a management room which has never had a policy list. That is an upstream bug and it clears as soon as you subscribe to one; `!lists subscribe` works from the start.

docs/configuring-playbook-bot-mjolnir.md

@@ -15,6 +15,8 @@ The playbook can install and configure the [Mjolnir](https://github.com/matrix-o
 
 See the project's [documentation](https://github.com/matrix-org/mjolnir/blob/main/README.md) to learn what it does and why it might be useful to you.
 
+**Note**: you can also use the [Draupnir](configuring-playbook-bot-draupnir.md) or [Meowlnir](configuring-playbook-bot-meowlnir.md) bots, which speak the same [policy list](https://the-draupnir-project.github.io/draupnir-documentation/concepts/policy-lists) protocol.
+
 ## Prerequisites
 
 ### Register the bot account

docs/configuring-playbook-bridge-appservice-discord.md

@@ -26,9 +26,9 @@ Create a Discord Application [here](https://discordapp.com/developers/applicatio
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_appservice_discord_enabled: true
-matrix_appservice_discord_client_id: "YOUR DISCORD APP CLIENT ID"
-matrix_appservice_discord_bot_token: "YOUR DISCORD APP BOT TOKEN"
+matrix_bridge_appservice_discord_enabled: true
+matrix_bridge_appservice_discord_client_id: "YOUR DISCORD APP CLIENT ID"
+matrix_bridge_appservice_discord_bot_token: "YOUR DISCORD APP BOT TOKEN"
 
 # As of Synapse 1.90.0, uncomment to enable the backwards compatibility (https://matrix-org.github.io/synapse/latest/upgrade#upgrading-to-v1900) that this bridge needs.
 # Note: This deprecated method is considered insecure.
@@ -44,7 +44,7 @@ There are some additional things you may wish to configure about the bridge.
 Take a look at:
 
 - `roles/custom/matrix-bridge-appservice-discord/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/custom/matrix-bridge-appservice-discord/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_appservice_discord_configuration_extension_yaml` variable
+- `roles/custom/matrix-bridge-appservice-discord/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bridge_appservice_discord_configuration_extension_yaml` variable
 
 ## Installing
 
@@ -65,7 +65,7 @@ The shortcut commands with the [`just` program](just.md) are also available: `ju
 Self-service bridging allows you to bridge specific and existing Matrix rooms to specific Discord rooms. To enable it, add the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_appservice_discord_bridge_enableSelfServiceBridging: true
+matrix_bridge_appservice_discord_bridge_enableSelfServiceBridging: true
 ```
 
 **Note**: If self-service bridging is not enabled, `!discord help` commands will return no results.
@@ -91,14 +91,14 @@ All Matrix rooms created this way are **listed publicly** by default, and you wi
 To disable portal bridging, add the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_appservice_discord_bridge_disablePortalBridging: true
+matrix_bridge_appservice_discord_bridge_disablePortalBridging: true
 ```
 
 ### Usage
 
 To get started with Portal Bridging:
 
-1. To invite the bot to Discord, retrieve the invite link from the `{{ matrix_appservice_discord_config_path }}/invite_link` file on the server (this defaults to `/matrix/appservice-discord/config/invite_link`). You need to peek at the file on the server via SSH, etc., because it's not available via HTTP(S).
+1. To invite the bot to Discord, retrieve the invite link from the `{{ matrix_bridge_appservice_discord_config_path }}/invite_link` file on the server (this defaults to `/matrix/appservice-discord/config/invite_link`). You need to peek at the file on the server via SSH, etc., because it's not available via HTTP(S).
 2. Room addresses follow this syntax: `#_discord_<guildID>_<channelID>`. You can easily find the guild and channel IDs by logging into Discord in a browser and opening the desired channel. The URL will have this format: `discord.com/channels/<guildID>/<channelID>`.
 3. Once you have figured out the appropriate room address, you can join by doing `/join #_discord_<guildID>_<channelID>` in your Matrix client.
 
@@ -124,7 +124,7 @@ As with all other services, you can find the logs in [systemd-journald](https://
 The default logging level for this component is `warn`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file (adapt to your needs) and re-run the playbook:
 
 ```yaml
-matrix_appservice_discord_configuration_extension_yaml: |
+matrix_bridge_appservice_discord_configuration_extension_yaml: |
   logging:
     # What level should the logger output to the console at.
     console: "info" # Valid values: silent, error, warn, http, info, verbose, silly

docs/configuring-playbook-bridge-appservice-irc.md

@@ -20,9 +20,9 @@ See the project's [documentation](https://github.com/matrix-org/matrix-appservic
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_appservice_irc_enabled: true
+matrix_bridge_appservice_irc_enabled: true
 
-matrix_appservice_irc_ircService_servers:
+matrix_bridge_appservice_irc_ircService_servers:
   irc.example.com:
     name: "ExampleNet"
     port: 6697
@@ -76,7 +76,7 @@ There are some additional things you may wish to configure about the bridge.
 Take a look at:
 
 - `roles/custom/matrix-bridge-appservice-irc/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/custom/matrix-bridge-appservice-irc/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_appservice_irc_configuration_extension_yaml` variable
+- `roles/custom/matrix-bridge-appservice-irc/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bridge_appservice_irc_configuration_extension_yaml` variable
 
 ## Installing
 
@@ -104,7 +104,7 @@ As with all other services, you can find the logs in [systemd-journald](https://
 The default logging level for this component is `debug`, and the log is output to the console only. If you want to change the verbosity or enable logging to a file, add the following configuration to your `vars.yml` file (adapt to your needs) and re-run the playbook:
 
 ```yaml
-matrix_appservice_irc_configuration_extension_yaml: |
+matrix_bridge_appservice_irc_configuration_extension_yaml: |
   logging:
     # Level to log on console/logfile.
     # Valid values: error, warn, info, debug

docs/configuring-playbook-bridge-appservice-kakaotalk.md

@@ -1,75 +1,26 @@
 <!--
 SPDX-FileCopyrightText: 2022 Dennis Ciba
-SPDX-FileCopyrightText: 2022 Slavi Pantaleev
+SPDX-FileCopyrightText: 2022 - 2026 Slavi Pantaleev
 SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
 SPDX-FileCopyrightText: 2024 MDAD project contributors
 
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
 
-# Setting up Appservice Kakaotalk bridging (optional)
+# Setting up Appservice Kakaotalk bridging (optional, removed)
 
-The playbook can install and configure [matrix-appservice-kakaotalk](https://src.miscworks.net/fair/matrix-appservice-kakaotalk) for you, for bridging to [Kakaotalk](https://www.kakaocorp.com/page/service/service/KakaoTalk?lang=ENG). This bridge is based on [node-kakao](https://github.com/storycraft/node-kakao) (now unmaintained) and some [mautrix-facebook](https://github.com/mautrix/facebook) code.
+🪦 The playbook used to be able to install and configure [matrix-appservice-kakaotalk](https://src.miscworks.net/fair/matrix-appservice-kakaotalk) (a bridge to [Kakaotalk](https://www.kakaocorp.com/page/service/service/KakaoTalk?lang=ENG)), but no longer includes this component.
 
-See the project's [documentation](https://src.miscworks.net/fair/matrix-appservice-kakaotalk/src/branch/master/README.md) to learn what it does and why it might be useful to you.
+The bridge could only be installed by self-building its source code, and its upstream repository has become unreachable, which makes installation impossible. The bridge was also based on the now-unmaintained [node-kakao](https://github.com/storycraft/node-kakao) library, and there have been reports that using it may get your Kakaotalk account banned.
 
-> [!WARNING]
-> There have been recent reports (~2022-09-16) that **using this bridge may get your account banned**.
+## Uninstalling the component manually
 
-## Prerequisite (optional)
+If you still have matrix-appservice-kakaotalk installed on your Matrix server, the playbook can no longer help you uninstall it and you will need to do it manually. To uninstall manually, run these commands on the server:
 
-### Enable Shared Secret Auth
-
-If you want to set up [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do) for this bridge automatically, you need to have enabled [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook.
-
-See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-puppeting-optional) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about setting up Double Puppeting.
-
-**Note**: double puppeting with the Shared Secret Auth works at the time of writing, but is deprecated and will stop working in the future.
-
-## Adjusting the playbook configuration
-
-To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
-
-```yaml
-matrix_appservice_kakaotalk_enabled: true
-```
-
-### Extending the configuration
-
-There are some additional things you may wish to configure about the bridge.
-
-Take a look at:
-
-- `roles/custom/matrix-bridge-appservice-kakaotalk/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/custom/matrix-bridge-appservice-kakaotalk/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_appservice_kakaotalk_configuration_extension_yaml` variable
-
-## Installing
-
-After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
-
-<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
 ```sh
-ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
-```
+systemctl disable --now matrix-appservice-kakaotalk.service
 
-The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
+systemctl disable --now matrix-appservice-kakaotalk-node.service
 
-`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too.
-
-## Usage
-
-To use the bridge, you need to start a chat with `@kakaotalkbot:example.com` (where `example.com` is your base domain, not the `matrix.` domain).
-
-You then need to send `login --save EMAIL_OR_PHONE_NUMBER` to the bridge bot to enable bridging for your Kakaotalk account. The `--save` flag may be omitted, if you'd rather not save your password.
-
-## Troubleshooting
-
-As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-appservice-kakaotalk`.
-
-### Increase logging verbosity
-
-The default logging level for this component is `WARNING`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
-
-```yaml
-matrix_appservice_kakaotalk_logging_level: DEBUG
+rm -rf /matrix/appservice-kakaotalk
 ```

docs/configuring-playbook-bridge-beeper-line.md

@@ -0,0 +1,101 @@
+<!--
+SPDX-FileCopyrightText: 2026 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Setting up Beeper LINE bridging (optional)
+
+<sup>Refer to the common guide for configuring mautrix bridges: [Setting up a Generic Mautrix Bridge](configuring-playbook-bridge-mautrix-bridges.md)</sup>
+
+The playbook can install and configure [beeper-line](https://github.com/beeper/line) for you, for bridging to [LINE](https://line.me/).
+
+See the project's [documentation](https://github.com/beeper/line/blob/main/README.md) to learn what it does and which features it supports.
+
+## Prerequisites
+
+### Prepare your LINE account
+
+The bridge logs in with the email address configured in your LINE account. If your account does not have an email address, set one in the LINE mobile app under **Settings** → **Account** → **Email address** before trying to log in.
+
+The bridge identifies itself to LINE as a Chrome Extension client. LINE only permits one active Chrome Extension session, so the bridge and the real LINE Chrome Extension cannot be used at the same time. Logging in with either one invalidates the other session.
+
+### Enable Appservice Double Puppet (optional)
+
+If you want to set up [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) for this bridge automatically, you need to have enabled [Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md) for this playbook.
+
+See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-puppeting-optional) on the common mautrix bridge guide for details.
+
+## Adjusting the playbook configuration
+
+To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
+
+```yaml
+matrix_bridge_beeper_line_enabled: true
+```
+
+### Using another container image
+
+Upstream does not publish container images publicly, as its CI only pushes them to Beeper's private registry. The playbook therefore uses [`docker.io/crispyduck/beeper-line`](https://hub.docker.com/r/crispyduck/beeper-line) by default, which is a community-maintained image built from the upstream source.
+
+That image is only available for the amd64 architecture. On other architectures, the playbook self-builds the image from source automatically.
+
+To use an image that you have built and published elsewhere, override the complete image name:
+
+```yaml
+matrix_bridge_beeper_line_container_image_self_build: false
+matrix_bridge_beeper_line_container_image: docker.io/example/beeper-line:latest
+```
+
+The role can also build the bridge directly from a Git repository on the Matrix server:
+
+```yaml
+matrix_bridge_beeper_line_container_image_self_build: true
+matrix_bridge_beeper_line_container_image_self_build_repo: https://github.com/beeper/line.git
+matrix_bridge_beeper_line_container_image_self_build_branch: main
+```
+
+Self-building requires more time and resources on the server than pulling a prebuilt image.
+
+### Extending the configuration
+
+There are additional things you may wish to configure about the bridge.
+
+See [this section](configuring-playbook-bridge-mautrix-bridges.md#extending-the-configuration) on the common mautrix bridge guide for details about variables that you can customize and the bridge's default configuration, including [bridge permissions](configuring-playbook-bridge-mautrix-bridges.md#configure-bridge-permissions-optional), [encryption support](configuring-playbook-bridge-mautrix-bridges.md#enable-encryption-optional), [relay mode](configuring-playbook-bridge-mautrix-bridges.md#enable-relay-mode-optional), and the [bot's username](configuring-playbook-bridge-mautrix-bridges.md#set-the-bots-username-optional).
+
+When following the common guide, replace `_mautrix_SERVICENAME_` in variable names with `_beeper_line_`.
+
+## Installing
+
+After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
+
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`.
+
+`just install-all` is useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove other components, run `just setup-all` so those components are uninstalled.
+
+## Usage
+
+To use the bridge, start a chat with `@linebot:example.com` (where `example.com` is your base domain, not the `matrix.` domain).
+
+Send `login` and enter your LINE email address and password when prompted. The bridge then shows you a PIN code, which you need to enter into the LINE app on your mobile device to approve the new session.
+
+## Troubleshooting
+
+As with all other services, you can find the logs in systemd-journald by logging in to the server with SSH and running:
+
+```sh
+journalctl -fu matrix-beeper-line
+```
+
+### Increase logging verbosity
+
+The default logging level for this component is `warn`. To increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
+
+```yaml
+# Valid values: fatal, error, warn, info, debug, trace
+matrix_bridge_beeper_line_logging_level: debug
+```

docs/configuring-playbook-bridge-beeper-linkedin.md

@@ -8,7 +8,9 @@ SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
 
-# Setting up Beeper Linkedin bridging (optional)
+# Setting up Beeper Linkedin bridging (optional, unmaintained)
+
+**Note**: this bridge is unmaintained. Its [upstream repository](https://github.com/beeper/linkedin) has been archived and has not seen a change since March 2025. For bridging to LinkedIn, consider using the [mautrix-linkedin](configuring-playbook-bridge-mautrix-linkedin.md) bridge instead, which is actively maintained and also supported by the playbook.
 
 The playbook can install and configure [beeper-linkedin](https://github.com/beeper/linkedin) for you, for bridging to [LinkedIn](https://www.linkedin.com/) Messaging. This bridge is based on the mautrix-python framework and can be configured in a similar way to the mautrix bridges.
 
@@ -29,7 +31,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_beeper_linkedin_enabled: true
+matrix_bridge_beeper_linkedin_enabled: true
 ```
 
 ### Extending the configuration
@@ -68,7 +70,7 @@ As with all other services, you can find the logs in [systemd-journald](https://
 The default logging level for this component is `WARNING`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
 
 ```yaml
-matrix_beeper_linkedin_logging_level: DEBUG
+matrix_bridge_beeper_linkedin_logging_level: DEBUG
 ```
 
 ### Bridge asking for 2FA even if you don't have 2FA enabled

docs/configuring-playbook-bridge-heisenbridge.md

@@ -25,26 +25,26 @@ If you wish to adjust it, see the section [below](#adjusting-the-heisenbridge-ur
 To enable Heisenbridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_heisenbridge_enabled: true
+matrix_bridge_heisenbridge_enabled: true
 
 # Setting the owner is optional as the first local user to DM `@heisenbridge:example.com` will be made the owner.
 # If you are not using a local user you must set it as otherwise you can't DM it at all.
-matrix_heisenbridge_owner: "@alice:{{ matrix_domain }}"
+matrix_bridge_heisenbridge_owner: "@alice:{{ matrix_domain }}"
 
 # Uncomment to enable identd on host port 113/TCP (optional)
-# matrix_heisenbridge_identd_enabled: true
+# matrix_bridge_heisenbridge_identd_enabled: true
 ```
 
 ### Adjusting the Heisenbridge URL (optional)
 
-By tweaking the `matrix_heisenbridge_hostname` and `matrix_heisenbridge_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
+By tweaking the `matrix_bridge_heisenbridge_hostname` and `matrix_bridge_heisenbridge_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
 
 Example additional configuration for your `vars.yml` file:
 
 ```yaml
 # Change the default hostname and path prefix
-matrix_heisenbridge_hostname: heisenbridge.example.com
-matrix_heisenbridge_path_prefix: /
+matrix_bridge_heisenbridge_hostname: heisenbridge.example.com
+matrix_bridge_heisenbridge_path_prefix: /
 ```
 
 If you've changed the default hostname, you may need to create a CNAME record for the Heisenbridge domain (`heisenbridge.example.com`), which targets `matrix.example.com`.

docs/configuring-playbook-bridge-hookshot.md

@@ -29,20 +29,23 @@ You need to download the private key file, if you will install the file manually
 Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `GITHUB_PRIVATE_KEY_HERE` with the one created [above](#download-github-app-private-key).
 
 ```yaml
-matrix_hookshot_enabled: true
+matrix_bridge_hookshot_enabled: true
 
 # Uncomment to enable end-to-bridge encryption.
 # See: https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html
-# matrix_hookshot_encryption_enabled: true
+# matrix_bridge_hookshot_encryption_enabled: true
 
 # Uncomment and paste the contents of GitHub app private key to enable GitHub bridge.
 # Alternatively, you can use one of the other methods explained below on the "Manage GitHub Private Key with aux role" section.
-# matrix_hookshot_github_private_key: "GITHUB_PRIVATE_KEY_HERE"
+# matrix_bridge_hookshot_github_private_key: "GITHUB_PRIVATE_KEY_HERE"
 ```
 
-For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required.
+> [!NOTE]
+> End-to-bridge encryption requires the homeserver to support (and have enabled) [MSC2409](https://github.com/matrix-org/matrix-spec-proposals/pull/2409) and [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202). When using Synapse, the playbook turns on the experimental features this depends on (`msc2409_to_device_messages_enabled` and `msc3202_transaction_extensions`) for you. On other homeserver implementations, you need to arrange for this yourself.
 
-Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab and generic webhooks), while you must first add the required configuration and enable the others (GitHub, Jira, and Figma).
+For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_bridge_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required.
+
+Take special note of the `matrix_bridge_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab and generic webhooks), while you must first add the required configuration and enable the others (GitHub, Jira, and Figma).
 
 ### Extending the configuration
 
@@ -51,7 +54,7 @@ There are some additional things you may wish to configure about the bridge.
 Take a look at:
 
 - `roles/custom/matrix-bridge-hookshot/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/custom/matrix-bridge-hookshot/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_hookshot_configuration_extension_yaml` and `matrix_hookshot_registration_extension_yaml` variables
+- `roles/custom/matrix-bridge-hookshot/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bridge_hookshot_configuration_extension_yaml` and `matrix_bridge_hookshot_registration_extension_yaml` variables
 
 Refer the [official instructions](https://matrix-org.github.io/matrix-hookshot/latest/setup.html) and the comments in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) to learn what the individual options do.
 
@@ -96,31 +99,31 @@ Unless indicated otherwise, the following endpoints are reachable on your `matri
 
 | Listener | Default path | Variable | Used as |
 |---|---|---|---|
-| - | `/hookshot/webhooks/` | `matrix_hookshot_webhook_endpoint` | Webhook-prefix, which affects all webhook-related URLs below |
-| generic | `/hookshot/webhooks/webhook` | `matrix_hookshot_generic_endpoint` | Generic webhooks |
-| github oauth | `/hookshot/webhooks/oauth` | `matrix_hookshot_github_oauth_endpoint` | GitHub "Callback URL" |
-| jira oauth | `/hookshot/webhooks/jira/oauth` | `matrix_hookshot_jira_oauth_endpoint` | Jira OAuth |
-| figma endpoint | `/hookshot/webhooks/figma/webhook` | `matrix_hookshot_figma_endpoint` | Figma |
-| appservice | `/hookshot/_matrix/app/` | `matrix_hookshot_appservice_endpoint` | Matrix server |
-| widgets | `/hookshot/widgetapi/` | `matrix_hookshot_widgets_endpoint` | Widgets |
+| - | `/hookshot/webhooks/` | `matrix_bridge_hookshot_webhook_endpoint` | Webhook-prefix, which affects all webhook-related URLs below |
+| generic | `/hookshot/webhooks/webhook` | `matrix_bridge_hookshot_generic_endpoint` | Generic webhooks |
+| github oauth | `/hookshot/webhooks/oauth` | `matrix_bridge_hookshot_github_oauth_endpoint` | GitHub "Callback URL" |
+| jira oauth | `/hookshot/webhooks/jira/oauth` | `matrix_bridge_hookshot_jira_oauth_endpoint` | Jira OAuth |
+| figma endpoint | `/hookshot/webhooks/figma/webhook` | `matrix_bridge_hookshot_figma_endpoint` | Figma |
+| appservice | `/hookshot/_matrix/app/` | `matrix_bridge_hookshot_appservice_endpoint` | Matrix server |
+| widgets | `/hookshot/widgetapi/` | `matrix_bridge_hookshot_widgets_endpoint` | Widgets |
 
-Also see the various `matrix_hookshot_container_labels_*` variables in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml), which expose URLs publicly.
+Also see the various `matrix_bridge_hookshot_container_labels_*` variables in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml), which expose URLs publicly.
 
-The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) in detail for more info.
+The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_bridge_hookshot_container_url`) and on different ports (e.g. `matrix_bridge_hookshot_appservice_port`). Read [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) in detail for more info.
 
 ### Manage GitHub Private Key with aux role
 
 The GitHub bridge requires you to install a private key file. This can be done in multiple ways:
 
-- copy the *contents* of the downloaded file and set the variable `matrix_hookshot_github_private_key` to the contents (see example in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml)).
-- somehow copy the file to the path `{{ matrix_hookshot_base_path }}/{{ matrix_hookshot_github_private_key_file }}` (default: `/matrix/hookshot/private-key.pem`) on the server manually.
+- copy the *contents* of the downloaded file and set the variable `matrix_bridge_hookshot_github_private_key` to the contents (see example in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml)).
+- somehow copy the file to the path `{{ matrix_bridge_hookshot_base_path }}/{{ matrix_bridge_hookshot_github_private_key_file }}` (default: `/matrix/hookshot/private-key.pem`) on the server manually.
 - use the [`aux` role](https://github.com/mother-of-all-self-hosting/ansible-role-aux) to copy the file from an arbitrary path on your ansible client to the correct path on the server.
 
-To use the `aux` role, make sure the `matrix_hookshot_github_private_key` variable is empty. Then add the following configuration to your `vars.yml` file:
+To use the `aux` role, make sure the `matrix_bridge_hookshot_github_private_key` variable is empty. Then add the following configuration to your `vars.yml` file:
 
 ```yaml
 aux_file_definitions:
-  - dest: "{{ matrix_hookshot_base_path }}/{{ matrix_hookshot_github_private_key_file }}"
+  - dest: "{{ matrix_bridge_hookshot_base_path }}/{{ matrix_bridge_hookshot_github_private_key_file }}"
     content: "{{ lookup('file', '/path/to/your-github-private-key.pem') }}"
     mode: '0400'
     owner: "{{ matrix_user_name }}"
@@ -139,23 +142,23 @@ To enable the metrics, add the following configuration to your `vars.yml` file:
 
 ```yaml
 # Expose metrics (locally, on the container network).
-matrix_hookshot_metrics_enabled: true
+matrix_bridge_hookshot_metrics_enabled: true
 ```
 
 **To collect metrics from an external Prometheus server**, besides enabling metrics as described above, you will also need to enable metrics exposure on `https://matrix.example.com/metrics/hookshot` by adding the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_hookshot_metrics_proxying_enabled: true
+matrix_bridge_hookshot_metrics_proxying_enabled: true
 ```
 
 By default metrics are exposed publicly **without** password-protection. To password-protect the metrics with dedicated credentials, add the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_hookshot_container_labels_metrics_middleware_basic_auth_enabled: true
-matrix_hookshot_container_labels_metrics_middleware_basic_auth_users: ''
+matrix_bridge_hookshot_container_labels_metrics_middleware_basic_auth_enabled: true
+matrix_bridge_hookshot_container_labels_metrics_middleware_basic_auth_users: ''
 ```
 
-To `matrix_hookshot_container_labels_metrics_middleware_basic_auth_users`, set the Basic Authentication credentials (raw `htpasswd` file content) used to protect the endpoint. See https://doc.traefik.io/traefik/middlewares/http/basicauth/#users for details about it.
+To `matrix_bridge_hookshot_container_labels_metrics_middleware_basic_auth_users`, set the Basic Authentication credentials (raw `htpasswd` file content) used to protect the endpoint. See https://doc.traefik.io/traefik/middlewares/http/basicauth/#users for details about it.
 
 **Note**: alternatively, you can use `matrix_metrics_exposure_enabled` to expose all services on this `/metrics/*` feature, and you can use `matrix_metrics_exposure_http_basic_auth_enabled` and `matrix_metrics_exposure_http_basic_auth_users` to password-protect the metrics of them. See [this section](configuring-playbook-prometheus-grafana.md#collecting-metrics-to-an-external-prometheus-server) for more information.
 
@@ -175,5 +178,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: error, warn, info, debug
-matrix_hookshot_logging_level: debug
+matrix_bridge_hookshot_logging_level: debug
 ```

docs/configuring-playbook-bridge-matrix-bridge-sms.md

@@ -21,23 +21,23 @@ The bridge uses [android-sms-gateway-server](https://github.com/RebekkaMa/androi
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_sms_bridge_enabled: true
+matrix_bridge_sms_enabled: true
 
 # (optional but recommended) a room ID to a default room
-matrix_sms_bridge_default_room: ""
+matrix_bridge_sms_default_room: ""
 
 # (optional but recommended) configure your server location
-matrix_sms_bridge_default_region: DE
-matrix_sms_bridge_default_timezone: Europe/Berlin
+matrix_bridge_sms_default_region: DE
+matrix_bridge_sms_default_timezone: Europe/Berlin
 
 # Settings to connect to android-sms-gateway-server
-matrix_sms_bridge_provider_android_baseurl: https://192.168.24.24:9090
-matrix_sms_bridge_provider_android_username: admin
-matrix_sms_bridge_provider_android_password: supeSecretPassword
+matrix_bridge_sms_provider_android_baseurl: https://192.168.24.24:9090
+matrix_bridge_sms_provider_android_username: admin
+matrix_bridge_sms_provider_android_password: supeSecretPassword
 
 # (optional) if your android-sms-gateway-server uses a self signed vertificate, the bridge needs a "truststore". This can be the certificate itself.
-matrix_sms_bridge_provider_android_truststore_local_path: android-sms-gateway-server.p12
-matrix_sms_bridge_provider_android_truststore_password: 123
+matrix_bridge_sms_provider_android_truststore_local_path: android-sms-gateway-server.p12
+matrix_bridge_sms_provider_android_truststore_password: 123
 ```
 
 ### Extending the configuration
@@ -46,7 +46,7 @@ There are some additional things you may wish to configure about the bridge.
 
 Take a look at:
 
-- `roles/custom/matrix-bridge-sms/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_sms_bridge_configuration_extension_yaml` variable
+- `roles/custom/matrix-bridge-sms/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bridge_sms_configuration_extension_yaml` variable
 
 ## Installing
 

docs/configuring-playbook-bridge-mautrix-bluesky.md

@@ -27,7 +27,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_bluesky_enabled: true
+matrix_bridge_mautrix_bluesky_enabled: true
 ```
 
 ### Extending the configuration
@@ -70,5 +70,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug, trace
-matrix_mautrix_bluesky_logging_level: 'debug'
+matrix_bridge_mautrix_bluesky_logging_level: 'debug'
 ```

docs/configuring-playbook-bridge-mautrix-bridges.md

@@ -21,12 +21,12 @@ To enable the bridge, add the following configuration to your `inventory/host_va
 
 ```yaml
 # Replace SERVICENAME with one of: twitter, discord, signal, googlechat, etc.
-matrix_mautrix_SERVICENAME_enabled: true
+matrix_bridge_mautrix_SERVICENAME_enabled: true
 ```
 
-**Note**: for bridging to Meta's Messenger or Instagram, you would need to add `meta` with an underscore symbol (`_`) or hyphen (`-`) based on the context as prefix to each `SERVICENAME`; add `_` to variables (as in `matrix_mautrix_meta_messenger_configuration_extension_yaml` for example) and `-` to paths of the configuration files (as in `roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2`), respectively.
+**Note**: for bridging to Meta's Messenger or Instagram, you would need to add `meta` with an underscore symbol (`_`) or hyphen (`-`) based on the context as prefix to each `SERVICENAME`; add `_` to variables (as in `matrix_bridge_mautrix_meta_messenger_configuration_extension_yaml` for example) and `-` to paths of the configuration files (as in `roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2`), respectively.
 
-There are some additional things you may wish to configure about the bridge before you continue. Each bridge may have additional requirements besides `_enabled: true`. For example, the mautrix-telegram bridge (our documentation page about it is [here](configuring-playbook-bridge-mautrix-telegram.md)) requires the `matrix_mautrix_telegram_api_id` and `matrix_mautrix_telegram_api_hash` variables to be defined. Refer to each bridge's individual documentation page for details about enabling bridges.
+There are some additional things you may wish to configure about the bridge before you continue. Each bridge may have additional requirements besides `_enabled: true`. For example, the mautrix-telegram bridge (our documentation page about it is [here](configuring-playbook-bridge-mautrix-telegram.md)) requires the `matrix_bridge_mautrix_telegram_api_id` and `matrix_bridge_mautrix_telegram_api_hash` variables to be defined. Refer to each bridge's individual documentation page for details about enabling bridges.
 
 ### Configure bridge permissions (optional)
 
@@ -43,7 +43,7 @@ If you don't define the `matrix_admin` in your configuration (e.g. `matrix_admin
 **Alternatively** (more verbose, but allows multiple admins to be configured), you can do the same on a per-bridge basis with:
 
 ```yaml
-matrix_mautrix_SERVICENAME_configuration_extension_yaml: |
+matrix_bridge_mautrix_SERVICENAME_configuration_extension_yaml: |
   bridge:
     permissions:
       '@alice:{{ matrix_domain }}': admin
@@ -67,8 +67,8 @@ matrix_bridges_encryption_default: true
 **Alternatively**, for a specific bridge:
 
 ```yaml
-matrix_mautrix_SERVICENAME_bridge_encryption_enabled: true
-matrix_mautrix_SERVICENAME_bridge_encryption_default: true
+matrix_bridge_mautrix_SERVICENAME_bridge_encryption_enabled: true
+matrix_bridge_mautrix_SERVICENAME_bridge_encryption_default: true
 ```
 
 ### Enable relay mode (optional)
@@ -86,16 +86,16 @@ matrix_bridges_relay_enabled: true
 **Alternatively**, for a specific bridge:
 
 ```yaml
-matrix_mautrix_SERVICENAME_configuration_extension_yaml: |
+matrix_bridge_mautrix_SERVICENAME_configuration_extension_yaml: |
   bridge:
     relay:
       enabled: true
 ```
 
-You can only have one `matrix_mautrix_SERVICENAME_configuration_extension_yaml` definition in `vars.yml` per bridge, so if you need multiple pieces of configuration there, just merge them like this:
+You can only have one `matrix_bridge_mautrix_SERVICENAME_configuration_extension_yaml` definition in `vars.yml` per bridge, so if you need multiple pieces of configuration there, just merge them like this:
 
 ```yaml
-matrix_mautrix_SERVICENAME_configuration_extension_yaml: |
+matrix_bridge_mautrix_SERVICENAME_configuration_extension_yaml: |
   bridge:
     relay:
       enabled: true
@@ -115,7 +115,7 @@ Use `!prefix set-pl 100` to be able for the bot to modify room settings and invi
 By default, only admins are allowed to set themselves as relay users. To allow anyone on your homeserver to set themselves as relay users, add the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_mautrix_SERVICENAME_bridge_relay_admin_only: false
+matrix_bridge_mautrix_SERVICENAME_bridge_relay_admin_only: false
 ```
 
 ### Set the bot's username (optional)
@@ -123,7 +123,7 @@ matrix_mautrix_SERVICENAME_bridge_relay_admin_only: false
 To set the bot's username, add the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_mautrix_SERVICENAME_appservice_bot_username: "BOTNAME"
+matrix_bridge_mautrix_SERVICENAME_appservice_bot_username: "BOTNAME"
 ```
 
 ### Configure the logging level (optional)
@@ -131,13 +131,42 @@ matrix_mautrix_SERVICENAME_appservice_bot_username: "BOTNAME"
 To specify the logging level, add the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_mautrix_SERVICENAME_logging_level: warn
+matrix_bridge_mautrix_SERVICENAME_logging_level: warn
 ```
 
 Replace `warn` with one of the following to control the verbosity of the logs generated: `trace`, `debug`, `info`, `warn`, `error` or `fatal`.
 
 If you have issues with a service, and are requesting support, the higher levels of logging (those that appear earlier in the list, like `trace`) will generally be more helpful.
 
+### Expose the bridge's API (for Mautrix Manager and similar tools)
+
+Each mautrix bridge runs an HTTP API which tools like [Mautrix Manager](https://github.com/mautrix/manager) can use to help you log into the bridge. This is especially handy for bridges where logging in manually is cumbersome (like [mautrix-gmessages](configuring-playbook-bridge-mautrix-gmessages.md)).
+
+By default, the playbook exposes this API publicly at `https://matrix.example.com/bridges/SERVICENAME` (for example, `https://matrix.example.com/bridges/gmessages`). Such tools authenticate to the bridge with your own Matrix access token, so you never need to share any bridge secret with them.
+
+To make discovery easier, the playbook also serves a `/.well-known/matrix/mautrix` file which advertises all your exposed bridges. Mautrix Manager reads this file and offers your bridges automatically, so you don't need to enter their URLs by hand.
+
+This is all enabled by default. To **disable exposing the API for all bridges**, add the following configuration to your `vars.yml` file:
+
+```yaml
+matrix_bridges_exposure_enabled: false
+```
+
+**Alternatively**, to disable it for a specific bridge:
+
+```yaml
+matrix_bridge_mautrix_SERVICENAME_exposure_enabled: false
+```
+
+If you run additional bridges on the same server which are not managed by this playbook and would like compatible tools to discover them as well, you can advertise their base URLs in the `/.well-known/matrix/mautrix` file:
+
+```yaml
+matrix_static_files_file_matrix_mautrix_property_fi_mau_bridges_custom:
+  - https://matrix.example.com/bridges/SOME_OTHER_BRIDGE
+```
+
+Only list bridges hosted on (and connected to) this server here, as compatible tools will send your Matrix access token to them. For bridges on other servers, take a look at the `fi.mau.external_bridge_servers` property described in the [Mautrix Manager](https://github.com/mautrix/manager) documentation, which you can add via `matrix_static_files_file_matrix_mautrix_configuration_extension_json`.
+
 ### Extending the configuration
 
 There are some additional things you may wish to configure about the bridge.
@@ -145,7 +174,7 @@ There are some additional things you may wish to configure about the bridge.
 Take a look at:
 
 - `roles/custom/matrix-bridge-mautrix-SERVICENAME/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/custom/matrix-bridge-mautrix-SERVICENAME/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_mautrix_SERVICENAME_configuration_extension_yaml` variable
+- `roles/custom/matrix-bridge-mautrix-SERVICENAME/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bridge_mautrix_SERVICENAME_configuration_extension_yaml` variable
 
 ## Installing
 
@@ -197,7 +226,7 @@ This is the recommended way of setting up Double Puppeting, as it's easier to ac
 - Previously there were multiple different automatic double puppeting methods like one with the help of the [Shared Secret Auth password provider module](./configuring-playbook-shared-secret-auth.md), but they have been superseded by this Appservice Double Puppet method. Double puppeting with the Shared Secret Auth works at the time of writing, but is deprecated and will stop working in the future as the older methods were completely removed in the megabridge rewrites on [the upstream project](https://docs.mau.fi/bridges/general/double-puppeting.html#automatically).
 
 <!-- TODO: remove this note if the Shared Secret Auth service has stopped working or the bridges have been removed -->
-- Some bridges like [the deprecated Facebook mautrix bridge](configuring-playbook-bridge-mautrix-facebook.md) and [matrix-appservice-kakaotalk](configuring-playbook-bridge-appservice-kakaotalk.md), which is partially based on the Facebook bridge, are compatible with the Shared Secret Auth service only. These bridges automatically perform Double Puppeting if [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) service is configured and enabled on the server for this playbook.
+- Some bridges like [the deprecated Facebook mautrix bridge](configuring-playbook-bridge-mautrix-facebook.md) are compatible with the Shared Secret Auth service only. These bridges automatically perform Double Puppeting if [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) service is configured and enabled on the server for this playbook.
 
 #### Method 2: manually, by asking each user to provide a working access token
 

docs/configuring-playbook-bridge-mautrix-discord.md

@@ -39,7 +39,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_discord_enabled: true
+matrix_bridge_mautrix_discord_enabled: true
 ```
 
 ### Extending the configuration
@@ -96,7 +96,7 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug, trace
-matrix_mautrix_discord_logging_level: 'debug'
+matrix_bridge_mautrix_discord_logging_level: 'debug'
 ```
 
 ### Command requires room admin rights when user is creator

docs/configuring-playbook-bridge-mautrix-gmessages.md

@@ -27,7 +27,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_gmessages_enabled: true
+matrix_bridge_mautrix_gmessages_enabled: true
 ```
 
 ### Extending the configuration
@@ -68,5 +68,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug, trace
-matrix_mautrix_gmessages_logging_level: 'debug'
+matrix_bridge_mautrix_gmessages_logging_level: 'debug'
 ```

docs/configuring-playbook-bridge-mautrix-googlechat.md

@@ -30,7 +30,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the [Google Chat](https://chat.google.com/) bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_googlechat_enabled: true
+matrix_bridge_mautrix_googlechat_enabled: true
 ```
 
 ### Extending the configuration
@@ -70,5 +70,5 @@ As with all other services, you can find the logs in [systemd-journald](https://
 The default logging level for this component is `WARNING`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
 
 ```yaml
-matrix_mautrix_googlechat_logging_level: DEBUG
+matrix_bridge_mautrix_googlechat_logging_level: DEBUG
 ```

docs/configuring-playbook-bridge-mautrix-gvoice.md

@@ -0,0 +1,73 @@
+<!--
+SPDX-FileCopyrightText: 2026 MDAD project contributors
+SPDX-FileCopyrightText: 2026 Nikita Chernyi
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Setting up Mautrix Google Voice bridging (optional)
+
+<sup>Refer the common guide for configuring mautrix bridges: [Setting up a Generic Mautrix Bridge](configuring-playbook-bridge-mautrix-bridges.md)</sup>
+
+The playbook can install and configure [mautrix-gvoice](https://github.com/mautrix/gvoice) for you, for bridging to [Google Voice](https://voice.google.com/).
+
+See the project's [documentation](https://docs.mau.fi/bridges/go/gvoice/index.html) to learn what it does and why it might be useful to you.
+
+## Prerequisite (optional)
+
+### Enable Appservice Double Puppet
+
+If you want to set up [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do) for this bridge automatically, you need to have enabled [Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md) for this playbook.
+
+See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-puppeting-optional) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about setting up Double Puppeting.
+
+## Adjusting the playbook configuration
+
+To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
+
+```yaml
+matrix_bridge_mautrix_gvoice_enabled: true
+```
+
+### Extending the configuration
+
+There are some additional things you may wish to configure about the bridge.
+
+<!-- NOTE: relay mode is not supported for this bridge -->
+See [this section](configuring-playbook-bridge-mautrix-bridges.md#extending-the-configuration) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about variables that you can customize and the bridge's default configuration, including [bridge permissions](configuring-playbook-bridge-mautrix-bridges.md#configure-bridge-permissions-optional), [encryption support](configuring-playbook-bridge-mautrix-bridges.md#enable-encryption-optional), [bot's username](configuring-playbook-bridge-mautrix-bridges.md#set-the-bots-username-optional), etc.
+
+## Installing
+
+After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
+
+<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
+
+`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too.
+
+## Usage
+
+To use the bridge, start a chat with `@gvoicebot:example.com` (where `example.com` is your base domain, not the `matrix.` domain).
+
+Google Voice has no phone to pair and no QR code to scan. It logs in with cookies, which you copy from a browser already signed in to [voice.google.com](https://voice.google.com/) and hand to the bot. It is fiddlier than scanning a code and feels more suspicious than it is, but Google leaves no cleaner door open. The bridge's [official Authentication guide](https://docs.mau.fi/bridges/go/gvoice/authentication.html) has the exact cookies to grab and the steps for grabbing them.
+
+Those cookies are a login session, and Google expires them on its own schedule. When they lapse the bridge goes quiet and you log in again. Nothing is broken, that is just how cookie auth ages.
+
+Once you log in, the bridge builds portal rooms for your recent conversations and carries text and media both ways. Don't reach for it to start a brand-new chat or to place a call, though. That ground still belongs to Google Voice, so keep the app around for those.
+
+## Troubleshooting
+
+As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-mautrix-gvoice`.
+
+### Increase logging verbosity
+
+The default logging level for this component is `warn`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
+
+```yaml
+# Valid values: fatal, error, warn, info, debug, trace
+matrix_bridge_mautrix_gvoice_logging_level: 'debug'
+```

docs/configuring-playbook-bridge-mautrix-linkedin.md

@@ -0,0 +1,112 @@
+<!--
+SPDX-FileCopyrightText: 2026 MDAD project contributors
+SPDX-FileCopyrightText: 2026 Nikita Chernyi
+SPDX-FileCopyrightText: 2026 Suguru Hirahara
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Setting up Mautrix LinkedIn bridging (optional)
+
+<sup>Refer the common guide for configuring mautrix bridges: [Setting up a Generic Mautrix Bridge](configuring-playbook-bridge-mautrix-bridges.md)</sup>
+
+The playbook can install and configure [mautrix-linkedin](https://github.com/mautrix/linkedin) for you, for bridging to [LinkedIn](https://www.linkedin.com/) messaging.
+
+See the project's [documentation](https://docs.mau.fi/bridges/go/linkedin/index.html) to learn what it does and why it might be useful to you.
+
+>[!NOTE]
+> LinkedIn keeps its messaging function behind a login wall and does not provide a usable public API, so using this bridge requires you to manually copy cookies on a web browser for logging in. Refer to [this section](#usage) below for details.
+
+## Prerequisite
+
+### Uninstalling `beeper-linkedin`
+
+If `beeper-linkedin` bridge is enabled on your host, you need to uninstall it first, since it claims the `@linkedinbot` username and `@linkedin_*` user range as exclusive appservice namespaces, which will cause conflicts with `mautrix-linkedin`.
+
+To uninstall the bridge, set `matrix_bridge_beeper_linkedin_enabled: false` and re-run the playbook. The playbook refuses to install `mautrix-linkedin` until `beeper-linkedin` is uninstalled.
+
+### Enable Appservice Double Puppet (optional)
+
+If you want to set up [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do) for this bridge automatically, you need to have enabled [Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md) for this playbook.
+
+See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-puppeting-optional) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about setting up Double Puppeting.
+
+## Adjusting the playbook configuration
+
+To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
+
+```yaml
+matrix_bridge_mautrix_linkedin_enabled: true
+```
+
+### Extending the configuration
+
+There are some additional things you may wish to configure about the bridge.
+
+<!-- NOTE: relay mode is not supported for this bridge -->
+See [this section](configuring-playbook-bridge-mautrix-bridges.md#extending-the-configuration) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about variables that you can customize and the bridge's default configuration, including [bridge permissions](configuring-playbook-bridge-mautrix-bridges.md#configure-bridge-permissions-optional), [encryption support](configuring-playbook-bridge-mautrix-bridges.md#enable-encryption-optional), [bot's username](configuring-playbook-bridge-mautrix-bridges.md#set-the-bots-username-optional), etc.
+
+## Installing
+
+After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
+
+<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
+
+`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too.
+
+## Usage
+
+Start a chat with `@linkedinbot:example.com` (where `example.com` is your base domain, the bare one without the `matrix.` prefix) and send `login`.
+
+### Logging in
+
+To log in, you need to sign in to LinkedIn with a web browser and hand one of the requests it makes to the bot. Because the bridge presents itself as Chrome on Linux, the request needs to come from **Chrome or a Chrome-based browser**.
+
+>[!WARNING]
+> LinkedIn ties the session to the browser that made the request and rejects it when it is replayed under a different user-agent. A request copied from Firefox therefore results in a session that stops working immediately, without an error message.
+
+You need to follow these steps to log in:
+
+1. Open [linkedin.com](https://www.linkedin.com/) in a private/incognito window on Chrome / a Chrome-based browser
+2. Sign in to LinkedIn
+3. Open your browser's devtools (F12) and go to the Network tab
+4. Filter for `graphql`
+5. Right-click any one of those requests, then "Copy" and "Copy as cURL"
+6. Paste the output into the chat with the bot and send it
+
+The bridge's [official Authentication guide](https://docs.mau.fi/bridges/go/linkedin/authentication.html) walks the same steps with screenshots.
+
+Once you log in, the bridge builds portal rooms for your recent conversations and carries messages both ways.
+
+**💡 Notes:**
+
+- The request contains a login session, which LinkedIn may expire at any time. When the bridge goes quiet, log in again by following the steps above.
+- If you would rather not retrieve the request yourself, you may wish to take a look at [mautrix-manager](https://github.com/mautrix/manager).
+
+## Troubleshooting
+
+### The bot does not respond after you send it the cURL output
+
+This most likely means that you have obtained the request with a browser other than Chrome or a Chrome-based one. LinkedIn silently discards a session replayed under a different user-agent. Follow the login steps above again, this time using Chrome or a Chrome-based browser.
+
+### The bridge worked before, but has gone quiet
+
+Your LinkedIn session has most likely expired. Send `login` to the bot and follow the login steps above again.
+
+### Other issues
+
+As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-mautrix-linkedin`.
+
+### Increase logging verbosity
+
+The default logging level for this component is `warn`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
+
+```yaml
+# Valid values: fatal, error, warn, info, debug, trace
+matrix_bridge_mautrix_linkedin_logging_level: 'debug'
+```

docs/configuring-playbook-bridge-mautrix-meta-instagram.md

@@ -13,7 +13,7 @@ The playbook can install and configure the [mautrix-meta](https://github.com/mau
 
 See the project's [documentation](https://docs.mau.fi/bridges/go/meta/index.html) to learn what it does and why it might be useful to you.
 
-Since this bridge component can bridge to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) and you may wish to do both at the same time, the playbook makes it available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`). The latter is a reconfigured copy of the first one (created by `just rebuild-mautrix-meta-instagram` and `bin/rebuild-mautrix-meta-instagram.sh`).
+The mautrix-meta project provides bridging to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/), each via a separate bridge (its own binary and container image) since mautrix-meta v26.07. The playbook makes them available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`), which can both be enabled at the same time.
 
 This documentation page only deals with the bridge's ability to bridge to Instagram. For bridging to Facebook/Messenger, see [Setting up Messenger bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-messenger.md).
 
@@ -23,7 +23,7 @@ This documentation page only deals with the bridge's ability to bridge to Instag
 
 If you've been using the [mautrix-instagram](./configuring-playbook-bridge-mautrix-instagram.md) bridge, **you'd better get rid of it first** or the 2 bridges will be in conflict:
 
-- both trying to use `@instagrambot:example.com` as their username. This conflict may be resolved by adjusting `matrix_mautrix_instagram_appservice_bot_username` or `matrix_mautrix_meta_instagram_appservice_username`
+- both trying to use `@instagrambot:example.com` as their username. This conflict may be resolved by adjusting `matrix_mautrix_instagram_appservice_bot_username` or `matrix_bridge_mautrix_meta_instagram_appservice_username`
 - both trying to bridge the same DMs
 
 To do so, send a `clean-rooms` command to the management room with the old bridge bot (`@instagrambot:example.com`). It gives you a list of portals and groups of portals you may purge. Proceed with sending commands like `clean recommended`, etc.
@@ -41,7 +41,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_meta_instagram_enabled: true
+matrix_bridge_mautrix_meta_instagram_enabled: true
 ```
 
 Before proceeding to [re-running the playbook](./installing.md), you may wish to adjust the configuration further. See below.
@@ -83,5 +83,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # This bridge uses zerolog, so valid levels are: panic, fatal, error, warn, info, debug, trace
-matrix_mautrix_meta_instagram_logging_min_level: debug
+matrix_bridge_mautrix_meta_instagram_logging_min_level: debug
 ```

docs/configuring-playbook-bridge-mautrix-meta-messenger.md

@@ -14,7 +14,7 @@ The playbook can install and configure the [mautrix-meta](https://github.com/mau
 
 See the project's [documentation](https://docs.mau.fi/bridges/go/meta/index.html) to learn what it does and why it might be useful to you.
 
-Since this bridge component can bridge to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) and you may wish to do both at the same time, the playbook makes it available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`). The latter is a reconfigured copy of the first one (created by `just rebuild-mautrix-meta-instagram` and `bin/rebuild-mautrix-meta-instagram.sh`).
+The mautrix-meta project provides bridging to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/), each via a separate bridge (its own binary and container image) since mautrix-meta v26.07. The playbook makes them available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`), which can both be enabled at the same time.
 
 This documentation page only deals with the bridge's ability to bridge to Facebook Messenger. For bridging to Instagram, see [Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md).
 
@@ -41,7 +41,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_meta_messenger_enabled: true
+matrix_bridge_mautrix_meta_messenger_enabled: true
 ```
 
 Before proceeding to [re-running the playbook](./installing.md), you may wish to adjust the configuration further. See below.
@@ -56,7 +56,7 @@ The bridge can pull your Messenger messages via 3 different methods:
 - (`facebook-tor`) Facebook via `facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion` ([Tor](https://www.torproject.org/)) — does not currently proxy media downloads
 - (default) (`messenger`) Messenger via `messenger.com` — usable even without a Facebook account
 
-You may switch the mode via the `matrix_mautrix_meta_messenger_meta_mode` variable. The playbook defaults to the `messenger` mode, because it's most universal (every Facebook user has a Messenger account, but the opposite is not true).
+You may switch the mode via the `matrix_bridge_mautrix_meta_messenger_meta_mode` variable. The playbook defaults to the `messenger` mode, because it's most universal (every Facebook user has a Messenger account, but the opposite is not true).
 
 Note that switching the mode (especially between `facebook*` and `messenger`) will intentionally make the bridge use another database (`matrix_mautrix_meta_facebook` or `matrix_mautrix_meta_messenger`) to isolate the 2 instances. Switching between Tor and non-Tor may be possible without dataloss, but your mileage may vary. Before switching to a new mode, you may wish to de-configure the old one (send `help` to the bridge bot and unbridge your portals, etc.).
 
@@ -99,5 +99,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # This bridge uses zerolog, so valid levels are: panic, fatal, error, warn, info, debug, trace
-matrix_mautrix_meta_messenger_logging_min_level: debug
+matrix_bridge_mautrix_meta_messenger_logging_min_level: debug
 ```

docs/configuring-playbook-bridge-mautrix-signal.md

@@ -28,7 +28,7 @@ See the project's [documentation](https://docs.mau.fi/bridges/go/signal/index.ht
 
 If you're running with the Postgres database server integrated by the playbook (which is the default), you don't need to do anything special and can easily proceed with installing.
 
-However, if you're [using an external Postgres server](configuring-playbook-external-postgres.md), you'd need to manually prepare a Postgres database for this bridge and adjust the variables related to that (`matrix_mautrix_signal_database_*`).
+However, if you're [using an external Postgres server](configuring-playbook-external-postgres.md), you'd need to manually prepare a Postgres database for this bridge and adjust the variables related to that (`matrix_bridge_mautrix_signal_database_*`).
 
 ### Enable Appservice Double Puppet
 
@@ -41,7 +41,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_signal_enabled: true
+matrix_bridge_mautrix_signal_enabled: true
 ```
 
 ### Extending the configuration
@@ -83,5 +83,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug, trace
-matrix_mautrix_signal_logging_level: 'debug'
+matrix_bridge_mautrix_signal_logging_level: 'debug'
 ```

docs/configuring-playbook-bridge-mautrix-slack.md

@@ -34,7 +34,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_slack_enabled: true
+matrix_bridge_mautrix_slack_enabled: true
 ```
 
 ### Extending the configuration
@@ -74,5 +74,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug, trace
-matrix_mautrix_slack_logging_level: 'debug'
+matrix_bridge_mautrix_slack_logging_level: 'debug'
 ```

docs/configuring-playbook-bridge-mautrix-telegram.md

@@ -36,9 +36,9 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `YOUR_TELEGRAM_APP_ID` and `YOUR_TELEGRAM_API_HASH`.
 
 ```yaml
-matrix_mautrix_telegram_enabled: true
-matrix_mautrix_telegram_api_id: YOUR_TELEGRAM_APP_ID
-matrix_mautrix_telegram_api_hash: YOUR_TELEGRAM_API_HASH
+matrix_bridge_mautrix_telegram_enabled: true
+matrix_bridge_mautrix_telegram_api_id: YOUR_TELEGRAM_APP_ID
+matrix_bridge_mautrix_telegram_api_hash: YOUR_TELEGRAM_API_HASH
 ```
 
 ### Relaying
@@ -86,5 +86,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug, trace
-matrix_mautrix_telegram_logging_level: debug
+matrix_bridge_mautrix_telegram_logging_level: debug
 ```

docs/configuring-playbook-bridge-mautrix-twitter.md

@@ -28,7 +28,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_twitter_enabled: true
+matrix_bridge_mautrix_twitter_enabled: true
 ```
 
 ### Extending the configuration
@@ -69,5 +69,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug, trace
-matrix_mautrix_twitter_logging_level: 'debug'
+matrix_bridge_mautrix_twitter_logging_level: 'debug'
 ```

docs/configuring-playbook-bridge-mautrix-whatsapp.md

@@ -34,7 +34,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_whatsapp_enabled: true
+matrix_bridge_mautrix_whatsapp_enabled: true
 ```
 
 ### Extending the configuration
@@ -76,5 +76,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug, trace
-matrix_mautrix_whatsapp_logging_level: 'debug'
+matrix_bridge_mautrix_whatsapp_logging_level: 'debug'
 ```

docs/configuring-playbook-bridge-mautrix-wsproxy.md

@@ -25,26 +25,26 @@ When setting, replace `example.com` with your own.
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mautrix_wsproxy_enabled: true
+matrix_bridge_mautrix_wsproxy_enabled: true
 
-matrix_mautrix_androidsms_appservice_token: 'secret token from bridge'
-matrix_mautrix_androidsms_homeserver_token: 'secret token from bridge'
-matrix_mautrix_imessage_appservice_token: 'secret token from bridge'
-matrix_mautrix_imessage_homeserver_token: 'secret token from bridge'
-matrix_mautrix_wsproxy_syncproxy_shared_secret: 'secret token from bridge'
+matrix_bridge_mautrix_wsproxy_androidsms_appservice_token: 'secret token from bridge'
+matrix_bridge_mautrix_wsproxy_androidsms_homeserver_token: 'secret token from bridge'
+matrix_bridge_mautrix_wsproxy_imessage_appservice_token: 'secret token from bridge'
+matrix_bridge_mautrix_wsproxy_imessage_homeserver_token: 'secret token from bridge'
+matrix_bridge_mautrix_wsproxy_syncproxy_shared_secret: 'secret token from bridge'
 ```
 
 Note that the tokens must match what is compiled into the [mautrix-imessage](https://github.com/mautrix/imessage) bridge running on your Mac or Android device.
 
 ### Adjusting the wsproxy URL (optional)
 
-By tweaking the `matrix_mautrix_wsproxy_hostname` variable, you can easily make the service available at a **different hostname** than the default one.
+By tweaking the `matrix_bridge_mautrix_wsproxy_hostname` variable, you can easily make the service available at a **different hostname** than the default one.
 
 Example additional configuration for your `vars.yml` file:
 
 ```yaml
 # Change the default hostname
-matrix_mautrix_wsproxy_hostname: ws.example.com
+matrix_bridge_mautrix_wsproxy_hostname: ws.example.com
 ```
 
 After changing the domain, **you may need to adjust your DNS** records to point the wsproxy domain to the Matrix server.

docs/configuring-playbook-bridge-meshtastic-relay.md

@@ -26,42 +26,42 @@ You also need access to a Meshtastic device, connected to the server via one of:
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_meshtastic_relay_enabled: true
+matrix_bridge_meshtastic_relay_enabled: true
 
 # Password for the bot's Matrix account.
 # On first startup, the bridge uses this to log in and persist credentials
 # (including End-to-End Encryption material) under its data directory.
 # After that, the password can be removed from this variable.
-matrix_meshtastic_relay_matrix_bot_password: "PASSWORD_FOR_THE_BOT"
+matrix_bridge_meshtastic_relay_matrix_bot_password: "PASSWORD_FOR_THE_BOT"
 
 # How the bridge connects to your Meshtastic device.
 # One of: tcp, serial, ble
-matrix_meshtastic_relay_connection_type: tcp
+matrix_bridge_meshtastic_relay_connection_type: tcp
 
 # For connection_type: tcp
-matrix_meshtastic_relay_tcp_host: "meshtastic.local"
+matrix_bridge_meshtastic_relay_tcp_host: "meshtastic.local"
 
 # For connection_type: serial
-# matrix_meshtastic_relay_serial_port: "/dev/ttyUSB0"
+# matrix_bridge_meshtastic_relay_serial_port: "/dev/ttyUSB0"
 
 # For connection_type: ble
-# matrix_meshtastic_relay_ble_address: "AA:BB:CC:DD:EE:FF"
+# matrix_bridge_meshtastic_relay_ble_address: "AA:BB:CC:DD:EE:FF"
 
 # Matrix rooms to bridge to Meshtastic channels.
-matrix_meshtastic_relay_matrix_rooms_list:
+matrix_bridge_meshtastic_relay_matrix_rooms_list:
   - id: "#meshtastic:{{ matrix_domain }}"
     meshtastic_channel: "0"
 ```
 
-By default, the bot's Matrix ID is `@meshtasticbot:{{ matrix_domain }}`. To change it, adjust `matrix_meshtastic_relay_matrix_bot_user_id`.
+By default, the bot's Matrix ID is `@meshtasticbot:{{ matrix_domain }}`. To change it, adjust `matrix_bridge_meshtastic_relay_matrix_bot_user_id`.
 
 ### Bluetooth (BLE) connections
 
-When `matrix_meshtastic_relay_connection_type` is `ble`, the container runs with `--network=host` and bind-mounts the host's DBus socket — both are required for Bluetooth pairing/communication. Only use this connection type if you trust the playbook-managed host and are comfortable with these privileges.
+When `matrix_bridge_meshtastic_relay_connection_type` is `ble`, the container runs with `--network=host` and bind-mounts the host's DBus socket — both are required for Bluetooth pairing/communication. Only use this connection type if you trust the playbook-managed host and are comfortable with these privileges.
 
 ### Serial connections
 
-When `matrix_meshtastic_relay_connection_type` is `serial`, the host device referenced by `matrix_meshtastic_relay_serial_port` is passed through to the container. Make sure that `matrix_user_uid` / `matrix_user_gid` have read/write access to that device (e.g. by adding the matrix user to the `dialout` group, or adjusting udev rules).
+When `matrix_bridge_meshtastic_relay_connection_type` is `serial`, the host device referenced by `matrix_bridge_meshtastic_relay_serial_port` is passed through to the container. Make sure that `matrix_user_uid` / `matrix_user_gid` have read/write access to that device (e.g. by adding the matrix user to the `dialout` group, or adjusting udev rules).
 
 ### Extending the configuration
 
@@ -69,7 +69,7 @@ There are some additional things you may wish to configure about the bridge.
 
 Take a look at:
 
-- `roles/custom/matrix-bridge-meshtastic-relay/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override individual `matrix_meshtastic_relay_*` variables, or make finer-grained adjustments via `matrix_meshtastic_relay_configuration_extension_yaml`.
+- `roles/custom/matrix-bridge-meshtastic-relay/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override individual `matrix_bridge_meshtastic_relay_*` variables, or make finer-grained adjustments via `matrix_bridge_meshtastic_relay_configuration_extension_yaml`.
 
 ## Installing
 
@@ -86,7 +86,7 @@ The shortcut commands with the [`just` program](just.md) are also available: `ju
 
 ## Usage
 
-Invite the bot to the Matrix rooms listed in `matrix_meshtastic_relay_matrix_rooms_list` and it will relay between Matrix and the corresponding Meshtastic channel. Messages sent on Meshtastic will appear in Matrix and vice versa.
+Invite the bot to the Matrix rooms listed in `matrix_bridge_meshtastic_relay_matrix_rooms_list` and it will relay between Matrix and the corresponding Meshtastic channel. Messages sent on Meshtastic will appear in Matrix and vice versa.
 
 See the [project's wiki](https://github.com/jeremiah-k/meshtastic-matrix-relay/wiki) for details about commands, plugins and advanced usage.
 

docs/configuring-playbook-bridge-mx-puppet-groupme.md

@@ -18,7 +18,7 @@ See the project's [documentation](https://gitlab.com/xangelix-pub/matrix/mx-pupp
 To enable the [GroupMe](https://groupme.com/) bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mx_puppet_groupme_enabled: true
+matrix_bridge_mx_puppet_groupme_enabled: true
 ```
 
 ## Installing

docs/configuring-playbook-bridge-mx-puppet-steam.md

@@ -20,7 +20,7 @@ See the project's [documentation](https://codeberg.org/icewind/mx-puppet-steam/b
 To enable the [Steam](https://steampowered.com/) bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_mx_puppet_steam_enabled: true
+matrix_bridge_mx_puppet_steam_enabled: true
 ```
 
 ## Installing

docs/configuring-playbook-bridge-postmoogle.md

@@ -24,7 +24,7 @@ Open the following ports on your server to be able to receive incoming emails:
 
 If you don't open these ports, you will still be able to send emails, but not receive any.
 
-These port numbers are configurable via the `matrix_postmoogle_smtp_host_bind_port` and `matrix_postmoogle_submission_host_bind_port` variables, but other email servers will try to deliver on these default (standard) ports, so changing them is of little use.
+These port numbers are configurable via the `matrix_bridge_postmoogle_smtp_host_bind_port` and `matrix_bridge_postmoogle_submission_host_bind_port` variables, but other email servers will try to deliver on these default (standard) ports, so changing them is of little use.
 
 ## Adjusting DNS records
 
@@ -44,17 +44,17 @@ To make Postmoogle enable its email sending features, you need to configure MX a
 Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_postmoogle_enabled: true
+matrix_bridge_postmoogle_enabled: true
 
 # Uncomment and adjust this part if you'd like to use a username different than the default
-# matrix_postmoogle_login: postmoogle
+# matrix_bridge_postmoogle_login: postmoogle
 
 # Generate a strong password for the bot. You can create one with a command like `pwgen -s 64 1`.
-matrix_postmoogle_password: PASSWORD_FOR_THE_BOT
+matrix_bridge_postmoogle_password: PASSWORD_FOR_THE_BOT
 
 # Uncomment to add one or more admins to this bridge:
 #
-# matrix_postmoogle_admins:
+# matrix_bridge_postmoogle_admins:
 #  - '@yourAdminAccount:{{ matrix_domain }}'
 #
 # … unless you've made yourself an admin of all bots/bridges like this:
@@ -87,7 +87,7 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-use
 
   `just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed.
 
-- If you change the bridge's bot password (`matrix_postmoogle_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [Ketesa](configuring-playbook-ketesa.md) to change it, and then update `matrix_postmoogle_password` to let the bot know its new password.
+- If you change the bridge's bot password (`matrix_bridge_postmoogle_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [Ketesa](configuring-playbook-ketesa.md) to change it, and then update `matrix_bridge_postmoogle_password` to let the bot know its new password.
 
 ## Usage
 
@@ -108,5 +108,5 @@ As with all other services, you can find the logs in [systemd-journald](https://
 The default logging level for this component is `INFO`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
 
 ```yaml
-matrix_postmoogle_loglevel: 'DEBUG'
+matrix_bridge_postmoogle_loglevel: 'DEBUG'
 ```

docs/configuring-playbook-bridge-rustpush.md

@@ -40,7 +40,7 @@ See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_rustpush_bridge_enabled: true
+matrix_bridge_rustpush_enabled: true
 ```
 
 ### Disable Backfill (optional)
@@ -48,7 +48,7 @@ matrix_rustpush_bridge_enabled: true
 Backfill can be disabled globally if desired via config. By default, the bridge will backfill from iCloud (CloudKit) and APNS if available. Backfill from `chat.db` is only possible when the bridge is running on MacOS.
 
 ```yaml
-matrix_rustpush_bridge_backfill_enabled: false
+matrix_bridge_rustpush_backfill_enabled: false
 ```
 
 ### Extending the Configuration
@@ -88,8 +88,13 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug, trace
-matrix_rustpush_bridge_logging_level: 'debug'
+matrix_bridge_rustpush_logging_level: 'debug'
 
 # Enable debug logging for RustPush
-matrix_rustpush_bridge_rust_log: "warn,rustpushgo=info,openabsinthe=debug"
+matrix_bridge_rustpush_rust_log: "warn,rustpushgo=info,openabsinthe=debug"
 ```
+## Notable Configuration Options
+- `matrix_bridge_rustpush_statuskit_notifications` will display StatusKit information for conversation participants. In some clients, this update will cause the DM to be pushed to the top of the conversation list continuously, so this option is disabled by default.
+  - `matrix_bridge_rustpush_statuskit_notification_style` can be set to either `topic` or `notice`
+  - `topic` sets the status as a room topic. In supported clients (like Cinny and Sable), this will display `🔕 Focus` as a second line when the person has focus mode enabled.
+  - `notice` sends an `m.notice` event to the room which will display text in the room but should not generate a notification

docs/configuring-playbook-bridge-steam.md

@@ -15,7 +15,7 @@ See the project's [documentation](https://github.com/jasonlaguidice/matrix-steam
 To enable the [Steam](https://steampowered.com/) bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_steam_bridge_enabled: true
+matrix_bridge_steam_enabled: true
 ```
 
 ## Installing
@@ -46,3 +46,6 @@ Once logged in, send `search [name]` to search through recognized Steam friends.
 Chat rooms will automatically be opened as new messages are received.
 
 Send `help` to the bot to see the available commands.
+
+## Notable Configuration Options
+- `matrix_bridge_steam_network_presence_topic_enabled` and `matrix_bridge_steam_network_presence_topic_rich_presence_enabled` mirror Steam's [Enhanced Rich Presence](https://partner.steamgames.com/doc/features/enhancedrichpresence) feature in Matrix. This will display the user's current game and rich presence if supported by the game. This sets the DM room's `m.topic` field to achieve this. Some games (like Deadlock) update the rich presence every minute with a match timer. In some clients, the topic update will cause the DM to be pushed to the top of the conversation list continuously, so this option is disabled by default.

docs/configuring-playbook-bridge-wechat.md

@@ -19,7 +19,7 @@ See the project's [documentation](https://github.com/duo/matrix-wechat/blob/mast
 To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_wechat_enabled: true
+matrix_bridge_wechat_enabled: true
 ```
 
 ### Extending the configuration
@@ -29,7 +29,7 @@ There are some additional things you may wish to configure about the bridge.
 Take a look at:
 
 - `roles/custom/matrix-bridge-wechat/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/custom/matrix-bridge-wechat/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_wechat_configuration_extension_yaml` variable
+- `roles/custom/matrix-bridge-wechat/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bridge_wechat_configuration_extension_yaml` variable
 
 ## Installing
 
@@ -62,5 +62,5 @@ The default logging level for this component is `warn`. If you want to increase
 
 ```yaml
 # Valid values: fatal, error, warn, info, debug
-matrix_wechat_log_level: 'debug'
+matrix_bridge_wechat_log_level: 'debug'
 ```

docs/configuring-playbook-client-commet.md

@@ -0,0 +1,93 @@
+<!--
+SPDX-FileCopyrightText: 2026 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Setting up Commet (optional)
+
+The playbook can install and configure the [Commet](https://github.com/commetchat/commet) Matrix web client for you.
+
+## Adjusting DNS records
+
+By default, this playbook installs Commet on the `commet.` subdomain (`commet.example.com`) and requires you to create a CNAME record for `commet`, which targets `matrix.example.com`.
+
+When setting, replace `example.com` with your own.
+
+## Adjusting the playbook configuration
+
+To enable Commet, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
+
+```yaml
+matrix_client_commet_enabled: true
+```
+
+### Adjusting the Commet URL (optional)
+
+By tweaking the `matrix_client_commet_hostname` and `matrix_client_commet_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
+
+Example additional configuration for your `vars.yml` file:
+
+```yaml
+# Switch to the domain used for Matrix services (`matrix.example.com`),
+# so we won't need to add additional DNS records for Commet.
+matrix_client_commet_hostname: "{{ matrix_server_fqn_matrix }}"
+
+# Expose under the /commet subpath
+matrix_client_commet_path_prefix: /commet
+```
+
+After changing the domain, **you may need to adjust your DNS** records to point the Commet domain to the Matrix server.
+
+If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
+
+**Note**: `matrix_client_commet_path_prefix` must either be `/` or not end with a slash (e.g. `/commet`).
+
+### Adjusting the default homeserver (optional)
+
+Commet is configured with a `default_homeserver` value. By default, the playbook uses `matrix.org`.
+
+To change it, add the following configuration to your `vars.yml` file:
+
+```yaml
+matrix_client_commet_default_homeserver: "{{ matrix_domain }}"
+```
+
+### Adjusting the Commet version/branch to build (optional)
+
+When self-building the container image (`matrix_client_commet_container_image_self_build: true`), the playbook checks out the Commet source repository and builds an image from it.
+
+To build from a different git branch/tag/SHA, set `matrix_client_commet_version` in your `vars.yml` file:
+
+```yaml
+# Examples: "main", "v1.2.3", "feature-branch", "a1b2c3d4"
+matrix_client_commet_version: "main"
+```
+
+**Note**: by default, the image tag is derived from `matrix_client_commet_version` (`localhost/matrix-client-commet:{{ matrix_client_commet_version }}`). If your branch name contains `/` (e.g. `feature/foo`), override `matrix_client_commet_container_image` (and optionally `matrix_client_commet_container_image_self_build_version_tag`) to a Docker-tag-safe value.
+
+### Extending the configuration
+
+There are some additional things you may wish to configure about the component.
+
+Take a look at:
+
+- `roles/custom/matrix-client-commet/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
+- `roles/custom/matrix-client-commet/templates/global_config.json.j2` for the component's default runtime configuration
+
+## Installing
+
+After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the playbook with [playbook tags](playbook-tags.md) as below:
+
+<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
+
+`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too.
+
+## Troubleshooting
+
+As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-client-commet`.

docs/configuring-playbook-federation.md

@@ -71,4 +71,6 @@ matrix_synapse_federation_port_enabled: false
 matrix_synapse_tls_federation_listener_enabled: false
 ```
 
+**Note**: `matrix_synapse_federation_port_enabled: false` only makes sense in this specific setup, where federation traffic is served through the client port (because of the `federation` entry in `matrix_synapse_http_listener_resource_names`). If federation still flows through the dedicated federation port on your setup (e.g. another reverse proxy of yours forwarding a custom public port to this playbook's federation port), leave `matrix_synapse_federation_port_enabled` at its default (enabled). Disabling it removes the federation route entirely and breaks such setups.
+
 **Use this at you own risk as all the possible side-effects of doing this are not fully known. However, it has been tested and works fine and passes all the tests on <https://federationtester.matrix.org/> without issues.**

docs/configuring-playbook-jwt-service.md

@@ -1,47 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2024 wjbeckett
-SPDX-FileCopyrightText: 2024 Slavi Pantaleev
-
-SPDX-License-Identifier: AGPL-3.0-or-later
--->
-
-# Setting up JWT Service (optional)
-
-The playbook can install and configure [LiveKit JWT Service](https://github.com/element-hq/lk-jwt-service) for you.
-
-LK-JWT-Service is currently used for a single reason: generate JWT tokens with a given identity for a given room, so that users can use them to authenticate against LiveKit SFU.
-
-See the project's [documentation](https://github.com/element-hq/lk-jwt-service/) to learn more.
-
-## Decide on a domain and path
-
-By default, JWT Service is configured to be served:
-
-- on the Matrix domain (`matrix.example.com`), configurable via `matrix_livekit_jwt_service_hostname`
-- under a `/livekit-jwt-service` path prefix, configurable via `matrix_livekit_jwt_service_path_prefix`
-
-This makes it easy to set it up, **without** having to adjust your DNS records manually.
-
-## Adjusting DNS records
-
-If you've changed the default hostname, **you may need to adjust your DNS** records accordingly to point to the correct server.
-
-## Adjusting the playbook configuration
-
-Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
-
-```yaml
-matrix_livekit_jwt_service_enabled: true
-```
-
-## Installing
-
-After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the [installation](installing.md) command: `just install-all` or `just setup-all`
-
-## Usage
-
-Once installed, a new `org.matrix.msc4143.rtc_foci` section is added to the Element Web client to point to your JWT service URL (e.g., `https://matrix.example.com/livekit-jwt-service`).
-
-## Additional Information
-
-Refer to the LiveKit JWT-Service documentation for more details on configuring and using JWT Service.

docs/configuring-playbook-ketesa.md

@@ -13,14 +13,14 @@ SPDX-License-Identifier: AGPL-3.0-or-later
 
 # Setting up Ketesa (optional)
 
-The playbook can install and configure [Ketesa](https://github.com/etkecc/ketesa) for you.
+The playbook can install and configure [Ketesa](https://ketesa.app) ([source code](https://github.com/etkecc/ketesa)) for you.
 
 Ketesa is a fully-featured admin interface for Matrix homeservers — manage users, rooms, media, sessions, and more from one clean, responsive web UI. It is the evolution of [Awesome-Technologies/synapse-admin](https://github.com/Awesome-Technologies/synapse-admin): what began as a fork has grown into its own independent project with a redesigned interface, comprehensive Synapse and MAS API coverage, and multi-language support. See the [Ketesa v1.0.0 announcement](https://etke.cc/blog/introducing-ketesa/) for a full overview of what's new.
 
 >[!NOTE]
 >
 > - Ketesa does not work with other homeserver implementations than Synapse due to API's incompatibility.
-> - The latest version of Ketesa is hosted by [etke.cc](https://etke.cc/) at [admin.etke.cc](https://admin.etke.cc/). If you only need this service occasionally and trust giving your admin credentials to a 3rd party Single Page Application, you can consider using it from there and avoiding the (small) overhead of self-hosting.
+> - The latest version of Ketesa is hosted by [etke.cc](https://etke.cc/) at [cloud.ketesa.app](https://cloud.ketesa.app/). If you only need this service occasionally and trust giving your admin credentials to a 3rd party Single Page Application, you can consider using it from there and avoiding the (small) overhead of self-hosting.
 > - This playbook also supports an alternative management UI in the shape of [Element Admin](./configuring-playbook-element-admin.md). Please note that it's currently less feature-rich than Ketesa and requires [Matrix Authentication Service](./configuring-playbook-matrix-authentication-service.md).
 
 ## Adjusting DNS records (optional)
@@ -41,6 +41,7 @@ matrix_ketesa_enabled: true
 
 - for [Synapse](./configuring-playbook-synapse.md) (our default homeserver implementation): `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true`
 - for [Dendrite](./configuring-playbook-dendrite.md): `matrix_dendrite_container_labels_public_client_synapse_admin_api_enabled: true`
+- for [Tuwunel](./configuring-playbook-tuwunel.md): `matrix_tuwunel_container_labels_public_client_synapse_admin_api_enabled: true`
 
 By default, Ketesa installation will be [restricted to only work with one homeserver](https://github.com/etkecc/ketesa/blob/main/README.md#restricting-available-homeserver) — the one managed by the playbook. To adjust these restrictions, tweak the `matrix_ketesa_config_restrictBaseUrl` variable.
 

docs/configuring-playbook-prometheus-grafana.md

@@ -183,6 +183,9 @@ Name | Description
 `prometheus_postgres_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [Postgres exporter](#enable-metrics-and-graphs-for-postgres-optional) metrics on `https://matrix.example.com/metrics/postgres-exporter`.
 `prometheus_nginxlog_exporter_enabled`|Set this to `true` to enable the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) (locally, on the container network).
 `prometheus_nginxlog_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) metrics on `https://matrix.example.com/metrics/nginxlog`.
+`ntfy_metrics_listen_http_port`|Set this to a port number (e.g. `9090`) to make [ntfy](configuring-playbook-ntfy.md) serve its metrics (locally, on the container network) on that port.
+`ntfy_container_labels_traefik_metrics_enabled`|Set this to `true` to expose the [ntfy](configuring-playbook-ntfy.md) metrics on `https://matrix.example.com/metrics/ntfy`.
+`matrix_synapse_usage_exporter_metrics_proxying_enabled`|Set this to `true` to expose the [synapse-usage-exporter](configuring-playbook-synapse-usage-exporter.md) metrics on `https://matrix.example.com/metrics/synapse-usage-exporter`.
 
 ### Expose metrics of other services/roles
 

docs/configuring-playbook-synapse-usage-exporter.md

@@ -1,7 +1,7 @@
 <!--
 SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
 SPDX-FileCopyrightText: 2024 Michael Hollister
-SPDX-FileCopyrightText: 2024 Slavi Pantaleev
+SPDX-FileCopyrightText: 2024 - 2026 Slavi Pantaleev
 
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
@@ -38,13 +38,35 @@ To enable synapse-usage-exporter, add the following configuration to your `inven
 ```yaml
 matrix_synapse_usage_exporter_enabled: true
 
-# (Optional) Expose endpoint if you want to collect statistics from outside (from other homeservers).
+# (Optional) Expose the usage-stats ingestion endpoint if you want to collect statistics from outside (from other homeservers).
 # If enabled, synapse-usage-exporter will be exposed publicly at `matrix.example.com/report-usage-stats/push`.
 # When collecting usage statistics for Synapse running on the same host, you don't need to enable this.
 # You can adjust the hostname and path via `matrix_synapse_usage_exporter_hostname` and `matrix_synapse_usage_exporter_path_prefix`.
 # matrix_synapse_usage_exporter_proxying_enabled: true
 ```
 
+**Note**: `matrix_synapse_usage_exporter_proxying_enabled` only exposes the endpoint that Synapse pushes usage statistics **to** (`/report-usage-stats/push`). Despite its generic name, it has nothing to do with the metrics endpoint that Prometheus reads **from**. See [below](#collecting-metrics-to-an-external-prometheus-server) for exposing metrics.
+
+### Collecting metrics to an external Prometheus server
+
+Metrics are always served on the container network, so the [integrated Prometheus](./configuring-playbook-prometheus-grafana.md) (`prometheus_enabled: true`) scrapes them without any additional configuration.
+
+To collect them with an **external Prometheus server**, you need to expose them publicly. You can do so by enabling metrics exposure for all services (`matrix_metrics_exposure_enabled: true`), or just for this service:
+
+```yaml
+# Expose the metrics on https://matrix.example.com/metrics/synapse-usage-exporter
+matrix_synapse_usage_exporter_metrics_proxying_enabled: true
+
+# Uncomment to password-protect the metrics for synapse-usage-exporter.
+# matrix_synapse_usage_exporter_container_labels_traefik_metrics_middleware_basic_auth_enabled: true
+
+# Uncomment and set this part to the Basic Authentication credentials (raw `htpasswd` file content) used to protect the endpoint.
+# See https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+# matrix_synapse_usage_exporter_container_labels_traefik_metrics_middleware_basic_auth_users: ''
+```
+
+Refer to [this section](./configuring-playbook-prometheus-grafana.md#collecting-metrics-to-an-external-prometheus-server) of the Prometheus and Grafana documentation for more details.
+
 ### Adjusting the synapse-usage-exporter URL (optional)
 
 By tweaking the `matrix_synapse_usage_exporter_hostname` and `matrix_synapse_usage_exporter_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.

docs/configuring-playbook-synology.md

@@ -0,0 +1,179 @@
+<!--
+SPDX-FileCopyrightText: 2026 Chiu Ki Sit
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Configuring Synology DSM
+
+This document is a guide for preparing Synology DSM for the installation of the [Matrix Docker Ansible Deploy](https://github.com/spantaleev/matrix-docker-ansible-deploy) project.
+
+> **Note:** Synology DSM is a community-supported platform. It is not officially tested or maintained by the project maintainers. Use at your own discretion.
+
+**Intended audience:** Users already familiar with DSM, SSH, and this Ansible project.
+
+## Assumptions
+
+- DSM version 7 or higher
+- `Volume1` is used as the default Docker storage location
+- You are using DSM's built-in reverse proxy for handling HTTPS
+
+## How Synology Support Works
+
+The playbook automatically detects Synology DSM by checking for `/etc/synoinfo.conf`. When detected, it:
+
+- Uses `synouser` and `synogroup` (DSM-native tools) instead of standard Linux user management
+- Constrains the Python `requests` package to a version compatible with the Docker SDK
+- Ensures `/volume1` has shared mount propagation so container bind mounts work correctly
+- Deploys a `matrix-synology-boot-fix` service that runs on every boot after Docker is ready
+
+You can override auto-detection by setting `matrix_base_host_is_synology: true` or `false` in your `vars.yml`.
+
+### Matrix Service Account
+
+The playbook creates a `matrix` system account using Synology's `synouser` tool. The account is secured as follows:
+
+- **Expired** (`expired=1`) — the account cannot be used to log in to DSM or any application
+
+You must set a password for this account via `matrix_synology_user_password` in your `vars.yml` (see [vars.yml Configuration](#varsyml-configuration)). The password cannot be used to log in because the account is expired, but a non-empty password is required as an additional security layer.
+
+> If you pre-create the `matrix` user manually before running the playbook, the playbook will not modify the existing account's settings — you are responsible for securing it.
+
+### Boot-fix Service
+
+Synology DSM has two boot-time quirks that the boot-fix service addresses automatically:
+
+1. **`/volume1` shared mount propagation**
+
+    Docker requires `/volume1` to be mounted as shared (`mount --make-shared /volume1`) for container bind mounts with `bind-propagation=slave` to work correctly (used by matrix-synapse for its media store). On Synology, this cannot be inserted into the systemd chain before Container Manager starts — doing so causes Container Manager to detect a broken dependency and prompt for repair on every boot. The playbook applies this during setup, and the boot-fix service re-applies it on every subsequent reboot, safely outside Container Manager's dependency chain.
+
+2. **Skipped services at boot**
+
+    Synology's systemd drops services with multi-level dependency chains from the boot activation queue (e.g. `matrix-traefik → matrix-container-socket-proxy → docker`). These services show as `inactive` or `failed` after reboot even though they are enabled. The boot-fix service scans for any enabled `matrix-*.service` in either state and starts them automatically.
+
+    > **If you previously configured a Task Scheduler entry** (`Control Panel > Task Scheduler`) to run `mount --make-shared /volume1` at boot-up, you can remove it — the boot-fix service now handles this.
+
+## Synology GUI Preparation
+
+1. **Enable SSH**
+   - `Control Panel` > `Terminal & SNMP` > `Enable SSH service`
+
+2. **Enable SFTP**
+   - `Control Panel` > `File Service` > `FTP` > `Enable SFTP service` with default port
+
+3. **Enable User Home Directory**
+   - `Control Panel` > `User & Group` > `Advanced` > `Enable user home service`
+
+4. **Install Container Manager**
+   - Install from `Package Center`
+
+5. **Configure Reverse Proxy**
+   - `Control Panel` > `Login Portal` > `Advanced` > `Reverse Proxy`
+   - Create entries for each service you enable (e.g. Matrix, Element, admin page)
+   - Example entry:
+     - Source: `HTTPS` / `matrix.example.com` / port `443`
+     - Destination: `HTTP` / `localhost` / port `81`
+
+## SSH Preparation
+
+### (Optional but Recommended) Enable SSH Key Authentication
+
+Configure key-based SSH login to avoid password prompts during Ansible runs.
+
+### Set Up the Ansible Environment
+
+Create a project folder and Python virtual environment on the DSM host:
+
+```shell
+mkdir ~/path/to/your/project/folder
+cd ~/path/to/your/project/folder
+
+python3 -m venv ./myenv
+# (optional) activate python virtual environment
+# source ./myenv/bin/activate
+```
+
+## Inventory Configuration
+
+In your `inventory/hosts` file, set the Python interpreter to your virtual environment:
+
+```ini
+# SSH key authentication with empty passphrase example
+matrix.example.com ansible_host=<your-dsm-ip> ansible_ssh_user=<dsm-ssh-user> become=true become_user=root ansible_python_interpreter=/volume1/homes/path/to/your/project/folder/myenv/bin/python ansible_sudo_pass='your-password'
+```
+
+## vars.yml Configuration
+
+Add the following Synology-specific variables to your `vars.yml`:
+
+```yaml
+# Synology-specific settings
+
+# Controls Synology DSM-specific handling. `null` means autodetect (via /etc/synoinfo.conf).
+# Set to `true`/`false` to force.
+# matrix_base_host_is_synology: true
+
+# Password for the Matrix service account created by the playbook.
+# The account is created as expired so this password cannot be used to log in.
+matrix_synology_user_password: "your-strong-password"
+
+# User and group that will be created automatically by the playbook
+matrix_user_name: "matrix"
+matrix_group_name: "matrix"
+
+# Data path on your Synology volume
+matrix_base_data_path: "/volume1/docker/matrix"
+
+# Use Synology Container Manager's Docker daemon instead of installing Docker
+matrix_playbook_docker_installation_enabled: false
+devture_systemd_docker_base_host_command_docker: "/var/packages/ContainerManager/target/usr/bin/docker"
+devture_systemd_docker_base_docker_service_name: "pkg-ContainerManager-dockerd.service"
+
+# Use Synology's NTP service
+devture_timesync_ntpd_service: "chronyd"
+
+# Reverse proxy settings — use HTTPS at the DSM reverse proxy level
+matrix_playbook_ssl_enabled: true
+traefik_config_entrypoint_web_secure_enabled: false
+
+# Bind to localhost only — DSM reverse proxy handles public traffic
+traefik_container_web_host_bind_port: '127.0.0.1:81'
+matrix_playbook_public_matrix_federation_api_traefik_entrypoint_host_bind_port: '127.0.0.1:8449'
+
+# Trust X-Forwarded-* headers from the local reverse proxy
+traefik_config_entrypoint_web_forwardedHeaders_insecure: true
+
+matrix_playbook_public_matrix_federation_api_traefik_entrypoint_config_custom:
+  forwardedHeaders:
+    insecure: true
+```
+
+## Running the Playbook
+
+```shell
+# Full setup
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all
+
+# start
+ansible-playbook -i inventory/hosts setup.yml --tags=install-all,start
+
+# Stop all services
+ansible-playbook -i inventory/hosts setup.yml --tags=stop
+
+# Apply config changes (always include start to restart running containers)
+ansible-playbook -i inventory/hosts setup.yml --tags=stop,setup-all,start
+```
+
+> **Important:** Always include `stop` before `setup-all,start` when changing configuration. Running `setup-all` alone does not restart already-running containers.
+
+## Creating Matrix Users
+
+After the services are running, create your first Matrix user:
+
+```shell
+# option 1:
+sudo docker exec -it matrix-synapse register_new_matrix_user http://localhost:8008 -c /data/homeserver.yaml -u your_username -p your_password
+
+# option 2:
+ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=your_username password=your_password admin=yes|no' --tags=register-user
+```

docs/configuring-playbook-tuwunel.md

@@ -180,6 +180,33 @@ When enabled, rooms with a valid `m.room.policy` state event have outgoing event
 
 The role sets `default_room_version: '12'`, so newly created rooms default to Matrix [room version 12](https://github.com/matrix-org/matrix-spec-proposals/pull/4289) ("Hydra"). Override `matrix_tuwunel_config_default_room_version` if you need an earlier version for client compatibility.
 
+### The `/_tuwunel` API path
+
+Besides `/_matrix`, Tuwunel serves its own first-party routes under `/_tuwunel`. This namespace carries ad-hoc endpoints such as `/_tuwunel/server_version` and `/_tuwunel/local_user_count`, and the [native OpenID Connect provider](https://matrix-construct.github.io/tuwunel/authentication/oidc-server.html) endpoints (`/_tuwunel/oidc/...`) that clients use when Tuwunel handles OIDC login itself, rather than delegating to an upstream provider as described above. The role routes `/_tuwunel` on the public entrypoint by default so these features work out of the box.
+
+To keep this namespace off the public entrypoint and expose it only on the internal one, set:
+
+```yaml
+matrix_tuwunel_container_labels_public_tuwunel_api_enabled: false
+matrix_tuwunel_container_labels_internal_tuwunel_api_enabled: true
+```
+
+### Exposing the Administration API
+
+Tuwunel serves a Synapse-compatible Administration API under the `/_synapse/admin` path, so administration dashboards (such as synapse-admin and ketesa) and moderation bots (such as Draupnir and Meowlnir) work against it. The served endpoints are listed on the [Tuwunel Synapse Admin API page](https://matrix-construct.github.io/tuwunel/development/compliance/synapse-admin.html).
+
+The API is not routed through the reverse proxy by default. Every endpoint requires an administrator access token, but you may still prefer to keep it off the public entrypoint. To reach it only from trusted networks, expose it on the internal Traefik entrypoint:
+
+```yaml
+matrix_tuwunel_container_labels_internal_client_synapse_admin_api_enabled: true
+```
+
+To expose it publicly instead (for example, when a dashboard runs in the browser), set:
+
+```yaml
+matrix_tuwunel_container_labels_public_client_synapse_admin_api_enabled: true
+```
+
 ## Creating the first user account
 
 Unlike Synapse and Dendrite, Tuwunel does not register users from the command line or via the playbook. On first startup it logs a one-time-use registration token to its journal:

docs/configuring-playbook.md

@@ -95,6 +95,8 @@ Web clients for Matrix that you can host on your own domains.
 
 - [Setting up FluffyChat Web](configuring-playbook-client-fluffychat-web.md), if you've enabled [FluffyChat Web](https://github.com/krille-chan/fluffychat), a cute cross-platform messenger (web, iOS, Android) for Matrix written in [Flutter](https://flutter.dev/)
 
+- [Setting up Commet](configuring-playbook-client-commet.md), if you've enabled [Commet](https://github.com/commetchat/commet), a Matrix web client
+
 
 ### Authentication and user-related
 
@@ -144,6 +146,10 @@ Bridges can be used to connect your Matrix installation with third-party communi
 
 - [Setting up Mautrix Google Messages bridging](configuring-playbook-bridge-mautrix-gmessages.md)
 
+- [Setting up Mautrix Google Voice bridging](configuring-playbook-bridge-mautrix-gvoice.md)
+
+- [Setting up Mautrix LinkedIn bridging](configuring-playbook-bridge-mautrix-linkedin.md)
+
 - [Setting up Mautrix Whatsapp bridging](configuring-playbook-bridge-mautrix-whatsapp.md)
 
 - [Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md)
@@ -164,9 +170,7 @@ Bridges can be used to connect your Matrix installation with third-party communi
 
 - [Setting up Appservice Discord bridging](configuring-playbook-bridge-appservice-discord.md)
 
-- [Setting up Appservice Kakaotalk bridging](configuring-playbook-bridge-appservice-kakaotalk.md)
-
-- [Setting up Beeper LinkedIn bridging](configuring-playbook-bridge-beeper-linkedin.md)
+- [Setting up Beeper LINE bridging](configuring-playbook-bridge-beeper-line.md)
 
 - [Setting up matrix-hookshot](configuring-playbook-bridge-hookshot.md) — a bridge between Matrix and multiple project management services, such as [GitHub](https://github.com), [GitLab](https://about.gitlab.com) and [JIRA](https://www.atlassian.com/software/jira).
 
@@ -190,12 +194,10 @@ Bridges can be used to connect your Matrix installation with third-party communi
 
 Bots provide various additional functionality to your installation.
 
-- [Setting up baibot](configuring-playbook-bot-baibot.md) — a bot through which you can talk to various [AI](https://en.wikipedia.org/wiki/Artificial_intelligence) / [Large Language Models](https://en.wikipedia.org/wiki/Large_language_model) services ([OpenAI](https://openai.com/)'s [ChatGPT](https://openai.com/blog/chatgpt/) and [others](https://github.com/etkecc/baibot/blob/main/docs/providers.md))
+- [Setting up baibot](configuring-playbook-bot-baibot.md) — a bot through which you can talk to various [AI](https://en.wikipedia.org/wiki/Artificial_intelligence) / [Large Language Models](https://en.wikipedia.org/wiki/Large_language_model) services (the privacy-first [Venice](configuring-playbook-bot-baibot.md#venice) we recommend, [OpenAI](https://openai.com/)'s [ChatGPT](https://openai.com/blog/chatgpt/), and [others](https://github.com/etkecc/baibot/blob/main/docs/providers.md))
 
 - [Setting up matrix-reminder-bot](configuring-playbook-bot-matrix-reminder-bot.md) — a bot to remind you about stuff
 
-- [Setting up matrix-registration-bot](configuring-playbook-bot-matrix-registration-bot.md) — a bot to create and manage registration tokens to invite users
-
 - [Setting up maubot](configuring-playbook-bot-maubot.md) — a plugin-based Matrix bot system
 
 - [Setting up Honoroit](configuring-playbook-bot-honoroit.md) — a helpdesk bot
@@ -206,6 +208,8 @@ Bots provide various additional functionality to your installation.
 
 - [Setting up Draupnir for all/D4A](configuring-playbook-appservice-draupnir-for-all.md) — like the [Draupnir bot](configuring-playbook-bot-draupnir.md) mentioned above, but running in appservice mode and supporting multiple instances
 
+- [Setting up Meowlnir](configuring-playbook-bot-meowlnir.md) — a moderation tool/bot which speaks the same policy list protocol as Draupnir and Mjolnir, but runs in appservice mode and can override policies coming from lists you do not control
+
 - [Setting up Buscarron](configuring-playbook-bot-buscarron.md) — a bot you can use to send any form (HTTP POST, HTML) to a (encrypted) Matrix room
 
 ### Administration
@@ -263,10 +267,14 @@ Various services that don't fit any other categories.
 
 - [Setting up the Sliding Sync proxy](configuring-playbook-sliding-sync-proxy.md) for clients which require Sliding Sync support (like old Element X versions, before it got switched to Simplified Sliding Sync)
 
+- [Setting up Appservice Kakaotalk bridging](configuring-playbook-bridge-appservice-kakaotalk.md) (removed; the upstream repository has become unreachable and the component could only be installed by self-building it)
+
 - [Setting up Appservice Slack bridging](configuring-playbook-bridge-appservice-slack.md) (removed; this component has been discontinued)
 
 - [Setting up Appservice Webhooks bridging](configuring-playbook-bridge-appservice-webhooks.md) (deprecated; the bridge's author suggests taking a look at [matrix-hookshot](https://github.com/matrix-org/matrix-hookshot) as a replacement, which can also be [installed using this playbook](configuring-playbook-bridge-hookshot.md))
 
+- [Setting up Beeper LinkedIn bridging](configuring-playbook-bridge-beeper-linkedin.md) (unmaintained; the [upstream repository](https://github.com/beeper/linkedin) has been archived. Consider [setting up Mautrix LinkedIn bridging](configuring-playbook-bridge-mautrix-linkedin.md))
+
 - [Setting up the Dimension integration manager](configuring-playbook-dimension.md) ([unmaintained](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2806#issuecomment-1673559299); after [installing](installing.md))
 
 - [Setting up Email2Matrix](configuring-playbook-email2matrix.md) (removed; the author suggests taking a look at [Postmoogle](https://github.com/etkecc/postmoogle) as a replacement, which can also be [installed using this playbook](configuring-playbook-bridge-postmoogle.md))
@@ -283,6 +291,8 @@ Various services that don't fit any other categories.
 
 - [Setting up matrix-registration](configuring-playbook-matrix-registration.md) (removed; this component has been unmaintained)
 
+- [Setting up matrix-registration-bot](configuring-playbook-bot-matrix-registration-bot.md) (removed; this component has been unmaintained)
+
 - [Setting up Mautrix Facebook bridging](configuring-playbook-bridge-mautrix-facebook.md) (deprecated in favor of the Messenger/Instagram bridge with [mautrix-meta-messenger](configuring-playbook-bridge-mautrix-meta-messenger.md))
 
 - [Setting up Mautrix Instagram bridging](configuring-playbook-bridge-mautrix-instagram.md) (deprecated in favor of the Messenger/Instagram bridge with [mautrix-meta-instagram](configuring-playbook-bridge-mautrix-meta-instagram.md))

docs/configuring-well-known.md

@@ -104,6 +104,14 @@ All you need to do is:
 
 - set up the server at your base domain (e.g. `example.com`) so that it adds an extra HTTP header when serving the `/.well-known/matrix/client` file. [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS), the `Access-Control-Allow-Origin` header should be set with a value of `*`. If you don't do this step, web-based Matrix clients (like Element Web) may fail to work. Setting up headers for the `/.well-known/matrix/server` file is not necessary, as this file is only consumed by non-browsers, which don't care about CORS.
 
+- make sure the files are served with a `Content-Type: application/json` HTTP header. You can verify this by running `curl -i https://example.com/.well-known/matrix/client`. Some web servers serve extensionless files as plain text or even offer them as downloads, which breaks stricter clients such as Element X ([manifesting as errors like `MISSING_MATRIX_RTC_FOCUS`](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4763)). On Apache-based hosting, you can force the correct content type by placing an `.htaccess` file next to the files:
+
+  ```apache
+  <FilesMatch "^(client|server|support)$">
+      ForceType application/json
+  </FilesMatch>
+  ```
+
 This is relatively easy to do and possibly your only choice if you can only host static files from the base domain's server. It is, however, **a little fragile**, as future updates performed by this playbook may regenerate the well-known files and you may need to notice that and copy them over again.
 
 #### (Option 2): **Setting up reverse-proxying** of the well-known files from the base domain's server to the Matrix server
@@ -112,7 +120,9 @@ This option is less fragile and generally better.
 
 On the base domain's server (e.g. `example.com`), you can set up reverse-proxying (or simply a 302 redirect), so that any access for the `/.well-known/matrix` location prefix is forwarded to the Matrix domain's server (e.g. `matrix.example.com`).
 
-With this method, you **don't need** to add special HTTP headers for [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) reasons (like `Access-Control-Allow-Origin`), because your Matrix server (where requests ultimately go) will be configured by this playbook correctly.
+With reverse-proxying, you **don't need** to add special HTTP headers for [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) reasons (like `Access-Control-Allow-Origin`), because your Matrix server (where requests ultimately go) will be configured by this playbook correctly.
+
+If you use a 302 redirect instead, be aware that browsers apply CORS checks to every response in the redirect chain, so the redirect response itself must also carry an `Access-Control-Allow-Origin: *` header. Otherwise, web-based Matrix clients (like Element Web) may fail to work even though the final destination sets the header correctly.
 
 **For nginx**, it would be something like this:
 
@@ -155,6 +165,23 @@ example.com {
 }
 ```
 
+**Note**: Caddy does not process directives in the order they appear in the Caddyfile, but according to its own [directive order](https://caddyserver.com/docs/caddyfile/directives#directive-order). Notably, `redir` is evaluated before `reverse_proxy`, so a `redir` elsewhere in the same site block (a common way to send the base domain to `www.example.com` or to another site) takes precedence and breaks the well-known reverse-proxying. In such cases, wrap the directives in [`handle`](https://caddyserver.com/docs/caddyfile/directives/handle) blocks to enforce the intended priority:
+
+```caddy
+example.com {
+	handle /.well-known/matrix/* {
+		reverse_proxy https://matrix.example.com {
+			header_up Host {upstream_hostport}
+		}
+	}
+
+	handle {
+		# Everything else, e.g. a redirect to some other site
+		redir https://www.example.com{uri}
+	}
+}
+```
+
 **For HAProxy**, it would be something like this:
 
 ```haproxy

docs/container-images.md

@@ -91,6 +91,8 @@ Bridges can be used to connect your Matrix installation with third-party communi
 | [mautrix-slack](configuring-playbook-bridge-mautrix-slack.md) | [mautrix/slack](https://mau.dev/mautrix/slack/container_registry) | ❌ | Bridge to [Slack](https://slack.com/) |
 | [mautrix-telegram](configuring-playbook-bridge-mautrix-telegram.md) | [mautrix/telegram](https://mau.dev/mautrix/telegram/container_registry) | ❌ | Bridge to [Telegram](https://telegram.org/) |
 | [mautrix-gmessages](configuring-playbook-bridge-mautrix-gmessages.md) | [mautrix/gmessages](https://mau.dev/mautrix/gmessages/container_registry) | ❌ | Bridge to [Google Messages](https://messages.google.com/) |
+| [mautrix-gvoice](configuring-playbook-bridge-mautrix-gvoice.md) | [mautrix/gvoice](https://mau.dev/mautrix/gvoice/container_registry) | ❌ | Bridge to [Google Voice](https://voice.google.com/) |
+| [mautrix-linkedin](configuring-playbook-bridge-mautrix-linkedin.md) | [mautrix/linkedin](https://mau.dev/mautrix/linkedin/container_registry) | ❌ | Bridge to [LinkedIn](https://www.linkedin.com/) |
 | [mautrix-whatsapp](configuring-playbook-bridge-mautrix-whatsapp.md) | [mautrix/whatsapp](https://mau.dev/mautrix/whatsapp/container_registry) | ❌ | Bridge to [WhatsApp](https://www.whatsapp.com/) |
 | [mautrix-wsproxy](configuring-playbook-bridge-mautrix-wsproxy.md) | [mautrix/wsproxy](https://mau.dev/mautrix/wsproxy/container_registry) | ❌ | Bridge to Android SMS or Apple iMessage |
 | [mautrix-twitter](configuring-playbook-bridge-mautrix-twitter.md) | [mautrix/twitter](https://mau.dev/mautrix/twitter/container_registry) | ❌ | Bridge to [Twitter](https://twitter.com/) |
@@ -98,8 +100,8 @@ Bridges can be used to connect your Matrix installation with third-party communi
 | mautrix-meta (for [Messenger](configuring-playbook-bridge-mautrix-meta-messenger.md) and [Instagram](configuring-playbook-bridge-mautrix-meta-instagram.md)) | [mautrix/meta](https://mau.dev/mautrix/meta/container_registry) | ❌ | Bridge to [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) |
 | [mautrix-signal](configuring-playbook-bridge-mautrix-signal.md) | [mautrix/signal](https://mau.dev/mautrix/signal/container_registry) | ❌ | Bridge to [Signal](https://www.signal.org/) |
 | [beeper-linkedin](configuring-playbook-bridge-beeper-linkedin.md) | [beeper/linkedin](https://ghcr.io/beeper/linkedin) | ❌ | Bridge to [LinkedIn](https://www.linkedin.com/) |
+| [beeper-line](configuring-playbook-bridge-beeper-line.md) | [crispyduck/beeper-line](https://hub.docker.com/r/crispyduck/beeper-line) | ❌ | Bridge to [LINE](https://line.me/) |
 | [matrix-appservice-irc](configuring-playbook-bridge-appservice-irc.md) | [matrixdotorg/matrix-appservice-irc](https://hub.docker.com/r/matrixdotorg/matrix-appservice-irc) | ❌ | Bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) |
-| [matrix-appservice-kakaotalk](configuring-playbook-bridge-appservice-kakaotalk.md) | Self-building | ❌ | Bridge to [Kakaotalk](https://www.kakaocorp.com/page/service/service/KakaoTalk?lang=ENG) |
 | [matrix-appservice-discord](configuring-playbook-bridge-appservice-discord.md) | [matrix-org/matrix-appservice-discord](https://ghcr.io/matrix-org/matrix-appservice-discord) | ❌ | Bridge to [Discord](https://discordapp.com/) |
 | [matrix-hookshot](configuring-playbook-bridge-hookshot.md) | [halfshot/matrix-hookshot](https://hub.docker.com/r/halfshot/matrix-hookshot) | ❌ | Bridge for generic webhooks and multiple project management services, such as GitHub, GitLab, Figma, and Jira in particular |
 | [matrix-sms-bridge](configuring-playbook-bridge-matrix-bridge-sms.md) | [folivonet/matrix-sms-bridge](https://hub.docker.com/repository/docker/folivonet/matrix-sms-bridge) | ❌ | Bridge to SMS |
@@ -119,11 +121,11 @@ Bots provide various additional functionality to your installation.
 | ------- | --------------- | -------- | ----------- |
 | [baibot](configuring-playbook-bot-baibot.md) | [etke.cc/baibot](https://ghcr.io/etkecc/baibot) | ❌ | Bot that exposes the power of [AI](https://en.wikipedia.org/wiki/Artificial_intelligence) / [Large Language Models](https://en.wikipedia.org/wiki/Large_language_model) to you |
 | [matrix-reminder-bot](configuring-playbook-bot-matrix-reminder-bot.md) | [anoa/matrix-reminder-bot](https://hub.docker.com/r/anoa/matrix-reminder-bot) | ❌ | Bot for scheduling one-off & recurring reminders and alarms |
-| [matrix-registration-bot](configuring-playbook-bot-matrix-registration-bot.md) | [moanos/matrix-registration-bot](https://hub.docker.com/r/moanos/matrix-registration-bot/) | ❌ | Bot for invitations by creating and managing registration tokens |
 | [maubot](configuring-playbook-bot-maubot.md) | [dock.mau.dev/maubot/maubot](https://mau.dev/maubot/maubot/container_registry) | ❌ | Plugin-based Matrix bot system |
 | [Honoroit](configuring-playbook-bot-honoroit.md) | [etke.cc/honoroit](https://github.com/etkecc/honoroit/container_registry) | ❌ | Helpdesk bot |
 | [Mjolnir](configuring-playbook-bot-mjolnir.md) | [matrixdotorg/mjolnir](https://hub.docker.com/r/matrixdotorg/mjolnir) | ❌ | Moderation tool for Matrix |
 | [Draupnir](configuring-playbook-bot-draupnir.md) | [gnuxie/draupnir](https://hub.docker.com/r/gnuxie/draupnir) | ❌ | Moderation tool for Matrix (Fork of Mjolnir) |
+| [Meowlnir](configuring-playbook-bot-meowlnir.md) | [maunium/meowlnir](https://mau.dev/maunium/meowlnir/container_registry) | ❌ | Moderation tool for Matrix, running in appservice mode |
 | [Buscarron](configuring-playbook-bot-buscarron.md) | [etke.cc/buscarron](https://ghcr.io/etkecc/buscarron) | ❌ | Web forms (HTTP POST) to Matrix |
 
 ## Administration
@@ -153,10 +155,10 @@ Various services that don't fit any other categories.
 | [synapse_auto_compressor](configuring-playbook-synapse-auto-compressor.md) | [mb-saces/rust-synapse-tools](https://gitlab.com/mb-saces/rust-synapse-tools/container_registry) | ❌ | Cli tool that automatically compresses Synapse's `state_groups` database table in background |
 | [Matrix Corporal](configuring-playbook-matrix-corporal.md) (advanced) | [devture/matrix-corporal](https://hub.docker.com/r/devture/matrix-corporal/) | ❌ | Reconciliator and gateway for a managed Matrix server |
 | [Etherpad](configuring-playbook-etherpad.md) | [etherpad/etherpad](https://hub.docker.com/r/etherpad/etherpad/) | ❌ | Open source collaborative text editor |
-| [Jitsi](configuring-playbook-jitsi.md) | [jitsi/web](https://hub.docker.com/r/jitsi/web) | ❌ | [Jitsi](https://jitsi.org/) web UI |
-| [Jitsi](configuring-playbook-jitsi.md) | [jitsi/jicofo](https://hub.docker.com/r/jitsi/jicofo) | ❌ | [Jitsi](https://jitsi.org/) Focus component |
-| [Jitsi](configuring-playbook-jitsi.md) | [jitsi/prosody](https://hub.docker.com/r/jitsi/prosody) | ❌ | [Jitsi](https://jitsi.org/) Prosody XMPP server component |
-| [Jitsi](configuring-playbook-jitsi.md) | [jitsi/jvb](https://hub.docker.com/r/jitsi/jvb) | ❌ | [Jitsi](https://jitsi.org/) Video Bridge component |
+| [Jitsi](configuring-playbook-jitsi.md) | [jitsi/web](https://github.com/jitsi/docker-jitsi-meet/pkgs/container/web) | ❌ | [Jitsi](https://jitsi.org/) web UI |
+| [Jitsi](configuring-playbook-jitsi.md) | [jitsi/jicofo](https://github.com/jitsi/docker-jitsi-meet/pkgs/container/jicofo) | ❌ | [Jitsi](https://jitsi.org/) Focus component |
+| [Jitsi](configuring-playbook-jitsi.md) | [jitsi/prosody](https://github.com/jitsi/docker-jitsi-meet/pkgs/container/prosody) | ❌ | [Jitsi](https://jitsi.org/) Prosody XMPP server component |
+| [Jitsi](configuring-playbook-jitsi.md) | [jitsi/jvb](https://github.com/jitsi/docker-jitsi-meet/pkgs/container/jvb) | ❌ | [Jitsi](https://jitsi.org/) Video Bridge component |
 | [Cactus Comments](configuring-playbook-cactus-comments.md) | [cactuscomments/cactus-appservice](https://hub.docker.com/r/cactuscomments/cactus-appservice/) | ❌ | Federated comment system built on Matrix |
 | [Cactus Comments](configuring-playbook-cactus-comments.md) | [joseluisq/static-web-server](https://hub.docker.com/r/joseluisq/static-web-server) | ❌ | Federated comment system built on Matrix |
 | [Pantalaimon](configuring-playbook-pantalaimon.md) | [matrixdotorg/pantalaimon](https://hub.docker.com/r/matrixdotorg/pantalaimon) | ❌ | E2EE aware proxy daemon |
@@ -180,6 +182,7 @@ The list of the deprecated or unmaintained services is available [here](configur
 | [matrix-chatgpt-bot](configuring-playbook-bot-chatgpt.md) | [matrixgpt/matrix-chatgpt-bot](https://ghcr.io/matrixgpt/matrix-chatgpt-bot) | ❌ | Accessing ChatGPT via your favourite Matrix client |
 | [matrix-ldap-registration-proxy](configuring-playbook-matrix-ldap-registration-proxy.md) | [activism.international/matrix_ldap_registration_proxy](https://gitlab.com/activism.international/matrix_ldap_registration_proxy/container_registry) | ❌ | Proxy that handles Matrix registration requests and forwards them to LDAP |
 | [matrix-registration](configuring-playbook-matrix-registration.md) | [zeratax/matrix-registration](https://hub.docker.com/r/devture/zeratax-matrix-registration/) | ❌ | Simple python application to have a token based Matrix registration |
+| [matrix-registration-bot](configuring-playbook-bot-matrix-registration-bot.md) | [moanos/matrix-registration-bot](https://hub.docker.com/r/moanos/matrix-registration-bot/) | ❌ | Bot for invitations by creating and managing registration tokens |
 | [mautrix-facebook](configuring-playbook-bridge-mautrix-facebook.md) | [mautrix/facebook](https://mau.dev/mautrix/facebook/container_registry) | ❌ | Bridge to [Facebook](https://facebook.com/) |
 | [mautrix-instagram](configuring-playbook-bridge-mautrix-instagram.md) | [mautrix/instagram](https://mau.dev/mautrix/instagram/container_registry) | ❌ | Bridge to [Instagram](https://instagram.com/) |
 | [mx-puppet-discord](configuring-playbook-bridge-mx-puppet-discord.md) | [mx-puppet/discord/mx-puppet-discord](https://gitlab.com/mx-puppet/discord/mx-puppet-discord/container_registry) | ❌ | Bridge to [Discord](https://discordapp.com/) |

docs/faq.md

@@ -456,6 +456,12 @@ If it is correctly specified, look Traefik's logs (`journalctl -fu matrix-traefi
 
 ## Miscellaneous
 
+### The role to manage the service which I deploy has been removed from the playbook. Does this mean that the service can no longer be used on my server?
+
+Not necessarily. Removing the role from the playbook does not always mean that the service has been deprecated by the upstream developers, so as long as the resource such as the Docker image is available, you should be able to keep running it by reverting the specific commit which has removed the role. This essentially means that you will need to maintain your own version of the playbook.
+
+Please keep in mind that you will occasionally need to fix code conflicts if any.
+
 ### I would like to see this favorite service of mine integrated and become available on my Matrix server. How can I request it?
 
 You can freely create an issue for feature request on the repository at GitHub [here](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/new/choose). Note this is a community project with no financial backing, and there is not assurance that your request would be eventually picked up by others and the requested feature would become available. The easiest way to get a feature into this project is to just develop it yourself.

docs/howto-srv-server-delegation.md

@@ -49,8 +49,8 @@ This is because the Matrix specification expects the federation endpoint to be s
 ```yaml
 # To let Traefik know which domains' certificates to serve
 matrix_synapse_container_labels_additional_labels: |
-  traefik.http.routers.matrix-synapse-federation-api.tls.domains.main="example.com"
-  traefik.http.routers.matrix-synapse-federation-api.tls.domains.sans="*.example.com"
+  traefik.http.routers.matrix-synapse-public-federation-api.tls.domains.main="example.com"
+  traefik.http.routers.matrix-synapse-public-federation-api.tls.domains.sans="*.example.com"
 ```
 
 ### Configure the DNS-01 challenge for let's encrypt
@@ -137,8 +137,8 @@ matrix_synapse_container_labels_public_federation_api_traefik_rule: PathPrefix(`
 
 # To let Traefik know which domains' certificates to serve
 matrix_synapse_container_labels_additional_labels: |
-  traefik.http.routers.matrix-synapse-federation-api.tls.domains.main="example.com"
-  traefik.http.routers.matrix-synapse-federation-api.tls.domains.sans="*.example.com"
+  traefik.http.routers.matrix-synapse-public-federation-api.tls.domains.main="example.com"
+  traefik.http.routers.matrix-synapse-public-federation-api.tls.domains.sans="*.example.com"
 
 # Add a new ACME configuration without having to disable the default one, since it would have a wide range of side effects
 traefik_configuration_extension_yaml: |

docs/importing-postgres.md

@@ -25,6 +25,11 @@ The migration might be a good moment, to "reset" a not properly working bridge.
 
 Before doing the actual import, **you need to upload your Postgres dump file to the server** (any path is okay).
 
+> [!WARNING]
+> Do not import into a database that already contains tables (e.g. one that a service has already initialized and used). As the [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) puts it: at best this will error, at worst it will lead to subtle database inconsistencies. Import into an empty (freshly created) database instead.
+
+**Note for Synapse users restoring an older backup**: if the server kept running (and users kept chatting) after the backup you are restoring was made, truncate the `e2e_one_time_keys_json` table after importing and before starting Synapse. Restoring an older backup can otherwise cause already-used one-time keys to be re-issued, leading to message decryption errors for your users. You can do this by [getting a database terminal](maintenance-postgres.md#getting-a-database-terminal), connecting to the Synapse database (`\c synapse`) and running `TRUNCATE e2e_one_time_keys_json;`. Clients will generate and upload fresh one-time keys automatically.
+
 ## Importing
 
 To import, run this command (make sure to replace `SERVER_PATH_TO_POSTGRES_DUMP_FILE` with a file path on your server):

docs/importing-synapse-media-store.md

@@ -13,6 +13,8 @@ You can manually import your `media_store` files from a previous installation of
 
 Before doing the actual data restore, **you need to upload your media store directory to the server** (any path is okay).
 
+You also need the [rsync](https://rsync.samba.org/) utility installed **on the server**, as the import performs a server-side `rsync` synchronization. The playbook does not install it for you. On most distributions, it is available as a package called `rsync`.
+
 If you are [storing Matrix media files on Amazon S3](configuring-playbook-s3.md) (optional), restoring with this tool is not possible right now.
 
 As an alternative, you can perform a manual restore using the [AWS CLI tool](https://aws.amazon.com/cli/) (e.g. `aws s3 sync /path/to/server/media_store/. s3://name-of-bucket/`)

docs/installing.md

@@ -1,13 +1,13 @@
 <!--
+SPDX-FileCopyrightText: 2018 Aaron Raimist
 SPDX-FileCopyrightText: 2018-2023 Slavi Pantaleev
 SPDX-FileCopyrightText: 2018-2024 MDAD project contributors
-SPDX-FileCopyrightText: 2018 Aaron Raimist
 SPDX-FileCopyrightText: 2019 Edgars Voroboks
 SPDX-FileCopyrightText: 2019 Michael Haak
 SPDX-FileCopyrightText: 2020 Kevin Lanni
-SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
 SPDX-FileCopyrightText: 2024 Mitja Jež
 SPDX-FileCopyrightText: 2024 Nikita Chernyi
+SPDX-FileCopyrightText: 2024-2026 Suguru Hirahara
 
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
@@ -41,6 +41,8 @@ If you **don't** use SSH keys for authentication, but rather a regular password,
 
 If you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to all Ansible commands.
 
+Instead of typing the sudo password on each run (`-K`) or storing it in plain text in the inventory hosts file, you can also pull it from the [pass](https://www.passwordstore.org/) password manager by adding `ansible_become_password='{{ lookup("community.general.passwordstore", "path/to/password") }}'` to your host line. See the [passwordstore lookup documentation](https://docs.ansible.com/ansible/latest/collections/community/general/passwordstore_lookup.html) for more details.
+
 There 2 ways to start the installation process — depending on whether you're [Installing a brand new server (without importing data)](#installing-a-brand-new-server-without-importing-data) or [Installing a server into which you'll import old data](#installing-a-server-into-which-youll-import-old-data).
 
 **Note**: if you are migrating from an old server to a new one, take a look at [this guide](maintenance-migrating.md) instead. This is an easier and more straightforward way than installing a server and importing old data into it.
@@ -150,6 +152,12 @@ After completing the installation, you can:
   * or come say Hi in our support room — [#matrix-docker-ansible-deploy:devture.com](https://matrix.to/#/#matrix-docker-ansible-deploy:devture.com). You might learn something or get to help someone else new to Matrix hosting.
 - or help make this playbook better by contributing (code, documentation, or [coffee/beer](https://liberapay.com/s.pantaleev/donate))
 
+### Installing native Matrix clients on your computer
+
+As the playbook's aim is to help you to install and manage Matrix services on your server, if you are looking for dedicated native Matrix clients which run on your computer, you need to install ones by yourself. There is a convenient list which introduces known Matrix clients on this page: <https://matrix.org/ecosystem/clients/>
+
+If you feel overwhelmed by the variety and the number of the available clients, you might want to install [**Komai**](https://github.com/etkecc/komai), a desktop-first Matrix chat application maintained by the team behind the playbook. It is stable, and just works without quirks!
+
 ### ⚠️ Keep the playbook and services up-to-date
 
 While this playbook helps you to set up Matrix services and maintain them, it will **not** automatically run the maintenance task for you. You will need to update the playbook and re-run it **manually**.

docs/maintenance-migrating.md

@@ -37,7 +37,7 @@ cd /etc/systemd/system/ && systemctl disable --now matrix*
 
 ## Copy data directory to the new server
 
-After you've confirmed that all services were stopped, copy the `/matrix` directory from the old server to the new server. When copying, make sure to preserve ownership and permissions (use `cp -p` or `rsync -ar`)!
+After you've confirmed that all services were stopped, copy the `/matrix` directory from the old server to the new server. When copying, make sure to preserve ownership and permissions (use `cp -p` or `rsync -a`)!
 
 ## Adjust DNS records
 

docs/maintenance-postgres.md

@@ -76,6 +76,8 @@ If you are using an [external Postgres server](configuring-playbook-external-pos
 
 Restoring a backup made this way can be done by [importing it](importing-postgres.md).
 
+**Note for Synapse users**: the [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) recommends that the `e2e_one_time_keys_json` table either not be backed up, or be truncated after restoring (before Synapse is started). The full-server dump command above does include it, so if you ever restore a backup that is older than the server's current state, remember to truncate that table as described in [the importing guide](importing-postgres.md).
+
 ## Upgrading PostgreSQL
 
 Unless you are using an [external Postgres server](configuring-playbook-external-postgres.md), this playbook initially installs Postgres for you.

docs/maintenance-synapse.md

@@ -105,6 +105,9 @@ Cache autotuning is **enabled by default** and controlled via the following vari
 
 You can **learn more about cache-autotuning and the global cache factor settings** in the [Synapse's documentation on caches and associated values](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#caches-and-associated-values).
 
+> [!NOTE]
+> These limits apply **per Synapse process**. If you have [workers](configuring-playbook-synapse.md#load-balancing-with-workers) enabled, the main process and every worker each apply the configured limits independently, so the theoretical aggregate cache memory usage gets multiplied by the number of processes. When running many workers on a memory-constrained server, consider setting these variables to lower, explicitly chosen values.
+
 To **disable cache auto-tuning**, unset all values:
 
 ```yaml

docs/quick-start.md

@@ -89,7 +89,23 @@ To install Matrix services with this playbook, you would at least need 2 configu
 
 For your convenience, we have prepared example files of them ([`vars.yml`](../examples/vars.yml) and [`hosts`](../examples/hosts)).
 
-To start quickly based on these example files, go into the `matrix-docker-ansible-deploy` directory and follow the instructions below:
+To start quickly based on these example files, go into the `matrix-docker-ansible-deploy` directory and initialize your configuration, either automatically or manually.
+
+To initialize it automatically (with the base domain and server address pre-filled and secrets generated for you), run:
+
+- either: `just add-inventory-host example.com 1.2.3.4` (if you have the [`just`](just.md) tool)
+- or: `make add-inventory-host domain=example.com ip=1.2.3.4` (if you have the `make` program)
+
+… where `example.com` is your "base domain" (not `matrix.example.com`) and `1.2.3.4` is your server's external IP address (or domain name).
+
+Given a base domain of `example.com`, this creates:
+
+- an entry for `matrix.example.com` (the Matrix server's default hostname: `matrix.` + your base domain) in the inventory hosts file (`inventory/hosts`)
+- a configuration file (`inventory/host_vars/matrix.example.com/vars.yml`) containing `matrix_domain: example.com` and automatically generated secrets
+
+Afterward, edit these 2 files to adjust them further, as necessary. Existing configuration is never overwritten (the command refuses to run if the host is already in your inventory), so it can also be used for adding more hosts later.
+
+To initialize it manually, follow the instructions below:
 
 1. Create a directory to hold your configuration: `mkdir -p inventory/host_vars/matrix.example.com` where `example.com` is your "base domain"
 2. Copy the sample configuration file: `cp examples/vars.yml inventory/host_vars/matrix.example.com/vars.yml`

docs/self-building.md

@@ -37,10 +37,13 @@ Possibly outdated list of roles where self-building the Docker image is currentl
 - `matrix-bridge-hookshot`
 - `matrix-bridge-appservice-irc`
 - `matrix-bridge-beeper-linkedin`
+- `matrix-bridge-beeper-line`
 - `matrix-bridge-mautrix-googlechat`
 - `matrix-bridge-mautrix-telegram`
 - `matrix-bridge-mautrix-signal`
 - `matrix-bridge-mautrix-gmessages`
+- `matrix-bridge-mautrix-gvoice`
+- `matrix-bridge-mautrix-linkedin`
 - `matrix-bridge-mautrix-whatsapp`
 - `matrix-bridge-mx-puppet-steam`
 - `matrix-bot-mjolnir`

docs/style-guide.md

@@ -0,0 +1,105 @@
+<!--
+SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+SPDX-FileCopyrightText: 2026 Suguru Hirahara
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Style guide for playbook developers
+
+This page describes the conventions used when developing this playbook and writing its documentation. Follow it when adding a new component (a role and its documentation page) or editing existing ones, so that everything stays consistent.
+
+The guide is meant for anyone preparing a contribution, humans and AI agents alike. If you find existing files that deviate from it, feel free to send a pull request bringing them in line.
+
+## Language
+
+- Write in English, using American spelling ("customize", not "customise").
+- Proper nouns are capitalized: Matrix, Element, Synapse, Ansible, Docker, Traefik, Postgres, Grafana, etc. Some projects deliberately brand themselves in lowercase (e.g. `baibot`, `rageshake`, `coturn`, `mautrix-telegram`) and keep their lowercase name even at the start of a sentence. When in doubt, follow the upstream project's own spelling.
+
+## Markdown style
+
+- Do not hard-wrap prose. Each paragraph is a single line in the source file, no matter how long. This keeps the source and the rendered result consistent and makes diffs and translations easier to work with.
+- Number ordered lists sequentially (`1.`, `2.`, `3.`), instead of relying on the Markdown renderer to fix a repeated (`1.`, `1.`, `1.`) or wrong (`1.`, `2.`, `4.`) sequence.
+- Use `-` for unordered lists.
+- Wrap variable names, file paths, commands, domains, and service names in backticks (`` ` ``).
+- Use fenced code blocks with a language hint (```` ```yaml ````, ```` ```sh ````) for configuration and command examples.
+- Use relative links when linking between documentation pages (e.g. `[Configuring DNS](configuring-dns.md)`).
+- Link to the upstream project's official documentation instead of duplicating its content (installation steps, distro-specific commands, etc.). Copied instructions go stale; links age much better.
+
+## Example values
+
+Use these placeholder values in documentation and code comments, so examples look the same everywhere:
+
+| What | Value |
+|------|-------|
+| base domain | `example.com` |
+| Matrix server domain | `matrix.example.com` |
+| another (federated) server | `example.org` |
+| user IDs | `@alice:example.com`, `@bob:example.com` |
+| room ID | `!qporfwt:example.com` |
+| room alias | `#room:example.com` |
+
+The user and room ID values follow the examples in the [Matrix specification](https://spec.matrix.org/latest/#room-structure). Never use real domains, usernames, or tokens in examples.
+
+Component-specific identifiers (e.g. a bridge bot like `@telegrambot:example.com`) are fine where they make an example clearer.
+
+## Documentation page structure
+
+Each component gets its own documentation page: `docs/configuring-playbook-<component>.md` (bridges use a `configuring-playbook-bridge-<name>.md` file name, bots use `configuring-playbook-bot-<name>.md`).
+
+A typical page looks like this, with sections appearing in this order (sections that do not apply can be omitted):
+
+```md
+# Setting up ComponentName (optional)
+
+The playbook can install and configure [ComponentName](https://github.com/example/component) for you.
+
+See the project's [documentation](https://github.com/example/component/blob/main/README.md) to learn what it does and why it might be useful to you.
+
+## Prerequisites (optional)
+
+## Adjusting DNS records
+
+## Adjusting the playbook configuration
+
+### Extending the configuration
+
+## Installing
+
+## Usage
+
+## Troubleshooting
+```
+
+Notes:
+
+- Headings use sentence case ("Adjusting the playbook configuration", not "Adjusting The Playbook Configuration").
+- The "Adjusting the playbook configuration" section tells people to add configuration to their `inventory/host_vars/matrix.example.com/vars.yml` file and shows a minimal `yaml` example.
+- The "Installing" section references [playbook tags](playbook-tags.md) and shows the `just` command or `ansible-playbook` invocation to run.
+- Look at an existing page for a similar component (another bridge, bot, or service) and copy its structure. The mautrix bridge pages share common sections via [Setting up a Generic Mautrix Bridge](configuring-playbook-bridge-mautrix-bridges.md), so bridge pages link there instead of repeating the shared content.
+
+## Adding a new component
+
+First, consider where the component belongs:
+
+- Matrix-specific components are developed as roles in this repository, under `roles/custom/`.
+- Components that are not Matrix-specific should live as external roles, preferably in the [MASH organization](https://github.com/mother-of-all-self-hosting/), and get wired into the playbook via `requirements.yml`.
+- For components that are not Matrix-specific, also consider whether they belong in this Matrix playbook at all, or rather in [mash-playbook](https://github.com/mother-of-all-self-hosting/mash-playbook). Certain components (like Grafana or backup tools) are suitable for both playbooks. If something is too far away from general usefulness on a Matrix server, we prefer not to include it here, and to only have it in mash-playbook.
+
+Besides the role itself and its documentation page, a new component touches a few other places. Make sure a pull request adding one covers all of them:
+
+1. The role, in `roles/custom/matrix-<component>/` (or an external role wired via `requirements.yml`, as described above).
+2. Role registration in `setup.yml`.
+3. Wiring in `group_vars/matrix_servers`. Wire the component to the rest of the playbook there (referencing variables of other roles), but keep values that the role can construct by itself in the role's own `defaults/main.yml`.
+4. The documentation page, `docs/configuring-playbook-<component>.md`, linked from the table of contents in `docs/README.md`.
+5. An entry in the supported services list in `README.md`.
+6. A row in `docs/container-images.md`, if the component runs a container.
+7. A `CHANGELOG.md` entry announcing the new component.
+8. License headers: every new file carries `SPDX-FileCopyrightText` and `SPDX-License-Identifier` comments, as this project follows the [REUSE](https://reuse.software/) specification.
+
+Variable naming conventions:
+
+- The variable prefix matches the role directory name: the `matrix-bridge-mautrix-telegram` role uses `matrix_bridge_mautrix_telegram_*` variables, the `matrix-bot-mjolnir` role uses `matrix_bot_mjolnir_*` variables, and so on.
+- List-type variables that the playbook may extend automatically follow the `_auto` + `_custom` split: the main variable combines an `_auto` component (managed by the playbook via `group_vars`) and a `_custom` component (reserved for users). Where it makes sense, there is also a `_default` component, containing sensible defaults provided by the role itself. See `matrix_bridge_hookshot_container_additional_networks` and `matrix_bridge_hookshot_systemd_required_services_list` for examples.
+- When a variable is renamed or removed, deprecate it so that people with stale configuration get told about it instead of it being silently ignored. Each role deprecates its own variables, in its `validate_config.yml` tasks. The `matrix_playbook_migration` role handles the cases a role cannot: variables of completely eliminated roles (which no longer have their own `validate_config.yml`), and validation that needs to run very early for some reason.
+- For breaking changes that require the user's attention (beyond a renamed variable that validation already catches), bump `matrix_playbook_migration_expected_version` and add a matching entry to the `matrix_playbook_migration_breaking_changes` list (a summary and a `CHANGELOG.md` link), in `roles/custom/matrix_playbook_migration/defaults/main.yml`. Users declare `matrix_playbook_migration_validated_version` in their configuration, and the playbook walks them through all breaking changes between their validated version and the expected one. Also update the recommended value in `examples/vars.yml`; a pre-commit check enforces that it matches the expected version.

examples/reverse-proxies/nginx-proxy-manager/README.md

@@ -1,7 +1,7 @@
 <!--
 SPDX-FileCopyrightText: 2024 Gouthaman Raveendran
 SPDX-FileCopyrightText: 2024 MDAD project contributors
-SPDX-FileCopyrightText: 2024 Slavi Pantaleev
+SPDX-FileCopyrightText: 2024 - 2026 Slavi Pantaleev
 SPDX-FileCopyrightText: 2024 Suguru Hirahara
 
 SPDX-License-Identifier: AGPL-3.0-or-later
@@ -60,3 +60,27 @@ SSL Certificate: matrix.example.com or *.example.com
 ```
 
 Also note, NPM would need to be configured for whatever other services you are using. For example, you would need to create additional proxy hosts for `element.example.com` or `jitsi.example.com`, which would use the forwarding port `81`.
+
+## Serving the base domain (optional)
+
+The configuration above only covers `matrix.example.com`. Many people serve their base domain (`example.com`) from somewhere else entirely, in which case there is nothing more to do here. Arrange [server delegation](../../../docs/howto-server-delegation.md) on whichever server hosts the base domain instead.
+
+If you have made this Matrix server responsible for the base domain as well (by [serving the base domain](../../../docs/configuring-playbook-base-domain-serving.md) with `matrix_static_files_container_labels_base_domain_enabled: true`), then the base domain needs a proxy host of its own. Without it, requests for `https://example.com/.well-known/matrix/server` and `https://example.com/.well-known/matrix/client` never reach Traefik, NPM answers with a `404` error of its own, and both [Federation Server Discovery](../../../docs/configuring-well-known.md#federation-server-discovery) and [Client-Server discovery](../../../docs/configuring-well-known.md#client-server-discovery) break.
+
+Add another proxy host, this time for the base domain:
+
+```md
+# Details
+# Base domain proxy config
+Domain Names: example.com
+Scheme: http
+Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX
+Forward Port: 81
+
+# SSL
+# Note that a `*.example.com` wildcard certificate does not cover the base domain itself,
+# so the certificate you use here needs to include `example.com`
+SSL Certificate: example.com
+Force SSL: true
+HTTP/2 Support: true
+```

flake.lock

@@ -1,15 +1,31 @@
 {
   "nodes": {
+    "agru-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1786883889,
+        "narHash": "sha256-+hcrs34fov1dv6gAXvSr6jkv0ejbCLE9bGWTY7reu1s=",
+        "owner": "etkecc",
+        "repo": "agru",
+        "rev": "4b8fb5efc0b642a3735e507a699c69eeaf783640",
+        "type": "github"
+      },
+      "original": {
+        "owner": "etkecc",
+        "repo": "agru",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -20,21 +36,23 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1712578459,
-        "narHash": "sha256-r+rjtYIdwV7mEqFwbvaS7dZSH+3xNW9loR3Rh9C0ifI=",
+        "lastModified": 1786719841,
+        "narHash": "sha256-QcpQOT0NQEFkI77t+YXPZqDJc35iIodG7zinieOwFUg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b1a486be09c354e25a18689eb21425e43892e38c",
+        "rev": "8be7bd0c83f12e2e3bbba07c9044d6fed9e66f7f",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
+        "agru-src": "agru-src",
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       }

flake.nix

@@ -1,26 +1,40 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     flake-utils.url = "github:numtide/flake-utils";
+    agru-src = {
+      url = "github:etkecc/agru";
+      flake = false;
     };
-  outputs = {
+  };
+  outputs =
+    {
       self,
       nixpkgs,
       flake-utils,
+      agru-src,
     }:
-    flake-utils.lib.eachDefaultSystem
-    (
-      system: let
+    flake-utils.lib.eachDefaultSystem (
+      system:
+      let
         pkgs = import nixpkgs {
           inherit system;
         };
+        agru = pkgs.buildGo125Module {
+          pname = "agru";
+          version = "0.2.1";
+          src = agru-src;
+          vendorHash = null;
+        };
       in
-        with pkgs; {
+      with pkgs;
+      {
         devShells.default = mkShell {
           buildInputs = [
             just
             mise
             ansible
+            agru
           ];
           shellHook = ''
             echo "$(ansible --version)"

i18n/requirements.txt

@@ -1,10 +1,10 @@
 alabaster==1.0.0
 babel==2.18.0
-certifi==2026.6.17
-charset-normalizer==3.4.7
+certifi==2026.7.22
+charset-normalizer==3.5.1
 click==8.4.2
-docutils==0.23
-idna==3.18
+docutils==0.22.4
+idna==3.19
 imagesize==2.0.0
 Jinja2==3.1.6
 linkify-it-py==2.1.0
@@ -13,15 +13,15 @@ MarkupSafe==3.0.3
 mdit-py-plugins==0.6.1
 mdurl==0.1.2
 myst-parser==5.1.0
-packaging==26.2
-Pygments==2.20.0
+packaging==26.3
+Pygments==2.21.0
 PyYAML==6.0.3
 requests==2.34.2
-setuptools==82.0.1
+setuptools==84.0.0
 snowballstemmer==3.1.1
 Sphinx==9.1.0
 sphinx-intl==2.3.2
-sphinx-markdown-builder==0.6.10
+sphinx-markdown-builder==0.6.11
 sphinxcontrib-applehelp==2.0.0
 sphinxcontrib-devhelp==2.0.0
 sphinxcontrib-htmlhelp==2.1.0

i18n/translation-templates/AGENTS.pot

@@ -0,0 +1,109 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) 2018-2026, Slavi Pantaleev, Aine Etke, MDAD community members
+# This file is distributed under the same license as the matrix-docker-ansible-deploy package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: matrix-docker-ansible-deploy \n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2026-07-18 04:11+0000\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: ../../../AGENTS.md:7
+msgid "Guidance for AI agents"
+msgstr ""
+
+#: ../../../AGENTS.md:9
+msgid "This file gives AI coding agents the minimum context for working on this repository. Human contributors may find it a useful summary too."
+msgstr ""
+
+#: ../../../AGENTS.md:11
+msgid "What this is"
+msgstr ""
+
+#: ../../../AGENTS.md:13
+msgid "An Ansible playbook that installs and manages a Matrix homeserver and dozens of related services, each running as a Docker container wrapped in a systemd service."
+msgstr ""
+
+#: ../../../AGENTS.md:15
+msgid "Layout"
+msgstr ""
+
+#: ../../../AGENTS.md:17
+msgid "`setup.yml`: the main playbook, listing all roles."
+msgstr ""
+
+#: ../../../AGENTS.md:18
+msgid "`roles/custom/`: roles maintained in this repository."
+msgstr ""
+
+#: ../../../AGENTS.md:19
+msgid "`roles/galaxy/`: external roles, downloaded according to `requirements.yml` via [agru](https://github.com/etkecc/agru) (preferred) or `ansible-galaxy`. Run `just roles` to install them (or `just update` to also pull the playbook itself). Editing these roles locally is fine while preparing or testing a fix, but the changes get wiped on the next roles update, so they must be synced back to the role's upstream repository, followed by a version pin update in `requirements.yml`."
+msgstr ""
+
+#: ../../../AGENTS.md:20
+msgid "`group_vars/matrix_servers`: wires roles together (feeding one role's variables into another). Values a role can construct by itself belong in the role's `defaults/main.yml`, not here."
+msgstr ""
+
+#: ../../../AGENTS.md:21
+msgid "`docs/`: user-facing documentation, one page per component."
+msgstr ""
+
+#: ../../../AGENTS.md:22
+msgid "`i18n/`: translation infrastructure. Do not edit locale files by hand; they are managed by automation."
+msgstr ""
+
+#: ../../../AGENTS.md:23
+msgid "`CHANGELOG.md`: user-facing announcements, newest first."
+msgstr ""
+
+#: ../../../AGENTS.md:25
+msgid "Conventions"
+msgstr ""
+
+#: ../../../AGENTS.md:27
+msgid "Follow the [style guide for playbook developers](docs/style-guide.md). In particular:"
+msgstr ""
+
+#: ../../../AGENTS.md:29
+msgid "Variable prefixes match the role directory name."
+msgstr ""
+
+#: ../../../AGENTS.md:30
+msgid "Playbook-extensible list variables use the `_auto` + `_custom` split; `_custom` is reserved for users."
+msgstr ""
+
+#: ../../../AGENTS.md:31
+msgid "Renamed or removed variables get a validation entry, so stale user configuration produces an error instead of being silently ignored. Each role deprecates its own variables in its `validate_config.yml`; the `matrix_playbook_migration` role covers eliminated roles and very-early validation, and also gates breaking changes via `matrix_playbook_migration_expected_version` (see the style guide)."
+msgstr ""
+
+#: ../../../AGENTS.md:32
+msgid "Every file carries SPDX license headers ([REUSE](https://reuse.software/) specification)."
+msgstr ""
+
+#: ../../../AGENTS.md:33
+msgid "New components must be registered in `setup.yml`, `group_vars/matrix_servers`, `docs/README.md`, `README.md`, `docs/container-images.md`, and get a `CHANGELOG.md` entry."
+msgstr ""
+
+#: ../../../AGENTS.md:35
+msgid "Other notes"
+msgstr ""
+
+#: ../../../AGENTS.md:37
+msgid "Documentation examples use `example.com`, `@alice:example.com`, and the other placeholder values listed in the style guide."
+msgstr ""
+
+#: ../../../AGENTS.md:38
+msgid "Write role tasks concurrency-safe: use `ansible.builtin.tempfile` for temporary files (removed in an `always` block), never fixed shared paths."
+msgstr ""
+
+#: ../../../AGENTS.md:39
+msgid "One logical change per commit."
+msgstr ""

i18n/translation-templates/README.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-08-13 05:03+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -288,11 +288,23 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-client-fluffychat-web.md)"
 msgstr ""
 
-#: ../../../README.md:72
+#: ../../../README.md:0
+msgid "[Commet](https://github.com/commetchat/commet)"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "Matrix web client"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "[Link](docs/configuring-playbook-client-commet.md)"
+msgstr ""
+
+#: ../../../README.md:73
 msgid "Server Components"
 msgstr ""
 
-#: ../../../README.md:74
+#: ../../../README.md:75
 msgid "Services that run on the server to make the various parts of your installation work."
 msgstr ""
 
@@ -380,11 +392,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-matrix-rtc.md)"
 msgstr ""
 
-#: ../../../README.md:86
+#: ../../../README.md:87
 msgid "Authentication"
 msgstr ""
 
-#: ../../../README.md:88
+#: ../../../README.md:89
 msgid "Extend and modify how users are authenticated on your homeserver."
 msgstr ""
 
@@ -424,18 +436,6 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-ldap-auth.md)"
 msgstr ""
 
-#: ../../../README.md:0
-msgid "[matrix-ldap-registration-proxy](https://gitlab.com/activism.international/matrix_ldap_registration_proxy) (advanced)"
-msgstr ""
-
-#: ../../../README.md:0
-msgid "Proxy that handles Matrix registration requests and forwards them to LDAP"
-msgstr ""
-
-#: ../../../README.md:0
-msgid "[Link](docs/configuring-playbook-matrix-ldap-registration-proxy.md)"
-msgstr ""
-
 #: ../../../README.md:0
 msgid "[Matrix User Verification Service](https://github.com/matrix-org/matrix-user-verification-service)"
 msgstr ""
@@ -556,6 +556,30 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-bridge-mautrix-gmessages.md)"
 msgstr ""
 
+#: ../../../README.md:0
+msgid "[mautrix-gvoice](https://github.com/mautrix/gvoice)"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "Bridge to [Google Voice](https://voice.google.com/)"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "[Link](docs/configuring-playbook-bridge-mautrix-gvoice.md)"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "[mautrix-linkedin](https://github.com/mautrix/linkedin)"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "Bridge to [LinkedIn](https://www.linkedin.com/)"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "[Link](docs/configuring-playbook-bridge-mautrix-linkedin.md)"
+msgstr ""
+
 #: ../../../README.md:0
 msgid "[mautrix-whatsapp](https://github.com/mautrix/whatsapp)"
 msgstr ""
@@ -580,6 +604,18 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-bridge-mautrix-wsproxy.md)"
 msgstr ""
 
+#: ../../../README.md:0
+msgid "[matrix-rustpush-bridge](https://github.com/jasonlaguidice/imessage)"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "Bridge to [iMessage](https://support.apple.com/messages) via Apple Push Notification service"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "[Link](docs/configuring-playbook-bridge-rustpush.md)"
+msgstr ""
+
 #: ../../../README.md:0
 msgid "[mautrix-bluesky](https://github.com/mautrix/bluesky)"
 msgstr ""
@@ -641,15 +677,15 @@ msgid "[Link](docs/configuring-playbook-bridge-mautrix-signal.md)"
 msgstr ""
 
 #: ../../../README.md:0
-msgid "[beeper-linkedin](https://github.com/beeper/linkedin)"
+msgid "[beeper-line](https://github.com/beeper/line)"
 msgstr ""
 
 #: ../../../README.md:0
-msgid "Bridge to [LinkedIn](https://www.linkedin.com/)"
+msgid "Bridge to [LINE](https://line.me/)"
 msgstr ""
 
 #: ../../../README.md:0
-msgid "[Link](docs/configuring-playbook-bridge-beeper-linkedin.md)"
+msgid "[Link](docs/configuring-playbook-bridge-beeper-line.md)"
 msgstr ""
 
 #: ../../../README.md:0
@@ -664,18 +700,6 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-bridge-appservice-irc.md)"
 msgstr ""
 
-#: ../../../README.md:0
-msgid "[matrix-appservice-kakaotalk](https://src.miscworks.net/fair/matrix-appservice-kakaotalk)"
-msgstr ""
-
-#: ../../../README.md:0
-msgid "Bridge to [Kakaotalk](https://www.kakaocorp.com/page/service/service/KakaoTalk?lang=ENG)"
-msgstr ""
-
-#: ../../../README.md:0
-msgid "[Link](docs/configuring-playbook-bridge-appservice-kakaotalk.md)"
-msgstr ""
-
 #: ../../../README.md:0
 msgid "[matrix-appservice-discord](https://github.com/matrix-org/matrix-appservice-discord)"
 msgstr ""
@@ -796,11 +820,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-bridge-postmoogle.md)"
 msgstr ""
 
-#: ../../../README.md:140
+#: ../../../README.md:142
 msgid "Bots"
 msgstr ""
 
-#: ../../../README.md:142
+#: ../../../README.md:144
 msgid "Bots provide various additional functionality to your installation."
 msgstr ""
 
@@ -828,18 +852,6 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-bot-matrix-reminder-bot.md)"
 msgstr ""
 
-#: ../../../README.md:0
-msgid "[matrix-registration-bot](https://github.com/moan0s/matrix-registration-bot)"
-msgstr ""
-
-#: ../../../README.md:0
-msgid "Bot for invitations by creating and managing registration tokens"
-msgstr ""
-
-#: ../../../README.md:0
-msgid "[Link](docs/configuring-playbook-bot-matrix-registration-bot.md)"
-msgstr ""
-
 #: ../../../README.md:0
 msgid "[maubot](https://github.com/maubot/maubot)"
 msgstr ""
@@ -888,6 +900,18 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-bot-draupnir.md) (for [appservice mode](docs/configuring-playbook-appservice-draupnir-for-all.md))"
 msgstr ""
 
+#: ../../../README.md:0
+msgid "[Meowlnir](https://github.com/maunium/meowlnir)"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "Moderation tool for Matrix, running in appservice mode"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "[Link](docs/configuring-playbook-bot-meowlnir.md)"
+msgstr ""
+
 #: ../../../README.md:0
 msgid "[Buscarron](https://github.com/etkecc/buscarron)"
 msgstr ""
@@ -900,11 +924,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-bot-buscarron.md)"
 msgstr ""
 
-#: ../../../README.md:155
+#: ../../../README.md:157
 msgid "Administration"
 msgstr ""
 
-#: ../../../README.md:157
+#: ../../../README.md:159
 msgid "Services that help you in administrating and monitoring your Matrix installation."
 msgstr ""
 
@@ -992,11 +1016,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-synapse-usage-exporter.md)"
 msgstr ""
 
-#: ../../../README.md:169
+#: ../../../README.md:171
 msgid "Misc"
 msgstr ""
 
-#: ../../../README.md:171
+#: ../../../README.md:173
 msgid "Various services that don't fit any other categories."
 msgstr ""
 
@@ -1120,54 +1144,54 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-element-call.md)"
 msgstr ""
 
-#: ../../../README.md:186
+#: ../../../README.md:188
 msgid "🆕 Changes"
 msgstr ""
 
-#: ../../../README.md:188
+#: ../../../README.md:190
 msgid "This playbook evolves over time, sometimes with backward-incompatible changes."
 msgstr ""
 
-#: ../../../README.md:190
+#: ../../../README.md:192
 msgid "When updating the playbook, refer to [the changelog](CHANGELOG.md) to catch up with what's new."
 msgstr ""
 
-#: ../../../README.md:192
+#: ../../../README.md:194
 msgid "🆘 Support"
 msgstr ""
 
-#: ../../../README.md:194
+#: ../../../README.md:196
 msgid "Matrix room: [#matrix-docker-ansible-deploy:devture.com](https://matrix.to/#/#matrix-docker-ansible-deploy:devture.com)"
 msgstr ""
 
-#: ../../../README.md:196
+#: ../../../README.md:198
 msgid "IRC channel: `#matrix-docker-ansible-deploy` on the [Libera Chat](https://libera.chat/) IRC network (irc.libera.chat:6697)"
 msgstr ""
 
-#: ../../../README.md:198
+#: ../../../README.md:200
 msgid "GitHub issues: [spantaleev/matrix-docker-ansible-deploy/issues](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues)"
 msgstr ""
 
-#: ../../../README.md:200
+#: ../../../README.md:202
 msgid "🌐 Translation"
 msgstr ""
 
-#: ../../../README.md:202
+#: ../../../README.md:204
 msgid "See the [i18n/README.md](i18n/README.md) file for more information about translation."
 msgstr ""
 
-#: ../../../README.md:204
+#: ../../../README.md:206
 msgid "Translations are still work in progress."
 msgstr ""
 
-#: ../../../README.md:206
+#: ../../../README.md:208
 msgid "🤝 Related"
 msgstr ""
 
-#: ../../../README.md:208
+#: ../../../README.md:210
 msgid "You may also be interested in [mash-playbook](https://github.com/mother-of-all-self-hosting/mash-playbook) - another Ansible playbook for self-hosting non-Matrix services (see its [List of supported services](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/supported-services.md))."
 msgstr ""
 
-#: ../../../README.md:210
+#: ../../../README.md:212
 msgid "mash-playbook also makes use of [Traefik](./docs/configuring-playbook-traefik.md) as its reverse-proxy, so with minor [interoperability adjustments](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/interoperability.md), you can make matrix-docker-ansible-deploy and mash-playbook co-exist and host Matrix and non-Matrix services on the same server."
 msgstr ""

i18n/translation-templates/docs/README.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-18 04:11+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -133,37 +133,45 @@ msgid "[Alternative architectures](alternative-architectures.md)"
 msgstr ""
 
 #: ../../../docs/README.md:79
-msgid "[Container images used by the playbook](container-images.md)"
+msgid "[Configuring Synology DSM](configuring-playbook-synology.md)"
 msgstr ""
 
 #: ../../../docs/README.md:81
-msgid "[Obtaining an Access Token](obtaining-access-tokens.md)"
+msgid "[Container images used by the playbook](container-images.md)"
 msgstr ""
 
 #: ../../../docs/README.md:83
-msgid "[Playbook tags](playbook-tags.md)"
+msgid "[Obtaining an Access Token](obtaining-access-tokens.md)"
 msgstr ""
 
 #: ../../../docs/README.md:85
-msgid "[Registering users](registering-users.md)"
+msgid "[Playbook tags](playbook-tags.md)"
 msgstr ""
 
 #: ../../../docs/README.md:87
-msgid "[Running `just` commands](just.md)"
+msgid "[Registering users](registering-users.md)"
 msgstr ""
 
 #: ../../../docs/README.md:89
-msgid "[Self-building](self-building.md)"
+msgid "[Running `just` commands](just.md)"
 msgstr ""
 
 #: ../../../docs/README.md:91
-msgid "[Uninstalling](uninstalling.md)"
+msgid "[Self-building](self-building.md)"
 msgstr ""
 
 #: ../../../docs/README.md:93
-msgid "[Updating users passwords](updating-users-passwords.md)"
+msgid "[Style guide for playbook developers](style-guide.md)"
 msgstr ""
 
 #: ../../../docs/README.md:95
+msgid "[Uninstalling](uninstalling.md)"
+msgstr ""
+
+#: ../../../docs/README.md:97
+msgid "[Updating users passwords](updating-users-passwords.md)"
+msgstr ""
+
+#: ../../../docs/README.md:99
 msgid "[Using Ansible for the playbook](ansible.md)"
 msgstr ""

i18n/translation-templates/docs/ansible.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-08-22 05:21+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -77,116 +77,144 @@ msgid "**Note**: Both of the above methods are a bad way to run system software
 msgstr ""
 
 #: ../../../docs/ansible.md:42
-msgid "Using Ansible via Docker"
+msgid "SSH host key and passphrase prompts"
 msgstr ""
 
 #: ../../../docs/ansible.md:44
-msgid "Alternatively, you can run Ansible inside a Docker container (powered by the [ghcr.io/devture/ansible](https://github.com/devture/docker-ansible/pkgs/container/ansible) Docker image)."
+msgid "If Ansible fails with `Host key verification failed` (or a similar `Data could not be sent to remote host` error) without asking you to confirm the SSH host key of your server, you're likely on Ansible 2.21 or later."
 msgstr ""
 
 #: ../../../docs/ansible.md:46
-msgid "This ensures that:"
+msgid "Since Ansible 2.21, forked workers call `setsid()` and thus lose the controlling terminal. SSH cannot open `/dev/tty` anymore, so it can no longer ask you to confirm an unknown host key or prompt you for the passphrase of an SSH key."
 msgstr ""
 
 #: ../../../docs/ansible.md:48
-msgid "you're using a very recent Ansible version, which is less likely to be incompatible with the playbook"
+msgid "To fix host key errors, connect to the server once (e.g. `ssh root@matrix.example.com`) and confirm the host key. Ansible runs after that will find it in your `known_hosts` file."
 msgstr ""
 
-#: ../../../docs/ansible.md:49
-msgid "you also get access to the [agru](https://github.com/etkecc/agru) tool for quicker Ansible role installation (when running `just roles`) compared to `ansible-galaxy`"
+#: ../../../docs/ansible.md:50
+msgid "If your SSH key is protected by a passphrase, load it into an [ssh-agent](https://man.openbsd.org/ssh-agent) (e.g. `ssh-add ~/.ssh/id_ed25519`), so that SSH does not need to prompt for the passphrase."
 msgstr ""
 
-#: ../../../docs/ansible.md:51
-msgid "You can either [run Ansible in a container on the Matrix server itself](#running-ansible-in-a-container-on-the-matrix-server-itself) or [run Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server)."
+#: ../../../docs/ansible.md:52
+msgid "**Note**: if you're [using Ansible via Docker](#using-ansible-via-docker), host keys of previously unknown hosts are accepted automatically, so only the passphrase advice above applies to you. For the agent to be reachable inside the container, share its socket by adding `--mount type=bind,src=$SSH_AUTH_SOCK,dst=/ssh-agent --env SSH_AUTH_SOCK=/ssh-agent` to `docker run`. If the key is already loaded into the agent, you do not need to mount the SSH key file into the container at all."
 msgstr ""
 
-#: ../../../docs/ansible.md:53
-msgid "Running Ansible in a container on the Matrix server itself"
+#: ../../../docs/ansible.md:54
+msgid "Using Ansible via Docker"
 msgstr ""
 
-#: ../../../docs/ansible.md:55
-msgid "To run Ansible in a (Docker) container on the Matrix server itself, you need to have a working Docker installation. Docker is normally installed by the playbook, so this may be a bit of a chicken and egg problem. To solve it:"
-msgstr ""
-
-#: ../../../docs/ansible.md:57
-msgid "you **either** need to install Docker manually first. Follow [the upstream instructions](https://docs.docker.com/engine/install/) for your distribution and consider setting `matrix_playbook_docker_installation_enabled: false` in your `vars.yml` file, to prevent the playbook from installing Docker"
+#: ../../../docs/ansible.md:56
+msgid "Alternatively, you can run Ansible inside a Docker container (powered by the [ghcr.io/devture/ansible](https://github.com/devture/docker-ansible/pkgs/container/ansible) Docker image)."
 msgstr ""
 
 #: ../../../docs/ansible.md:58
-msgid "**or** you need to run the playbook in another way (e.g. [Running Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server)) at least the first time around"
+msgid "This ensures that:"
 msgstr ""
 
 #: ../../../docs/ansible.md:60
+msgid "you're using a very recent Ansible version, which is less likely to be incompatible with the playbook"
+msgstr ""
+
+#: ../../../docs/ansible.md:61
+msgid "you also get access to the [agru](https://github.com/etkecc/agru) tool for quicker Ansible role installation (when running `just roles`) compared to `ansible-galaxy`"
+msgstr ""
+
+#: ../../../docs/ansible.md:63
+msgid "You can either [run Ansible in a container on the Matrix server itself](#running-ansible-in-a-container-on-the-matrix-server-itself) or [run Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server)."
+msgstr ""
+
+#: ../../../docs/ansible.md:65
+msgid "💡 If you use [Visual Studio Code](https://code.visualstudio.com/) or [GitHub Codespaces](https://github.com/features/codespaces), the playbook also ships a [dev container](https://containers.dev/) configuration (see the `.devcontainer/` directory) based on this same Ansible Docker image, which can prepare such a containerized Ansible environment for you automatically."
+msgstr ""
+
+#: ../../../docs/ansible.md:67
+msgid "Running Ansible in a container on the Matrix server itself"
+msgstr ""
+
+#: ../../../docs/ansible.md:69
+msgid "To run Ansible in a (Docker) container on the Matrix server itself, you need to have a working Docker installation. Docker is normally installed by the playbook, so this may be a bit of a chicken and egg problem. To solve it:"
+msgstr ""
+
+#: ../../../docs/ansible.md:71
+msgid "you **either** need to install Docker manually first. Follow [the upstream instructions](https://docs.docker.com/engine/install/) for your distribution and consider setting `matrix_playbook_docker_installation_enabled: false` in your `vars.yml` file, to prevent the playbook from installing Docker"
+msgstr ""
+
+#: ../../../docs/ansible.md:72
+msgid "**or** you need to run the playbook in another way (e.g. [Running Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server)) at least the first time around"
+msgstr ""
+
+#: ../../../docs/ansible.md:74
 msgid "Once you have a working Docker installation on the server, **clone the playbook** somewhere on the server and configure it as per usual (`inventory/hosts`, `inventory/host_vars/…`, etc.), as described in [configuring the playbook](configuring-playbook.md)."
 msgstr ""
 
-#: ../../../docs/ansible.md:62
+#: ../../../docs/ansible.md:76
 msgid "You would then need to add `ansible_connection=community.docker.nsenter` to the host line in `inventory/hosts`. This tells Ansible to connect to the \"remote\" machine by switching Linux namespaces with [nsenter](https://man7.org/linux/man-pages/man1/nsenter.1.html), instead of using SSH."
 msgstr ""
 
-#: ../../../docs/ansible.md:64
+#: ../../../docs/ansible.md:78
 msgid "Alternatively, you can leave your `inventory/hosts` as is and specify the connection type in **each** `ansible-playbook` call you do later, like this: `just install-all --connection=community.docker.nsenter` (or `ansible-playbook --connection=community.docker.nsenter …`)."
 msgstr ""
 
-#: ../../../docs/ansible.md:66
-#: ../../../docs/ansible.md:88
+#: ../../../docs/ansible.md:80
+#: ../../../docs/ansible.md:102
 msgid "Run this from the playbook's directory:"
 msgstr ""
 
-#: ../../../docs/ansible.md:80
-#: ../../../docs/ansible.md:103
+#: ../../../docs/ansible.md:94
+#: ../../../docs/ansible.md:117
 msgid "Once you execute the above command, you'll be dropped into a `/work` directory inside a Docker container. The `/work` directory contains the playbook's code."
 msgstr ""
 
-#: ../../../docs/ansible.md:82
-#: ../../../docs/ansible.md:105
+#: ../../../docs/ansible.md:96
+#: ../../../docs/ansible.md:119
 msgid "First, consider running `git config --global --add safe.directory /work` to [resolve directory ownership issues](#resolve-directory-ownership-issues)."
 msgstr ""
 
-#: ../../../docs/ansible.md:84
+#: ../../../docs/ansible.md:98
 msgid "Finally, you can execute `just` or `ansible-playbook …` (e.g. `ansible-playbook --connection=community.docker.nsenter …`) commands as per normal now."
 msgstr ""
 
-#: ../../../docs/ansible.md:86
+#: ../../../docs/ansible.md:100
 msgid "Running Ansible in a container on another computer (not the Matrix server)"
 msgstr ""
 
-#: ../../../docs/ansible.md:101
+#: ../../../docs/ansible.md:115
 msgid "The above command tries to mount an SSH key (`$HOME/.ssh/id_ed25519`) into the container (at `/root/.ssh/id_ed25519`). If your SSH key is at a different path (not in `$HOME/.ssh/id_ed25519`), adjust that part."
 msgstr ""
 
-#: ../../../docs/ansible.md:107
+#: ../../../docs/ansible.md:121
 msgid "Finally, you execute `just` or `ansible-playbook …` commands as per normal now."
 msgstr ""
 
-#: ../../../docs/ansible.md:109
+#: ../../../docs/ansible.md:123
 msgid "If you don't use SSH keys for authentication"
 msgstr ""
 
-#: ../../../docs/ansible.md:111
+#: ../../../docs/ansible.md:125
 msgid "If you don't use SSH keys for authentication, simply remove that whole line (`--mount type=bind,src$HOME/.ssh/id_ed25519,dst=/root/.ssh/id_ed25519,ro`)."
 msgstr ""
 
-#: ../../../docs/ansible.md:113
+#: ../../../docs/ansible.md:127
 msgid "To authenticate at your server using a password, you need to add a package. So, when you are in the shell of the ansible docker container (the previously used `docker run -it …` command), run:"
 msgstr ""
 
-#: ../../../docs/ansible.md:119
+#: ../../../docs/ansible.md:133
 msgid "Then, to be asked for the password whenever running an `ansible-playbook` command add `--ask-pass` to the arguments of the command."
 msgstr ""
 
-#: ../../../docs/ansible.md:121
+#: ../../../docs/ansible.md:135
 msgid "Resolve directory ownership issues"
 msgstr ""
 
-#: ../../../docs/ansible.md:123
+#: ../../../docs/ansible.md:137
 msgid "Because you're `root` in the container running Ansible and this likely differs from the owner (your regular user account) of the playbook directory outside of the container, certain playbook features which use `git` locally may report warnings such as:"
 msgstr ""
 
-#: ../../../docs/ansible.md:125
+#: ../../../docs/ansible.md:139
 msgid "fatal: unsafe repository ('/work' is owned by someone else) To add an exception for this directory, call:  git config --global --add safe.directory /work"
 msgstr ""
 
-#: ../../../docs/ansible.md:129
+#: ../../../docs/ansible.md:143
 msgid "These errors can be resolved by making `git` trust the playbook directory by running `git config --global --add safe.directory /work`"
 msgstr ""

i18n/translation-templates/docs/configuring-captcha.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-16 13:47+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -33,43 +33,59 @@ msgid "The captcha mechanism used is Google's [ReCaptcha](https://www.google.com
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:18
-msgid "ReCaptcha"
+msgid "If you are using [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md), captcha is configured there instead (it handles registration), and [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) is supported as well. See [Matrix Authentication Service](#matrix-authentication-service) below."
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:20
-#: ../../../docs/configuring-captcha.md:46
-msgid "Getting keys"
+msgid "ReCaptcha"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:22
 #: ../../../docs/configuring-captcha.md:48
-msgid "Requires a site/secret key pair from:"
+msgid "Getting keys"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:24
-msgid "<http://www.google.com/recaptcha/admin>"
+#: ../../../docs/configuring-captcha.md:50
+msgid "Requires a site/secret key pair from:"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:26
-msgid "Must be a reCAPTCHA **v2** key using the \"I'm not a robot\" Checkbox option"
+msgid "<http://www.google.com/recaptcha/admin>"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:28
-msgid "Setting ReCaptcha keys"
+msgid "Must be a reCAPTCHA **v2** key using the \"I'm not a robot\" Checkbox option"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:30
+msgid "Setting ReCaptcha keys"
+msgstr ""
+
+#: ../../../docs/configuring-captcha.md:32
 msgid "Once registered as above, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-captcha.md:44
+#: ../../../docs/configuring-captcha.md:46
 msgid "hCaptcha"
 msgstr ""
 
-#: ../../../docs/configuring-captcha.md:50
+#: ../../../docs/configuring-captcha.md:52
 msgid "<https://dashboard.hcaptcha.com/sites/new>"
 msgstr ""
 
-#: ../../../docs/configuring-captcha.md:52
+#: ../../../docs/configuring-captcha.md:54
 msgid "Setting hCaptcha keys"
 msgstr ""
+
+#: ../../../docs/configuring-captcha.md:67
+msgid "Matrix Authentication Service"
+msgstr ""
+
+#: ../../../docs/configuring-captcha.md:69
+msgid "When [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md) is enabled, registration and other account operations are handled by it, so captcha protection is configured there (the Synapse and Dendrite settings above do not apply)."
+msgstr ""
+
+#: ../../../docs/configuring-captcha.md:71
+msgid "Matrix Authentication Service supports [ReCaptcha v2](http://www.google.com/recaptcha/admin), [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) and [hCaptcha](https://dashboard.hcaptcha.com/sites/new). Obtain a site/secret key pair from your chosen service, then add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
+msgstr ""

i18n/translation-templates/docs/configuring-ipv6.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-08-22 05:21+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -205,7 +205,7 @@ msgid "The `devture_systemd_docker_base_ipv6_enabled` setting controls whether c
 msgstr ""
 
 #: ../../../docs/configuring-ipv6.md:111
-msgid "Changing this setting subsequently requires manual work (deleting all container networks). See [I've changed the `devture_systemd_docker_base_ipv6_enabled` setting, but it doesn't seem to have any effect](#i-ve-changed-the-devture_systemd_docker_base_ipv6_enabled-setting-but-it-doesn-t-seem-to-have-any-effect)."
+msgid "Changing this setting subsequently requires manual work (deleting all container networks). See [I've changed the `devture_systemd_docker_base_ipv6_enabled` setting, but it doesn't seem to have any effect](#ive-changed-the-devture_systemd_docker_base_ipv6_enabled-setting-but-it-doesnt-seem-to-have-any-effect)."
 msgstr ""
 
 #: ../../../docs/configuring-ipv6.md:114

i18n/translation-templates/docs/configuring-playbook-bot-baibot.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-04-03 11:56+0100\n"
+"POT-Creation-Date: 2026-06-29 17:11+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -25,7 +25,7 @@ msgid "🤖 [baibot](https://github.com/etkecc/baibot) (pronounced bye-bot) is a
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-baibot.md:17
-msgid "It supports [OpenAI](https://openai.com/)'s [ChatGPT](https://openai.com/blog/chatgpt/) models, as many well as other [☁️ providers](https://github.com/etkecc/baibot/blob/main/docs/providers.md)."
+msgid "It supports many [☁️ providers](https://github.com/etkecc/baibot/blob/main/docs/providers.md), including the privacy-first [Venice](#venice) we recommend, [OpenAI](https://openai.com/)'s [ChatGPT](https://openai.com/blog/chatgpt/) models, and more."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-baibot.md:19
@@ -183,290 +183,321 @@ msgid "Depending on your propensity for [GitOps](https://en.wikipedia.org/wiki/D
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-baibot.md:162
-msgid "Before proceeding, we recommend reading the upstream documentation on [How to choose a provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#how-to-choose-a-provider). In short, it's probably best to go with [OpenAI](#openai)."
+msgid "Before proceeding, we recommend reading the upstream documentation on [How to choose a provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#how-to-choose-a-provider) for a side-by-side of what each one can do. In short: we recommend [Venice](#venice), the most capable provider baibot supports and the only one that keeps no logs and trains on nothing. If you'd rather start with the most widely-used option, [OpenAI](#openai) is a solid, well-supported choice too."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-baibot.md:164
-msgid "Anthropic"
+msgid "Venice"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-baibot.md:166
-msgid "You can statically-define a single [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md) instance powered by the [Anthropic provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#anthropic) with the help of the playbook's preset variables."
+msgid "[Venice](https://venice.ai/chat?ref=kpXDe6) _(ref link with a $10 bonus for you)_ is the provider we recommend. It's the most capable one baibot supports, and the only one that pairs that full feature set with real privacy: inference runs on Venice's own GPUs or on zero-data-retention partner hardware, so your prompts and replies are stored nowhere and never used for training. It serves both frontier proprietary models and the latest open-source ones."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-baibot.md:168
-#: ../../../docs/configuring-playbook-bot-baibot.md:192
+msgid "Venice also leaves the content policy to you instead of imposing its own. Its models answer without the reflexive refusals some hosted services apply, and both text and image generation can handle adult or otherwise sensitive subjects when you need them to. Image generation ships a `safe_mode` that blurs adult content by default; you can turn it off (see the sample config). This pairs naturally with the privacy above: a bot you can speak to candidly, that keeps nothing."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-baibot.md:170
+msgid "Unlike the [OpenAI Compatible](#openai-compatible) provider (which can also point at Venice, but drops images and can't reach its audio or native image endpoints), this is a first-class integration that exposes Venice's full parameter set: text-generation with vision, file inputs, prompt caching and native web search, plus speech-to-text, text-to-speech, and image generation and editing."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-baibot.md:172
+msgid "You can statically-define a single [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md) instance powered by the [Venice provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#venice) with the help of the playbook's preset variables."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-baibot.md:174
+#: ../../../docs/configuring-playbook-bot-baibot.md:199
 #: ../../../docs/configuring-playbook-bot-baibot.md:223
-#: ../../../docs/configuring-playbook-bot-baibot.md:251
+#: ../../../docs/configuring-playbook-bot-baibot.md:254
+#: ../../../docs/configuring-playbook-bot-baibot.md:282
 msgid "Here's an example **addition** to your `vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:184
+#: ../../../docs/configuring-playbook-bot-baibot.md:187
+msgid "Because this is a [statically](https://github.com/etkecc/baibot/blob/main/docs/configuration/README.md#static-configuration)-defined agent, it will be given a `static/` ID prefix and will be named `static/venice`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-baibot.md:189
+msgid "Every Venice knob (sampling, caching, reasoning, web-search behavior, voice and image controls) has a matching `matrix_bot_baibot_config_agents_static_definitions_venice_config_*` variable. The [fully-commented sample config](https://github.com/etkecc/baibot/blob/main/docs/sample-provider-configs/venice.yml) explains every one of them."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-baibot.md:191
 #: ../../../docs/configuring-playbook-bot-baibot.md:215
-#: ../../../docs/configuring-playbook-bot-baibot.md:241
-#: ../../../docs/configuring-playbook-bot-baibot.md:275
+#: ../../../docs/configuring-playbook-bot-baibot.md:246
+#: ../../../docs/configuring-playbook-bot-baibot.md:272
+#: ../../../docs/configuring-playbook-bot-baibot.md:306
 msgid "If you'd like to use more than one model, take a look at the [Configuring additional agents (without a preset)](#configuring-additional-agents-without-a-preset) section below."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:186
+#: ../../../docs/configuring-playbook-bot-baibot.md:193
 #: ../../../docs/configuring-playbook-bot-baibot.md:217
-#: ../../../docs/configuring-playbook-bot-baibot.md:243
-#: ../../../docs/configuring-playbook-bot-baibot.md:277
+#: ../../../docs/configuring-playbook-bot-baibot.md:248
+#: ../../../docs/configuring-playbook-bot-baibot.md:274
+#: ../../../docs/configuring-playbook-bot-baibot.md:308
 msgid "💡 You may also wish to use this new agent for [🤝 Configuring initial default handlers](#-configuring-initial-default-handlers)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:188
-msgid "Groq"
+#: ../../../docs/configuring-playbook-bot-baibot.md:195
+msgid "Anthropic"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:190
-msgid "You can statically-define a single [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md) instance powered by the [Groq provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#groq) with the help of the playbook's preset variables."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-baibot.md:213
-msgid "Because this is a [statically](https://github.com/etkecc/baibot/blob/main/docs/configuration/README.md#static-configuration)-defined agent, it will be given a `static/` ID prefix and will be named `static/groq`."
+#: ../../../docs/configuring-playbook-bot-baibot.md:197
+msgid "You can statically-define a single [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md) instance powered by the [Anthropic provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#anthropic) with the help of the playbook's preset variables."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-baibot.md:219
-msgid "Mistral"
+msgid "Groq"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-baibot.md:221
+msgid "You can statically-define a single [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md) instance powered by the [Groq provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#groq) with the help of the playbook's preset variables."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-baibot.md:244
+msgid "Because this is a [statically](https://github.com/etkecc/baibot/blob/main/docs/configuration/README.md#static-configuration)-defined agent, it will be given a `static/` ID prefix and will be named `static/groq`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-baibot.md:250
+msgid "Mistral"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-baibot.md:252
 msgid "You can statically-define a single [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md) instance powered by the [🇫🇷 Mistral provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#mistral) with the help of the playbook's preset variables."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:239
+#: ../../../docs/configuring-playbook-bot-baibot.md:270
 msgid "Because this is a [statically](https://github.com/etkecc/baibot/blob/main/docs/configuration/README.md#static-configuration)-defined agent, it will be given a `static/` ID prefix and will be named `static/mistral`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:245
+#: ../../../docs/configuring-playbook-bot-baibot.md:276
 msgid "OpenAI"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:247
+#: ../../../docs/configuring-playbook-bot-baibot.md:278
 msgid "You can statically-define a single [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md) instance powered by the [OpenAI provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#openai) with the help of the playbook's preset variables."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:249
+#: ../../../docs/configuring-playbook-bot-baibot.md:280
 msgid "The OpenAI provider is **only meant to be used with OpenAI's official API** and compatibility with other services (which do not fully adhere to the OpenAI API spec completely) is limited. **If you're targeting an OpenAI-compatible service**, use the [OpenAI Compatible](#openai-compatible) provider instead."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:273
+#: ../../../docs/configuring-playbook-bot-baibot.md:304
 msgid "Because this is a [statically](https://github.com/etkecc/baibot/blob/main/docs/configuration/README.md#static-configuration)-defined agent, it will be given a `static/` ID prefix and will be named `static/openai`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:279
+#: ../../../docs/configuring-playbook-bot-baibot.md:310
 msgid "OpenAI Compatible"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:281
+#: ../../../docs/configuring-playbook-bot-baibot.md:312
 msgid "You can statically-define a single [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md) instance powered by the [OpenAI Compatible provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md#openai-compatible) with the help of the playbook's preset variables."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:283
+#: ../../../docs/configuring-playbook-bot-baibot.md:314
 msgid "This provider allows you to use OpenAI-compatible API services like [OpenRouter](https://github.com/etkecc/baibot/blob/main/docs/providers.md#openrouter), [Together AI](https://github.com/etkecc/baibot/blob/main/docs/providers.md#together-ai), etc."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:285
+#: ../../../docs/configuring-playbook-bot-baibot.md:316
 msgid "Some of these popular services already have **shortcut** providers (see [supported providers](https://github.com/etkecc/baibot/blob/main/docs/providers.md#supported-providers) leading to this one behind the scenes — this make it easier to get started."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:287
+#: ../../../docs/configuring-playbook-bot-baibot.md:318
 msgid "As of this moment, the playbook does not include presets for any of these services, so you'll need to [Configuring additional agents (without a preset)](#configuring-additional-agents-without-a-preset)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:289
+#: ../../../docs/configuring-playbook-bot-baibot.md:320
 msgid "Configuring additional agents (without a preset)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:291
+#: ../../../docs/configuring-playbook-bot-baibot.md:322
 msgid "The Ansible role may be lacking preset variables for some [☁️ provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md), or you may wish to statically-define an agent on the same provider twice (or more) with different configuration."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:293
+#: ../../../docs/configuring-playbook-bot-baibot.md:324
 msgid "It's possible to inject your own agent configuration using the `matrix_bot_baibot_config_agents_static_definitions_custom` Ansible variable."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:295
+#: ../../../docs/configuring-playbook-bot-baibot.md:326
 msgid "You can also define providers at runtime, by chatting with the bot, so using Ansible is not a requirement."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:297
+#: ../../../docs/configuring-playbook-bot-baibot.md:328
 msgid "Below is an an **example** demonstrating **statically-defining agents via Ansible without using presets**:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:336
+#: ../../../docs/configuring-playbook-bot-baibot.md:367
 msgid "Because these are [statically](https://github.com/etkecc/baibot/blob/main/docs/configuration/README.md#static-configuration)-defined agents, they will be given a `static/` ID prefix and will be named `static/my-openai-gpt-3.5-turbo-agent` and `static/my-ollama-agent`, respectively."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:338
+#: ../../../docs/configuring-playbook-bot-baibot.md:369
 msgid "💡 To figure out what to put in the `config` section, refer to the [☁️ provider](https://github.com/etkecc/baibot/blob/main/docs/providers.md) page, which contains **sample configuration YAML for each provider**."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:340
+#: ../../../docs/configuring-playbook-bot-baibot.md:371
 msgid "As with any [🤖 agent](https://github.com/etkecc/baibot/blob/main/docs/agents.md), defining them means they exist. To actually make use of them, they need to be configured as handlers globally or in a specific room — see [Mixing & matching models](https://github.com/etkecc/baibot/blob/main/docs/features.md#mixing--matching-models)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:342
+#: ../../../docs/configuring-playbook-bot-baibot.md:373
 msgid "💡 You may also wish to use these new agents for [🤝 Configuring initial default handlers](#-configuring-initial-default-handlers)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:344
+#: ../../../docs/configuring-playbook-bot-baibot.md:375
 msgid "🤝 Configuring initial default handlers"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:346
+#: ../../../docs/configuring-playbook-bot-baibot.md:377
 msgid "This section is only useful if you're [🤖 Configuring agents via Ansible](#-configuring-agents-via-ansible), as it lets you put these agents to use as soon as the bot starts (by adjusting the bot's **initial global configuration**)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:348
+#: ../../../docs/configuring-playbook-bot-baibot.md:379
 msgid "If you're not configuring agents via Ansible, you can skip this section."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:350
+#: ../../../docs/configuring-playbook-bot-baibot.md:381
 msgid "This section is only useful the first time around. **Once initially configured the global configuration cannot be managed Ansible**, but only via bot commands."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:352
+#: ../../../docs/configuring-playbook-bot-baibot.md:383
 msgid "baibot supports [various purposes](https://github.com/etkecc/baibot/blob/main/docs/features.md):"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:354
+#: ../../../docs/configuring-playbook-bot-baibot.md:385
 msgid "[💬 text-generation](https://github.com/etkecc/baibot/blob/main/docs/features.md#-text-generation): communicating with you via text"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:356
+#: ../../../docs/configuring-playbook-bot-baibot.md:387
 msgid "[🦻 speech-to-text](https://github.com/etkecc/baibot/blob/main/docs/features.md#-speech-to-text): turning your voice messages into text"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:358
+#: ../../../docs/configuring-playbook-bot-baibot.md:389
 msgid "[🗣️ text-to-speech](https://github.com/etkecc/baibot/blob/main/docs/features.md#-text-to-speech): turning bot or users text messages into voice messages"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:360
+#: ../../../docs/configuring-playbook-bot-baibot.md:391
 msgid "[🖌️ image-generation](https://github.com/etkecc/baibot/blob/main/docs/features.md#-image-generation): generating images based on instructions"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:362
+#: ../../../docs/configuring-playbook-bot-baibot.md:393
 msgid "❓ catch-all: special purposes, indicating use as a fallback (when no specific handler is configured)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:364
+#: ../../../docs/configuring-playbook-bot-baibot.md:395
 msgid "[Mixing & matching models](https://github.com/etkecc/baibot/blob/main/docs/features.md#mixing--matching-models) is made possible by the bot's ability to have different [🤝 handlers](https://github.com/etkecc/baibot/blob/main/docs/configuration/handlers.md) configured for different purposes."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:366
+#: ../../../docs/configuring-playbook-bot-baibot.md:397
 msgid "This configuration can be done as a global fallback, or per-room. Both of these [🛠️ configurations](https://github.com/etkecc/baibot/blob/main/docs/configuration/README.md) are managed at runtime (viat chat), but **the global configuration can have some initial defaults configured via Ansible**."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:368
+#: ../../../docs/configuring-playbook-bot-baibot.md:399
 msgid "You can configure the **initial values** for these via Ansible, via the `matrix_bot_baibot_config_initial_global_config_handler_*` variables."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:370
+#: ../../../docs/configuring-playbook-bot-baibot.md:401
 msgid "Example **additional** `vars.yml` configuration:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:387
+#: ../../../docs/configuring-playbook-bot-baibot.md:418
 msgid "**Note**: these are initial defaults for the bot's global configuration. As such, changing any of these values subsequently has no effect on the bot's behavior. **Once initially configured the global configuration cannot be managed Ansible**, but only via bot commands."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:389
+#: ../../../docs/configuring-playbook-bot-baibot.md:420
 msgid "Extending the configuration"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:391
+#: ../../../docs/configuring-playbook-bot-baibot.md:422
 msgid "There are some additional things you may wish to configure about the bot."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:393
+#: ../../../docs/configuring-playbook-bot-baibot.md:424
 msgid "Take a look at:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:395
+#: ../../../docs/configuring-playbook-bot-baibot.md:426
 msgid "`roles/custom/matrix-bot-baibot/defaults/main.yml` for some variables that you can customize via your `vars.yml` file"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:396
+#: ../../../docs/configuring-playbook-bot-baibot.md:427
 msgid "`roles/custom/matrix-bot-baibot/templates/config.yaml.j2` for the bot's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bot_baibot_configuration_extension_yaml` variable"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:398
+#: ../../../docs/configuring-playbook-bot-baibot.md:429
 msgid "Installing"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:400
+#: ../../../docs/configuring-playbook-bot-baibot.md:431
 msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:407
+#: ../../../docs/configuring-playbook-bot-baibot.md:438
 msgid "**Notes**:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:409
+#: ../../../docs/configuring-playbook-bot-baibot.md:440
 msgid "The `ensure-matrix-users-created` playbook tag makes the playbook automatically create the bot's user account when password authentication is used."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:411
+#: ../../../docs/configuring-playbook-bot-baibot.md:442
 msgid "If you're using access-token authentication, the bot account must already exist and the configured token + device ID must match that account. This mode is mainly for MAS/OIDC setups where password-based bot login is not suitable."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:413
+#: ../../../docs/configuring-playbook-bot-baibot.md:444
 msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:415
+#: ../../../docs/configuring-playbook-bot-baibot.md:446
 msgid "`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:417
+#: ../../../docs/configuring-playbook-bot-baibot.md:448
 msgid "If you change the bot password (`matrix_bot_baibot_config_user_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [Ketesa](configuring-playbook-ketesa.md) to change it, and then update `matrix_bot_baibot_config_user_password` to let the bot know its new password. (This note applies to password authentication mode.)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:419
+#: ../../../docs/configuring-playbook-bot-baibot.md:450
 msgid "Usage"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:421
+#: ../../../docs/configuring-playbook-bot-baibot.md:452
 msgid "To use the bot, invite it to any existing Matrix room (`/invite @baibot:example.com` where `example.com` is your base domain, not the `matrix.` domain)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:423
+#: ../../../docs/configuring-playbook-bot-baibot.md:454
 msgid "If you're an allowed bot [👥 user](https://github.com/etkecc/baibot/blob/main/docs/access.md#user) (see [👥 Initial users configuration](#-initial-users-configuration)), the bot will accept your invitation and join the room."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:425
+#: ../../../docs/configuring-playbook-bot-baibot.md:456
 msgid "After joining, the bot will introduce itself and show information about the [✨ features](https://github.com/etkecc/baibot/blob/main/docs/features.md) that are enabled for it."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:427
+#: ../../../docs/configuring-playbook-bot-baibot.md:458
 msgid "If you've [🤖 configured one or more agents via Ansible](#-configuring-agents-via-ansible) and have [🤝 configured initial default handlers](#configuring-initial-default-handlers), the bot will immediately be able to make use of these agents for this new room. Otherwise, you will need to configure agents and/or handlers via chat commands."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:429
+#: ../../../docs/configuring-playbook-bot-baibot.md:460
 msgid "Send `!bai help` to the bot in the room to see the available commands."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:431
+#: ../../../docs/configuring-playbook-bot-baibot.md:462
 msgid "You can also refer to the upstream [baibot](https://github.com/etkecc/baibot) project's documentation."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:433
+#: ../../../docs/configuring-playbook-bot-baibot.md:464
 msgid "Troubleshooting"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:435
+#: ../../../docs/configuring-playbook-bot-baibot.md:466
 msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-bot-baibot`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:437
+#: ../../../docs/configuring-playbook-bot-baibot.md:468
 msgid "Increase logging verbosity"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:439
+#: ../../../docs/configuring-playbook-bot-baibot.md:470
 msgid "The default logging level for this service is `info`. If you want to increase the verbosity to `debug` (or even `trace`), add the following configuration to your `vars.yml` file and re-run the playbook:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-baibot.md:453
+#: ../../../docs/configuring-playbook-bot-baibot.md:484
 msgid "**Alternatively**, you can use a single variable to set the logging level for all of the above (bot + all libraries):"
 msgstr ""

i18n/translation-templates/docs/configuring-playbook-bot-draupnir.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-08-16 16:15+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -33,470 +33,490 @@ msgid "This documentation page is about installing Draupnir in bot mode. As an a
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:19
-msgid "If your migrating from [Mjolnir](configuring-playbook-bot-mjolnir.md), skip to [this section](#migrating-from-mjolnir-only-required-if-migrating)."
+msgid "**Note**: you can also use the [Meowlnir](configuring-playbook-bot-meowlnir.md) or [Mjolnir](configuring-playbook-bot-mjolnir.md) bots, which speak the same [policy list](https://the-draupnir-project.github.io/draupnir-documentation/concepts/policy-lists) protocol."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:21
-msgid "Prerequisites"
+msgid "When migrating from [Mjolnir](configuring-playbook-bot-mjolnir.md), skip to [this section](#migrating-from-mjolnir-only-required-if-migrating)."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:23
-msgid "Prerequisites for Zero Touch Deployment (recommended)"
+msgid "Prerequisites"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:25
-msgid "As of Draupnir 3.1.0, Zero Touch Deployment of Draupnir bot mode requires you to supply the following:"
+msgid "Prerequisites for Zero Touch Deployment (recommended)"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:27
-msgid "MXID of the first person who gets invited to the management room that the bot creates for you."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-draupnir.md:28
-msgid "A permanent access token for authentication. Instructions for obtaining one can be found at [obtain an access token via curl](obtaining-access-tokens.md#obtain-an-access-token-via-curl)."
+msgid "As of Draupnir 3.1.0, Zero Touch Deployment of Draupnir bot mode requires you to supply the following:"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:29
-msgid "A user account for Draupnir."
+msgid "MXID of the first person who gets invited to the management room that the bot creates for you."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-draupnir.md:30
+msgid "A permanent access token for authentication. Instructions for obtaining one can be found at [obtain an access token via curl](obtaining-access-tokens.md#obtain-an-access-token-via-curl)."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:31
-msgid "Zero Touch Deployment is the officially preferred installation method for new deployments of Draupnir as of 3.1.0."
+msgid "A user account for Draupnir."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:33
-msgid "Create a management room (optional)"
+msgid "Zero Touch Deployment is the officially preferred installation method for new deployments of Draupnir as of 3.1.0."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:35
+msgid "Create a management room (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-draupnir.md:37
 msgid "Using your own account, create a new invite only room that you will use to manage the bot. This is the room where you will see the status of the bot and where you will send commands to the bot, such as the command to ban a user from another room."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:38
+#: ../../../docs/configuring-playbook-bot-draupnir.md:40
 msgid "Anyone in this room can control the bot so it is important that you only invite trusted users to this room."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:40
-msgid "It is possible to make the management room encrypted (E2EE). If doing so, then you need to enable the native E2EE support (see [below](#native-e2ee-support))."
-msgstr ""
-
 #: ../../../docs/configuring-playbook-bot-draupnir.md:42
-msgid "E2EE support for the management room is mutually exclusive with Zero Touch Deployment of Draupnir."
+msgid "The bot also needs at least a Moderator power level (50) in this room. This power level is granted in a [later step](#create-and-invite-the-bot-to-the-management-room-only-when-using-native-login-without-zero-touch-deployment), after the bot gets invited to the room."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:44
-msgid "Once you have created the room you need to copy the room ID so you can specify it on your `inventory/host_vars/matrix.example.com/vars.yml` file. In Element Web you can check the ID by going to the room's settings and clicking \"Advanced\". The room ID will look something like `!qporfwt:example.com`."
+msgid "It is possible to make the management room encrypted (E2EE). If doing so, then you need to enable the native E2EE support (see [below](#native-e2ee-support))."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:46
-msgid "End-to-End Encryption support"
+msgid "E2EE support for the management room is mutually exclusive with Zero Touch Deployment of Draupnir."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:48
-msgid "Decide whether you want to support having an encrypted management room or not. Draupnir can still protect encrypted rooms without encryption support enabled."
+msgid "Once you have created the room you need to copy the room ID so you can specify it on your `inventory/host_vars/matrix.example.com/vars.yml` file. In Element Web you can check the ID by going to the room's settings and clicking \"Advanced\". The room ID will look something like `!qporfwt:example.com`."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:50
-msgid "Refer to Draupnir's [documentation](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-protected-rooms#protecting-encrypted-rooms) for more details about why you might want to care about encryption support for protected rooms."
+msgid "End-to-End Encryption support"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:52
-msgid "Disable Pantalaimon for Draupnir (since v2.0.0; optional)"
+msgid "Decide whether you want to support having an encrypted management room or not. Draupnir can still protect encrypted rooms without encryption support enabled."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:54
-msgid "It is known that running Draupnir along with Pantalaimon breaks all workflows that involve answering prompts with reactions."
+msgid "Refer to Draupnir's [documentation](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-protected-rooms#protecting-encrypted-rooms) for more details about why you might want to care about encryption support for protected rooms."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:56
-msgid "If you are updating Draupnir from v1.x.x and have enabled Pantalaimon for it, you can disable Pantalaimon in favor of the native E2EE support. To disable Pantalaimon, remove the configuration `matrix_bot_draupnir_pantalaimon_use: true` from your `vars.yml` file."
+msgid "Disable Pantalaimon for Draupnir (since v2.0.0; optional)"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:58
-msgid "**Note**: because the management room is still encrypted, disabling it without enabling the native E2EE support will break the management room."
+msgid "It is known that running Draupnir along with Pantalaimon breaks all workflows that involve answering prompts with reactions."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:60
-msgid "Native E2EE support"
+msgid "If you are updating Draupnir from v1.x.x and have enabled Pantalaimon for it, you can disable Pantalaimon in favor of the native E2EE support. To disable Pantalaimon, remove the configuration `matrix_bot_draupnir_pantalaimon_use: true` from your `vars.yml` file."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:62
-msgid "To enable the native E2EE support, you need to obtain an access token for Draupnir and set it on your `vars.yml` file."
+msgid "**Note**: because the management room is still encrypted, disabling it without enabling the native E2EE support will break the management room."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:64
-msgid "Note that native E2EE requires a clean access token that has not touched E2EE so curl is recommended as a method to obtain it. **The access token obtained via Element Web does not work with it**. Refer to the documentation on [how to obtain an access token via curl](obtaining-access-tokens.md#obtain-an-access-token-via-curl)."
+msgid "Native E2EE support"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-draupnir.md:66
+msgid "To enable the native E2EE support, you need to obtain an access token for Draupnir and set it on your `vars.yml` file."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-draupnir.md:68
+msgid "Note that native E2EE requires a clean access token that has not touched E2EE so curl is recommended as a method to obtain it. **The access token obtained via Element Web does not work with it**. Refer to the documentation on [how to obtain an access token via curl](obtaining-access-tokens.md#obtain-an-access-token-via-curl)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-draupnir.md:70
 msgid "To enable the native E2EE support, add the following configuration to your `vars.yml` file. Make sure to replace `CLEAN_ACCESS_TOKEN_HERE` with the access token you obtained just now."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:77
+#: ../../../docs/configuring-playbook-bot-draupnir.md:81
 msgid "Adjusting the playbook configuration"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:79
+#: ../../../docs/configuring-playbook-bot-draupnir.md:83
 msgid "Configuration for Zero Touch Deployment (recommended)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:81
+#: ../../../docs/configuring-playbook-bot-draupnir.md:85
 msgid "To enable the bot using Zero Touch Deployment, add the following configuration to your `vars.yml` file. Make sure to replace `INITIAL_MANAGER_MXID_HERE` with the MXID of the user who should be invited to the management room first, and `CLEAN_ACCESS_TOKEN_HERE` with the access token you obtained."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:95
+#: ../../../docs/configuring-playbook-bot-draupnir.md:99
 msgid "Configuration without Zero Touch Deployment"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:97
+#: ../../../docs/configuring-playbook-bot-draupnir.md:101
 msgid "If you'd prefer to have the bot manage its own login at the cost of having to create the management room manually, you can use native login with the configuration block below. Make sure to replace `MANAGEMENT_ROOM_ID_HERE` with the ID of the management room you have created earlier."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:116
+#: ../../../docs/configuring-playbook-bot-draupnir.md:120
 msgid "Running both bot mode and appservice mode"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:118
+#: ../../../docs/configuring-playbook-bot-draupnir.md:122
 msgid "When running both bot mode and [appservice mode (Draupnir for all)](./configuring-playbook-appservice-draupnir-for-all.md), the playbook will force-restart the bot if running a non-release tag like `latest` or `main` or a development build. This is due to the conditional restart logic not being able to reliably tell when an update happened."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:122
+#: ../../../docs/configuring-playbook-bot-draupnir.md:126
 msgid "Conditional restarts work correctly for all tags when running only one of these two operating modes."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:124
+#: ../../../docs/configuring-playbook-bot-draupnir.md:128
 msgid "Create and invite the bot to the management room (only when using native login without Zero Touch Deployment)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:126
+#: ../../../docs/configuring-playbook-bot-draupnir.md:130
 msgid "Before proceeding to the next step, run the playbook with the following command to create the bot user."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:132
+#: ../../../docs/configuring-playbook-bot-draupnir.md:136
 msgid "**Note**: the `ensure-matrix-users-created` playbook tag makes the playbook automatically create the bot's user account."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:134
+#: ../../../docs/configuring-playbook-bot-draupnir.md:138
 msgid "Then, invite the bot (`@bot.draupnir:example.com`) to its management room which you have created earlier."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:136
+#: ../../../docs/configuring-playbook-bot-draupnir.md:140
+msgid "After the bot joins, give it at least a Moderator power level (50) in the management room."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-draupnir.md:143
+msgid "Draupnir stores each protection's settings as custom state events in the management room, and sending those requires a power level of 50 by default. A bot without this power level cannot save any protection settings. The failure is easy to miss and has nasty consequences: the `PolicyChangeNotification` protection, unable to remember its notifications room, will create a brand new one on every restart of the bot (and the playbook restarts it on every installation run), littering your server with abandoned rooms."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-draupnir.md:145
+msgid "This is not a concern for Zero Touch Deployment, where the bot creates the management room itself and has full control over it."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-draupnir.md:147
 msgid "Creating a user account for the bot (when using Zero Touch Deployment)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:138
+#: ../../../docs/configuring-playbook-bot-draupnir.md:149
 msgid "Since Zero Touch Deployment is not validated with native login, you will need to create the user account manually."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:140
+#: ../../../docs/configuring-playbook-bot-draupnir.md:151
 msgid "Refer to [registering users](registering-users.md) for documentation on how to configure the user account."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:142
+#: ../../../docs/configuring-playbook-bot-draupnir.md:153
 msgid "Make sure the account is free from rate limiting (optional, recommended)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:144
+#: ../../../docs/configuring-playbook-bot-draupnir.md:155
 msgid "If your homeserver's implementation is Synapse, you will need to prevent it from rate limiting the bot's account. **This is a highly recommended step. If you do not configure it, Draupnir performance will be degraded.**"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:146
+#: ../../../docs/configuring-playbook-bot-draupnir.md:157
 msgid "This can be done using Synapse's [Admin APIs](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html#override-ratelimiting-for-users). They can be accessed both externally and internally."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:148
+#: ../../../docs/configuring-playbook-bot-draupnir.md:159
 msgid "**Note**: access to the APIs is restricted with a valid access token, so exposing them publicly should not be a real security concern. Still, doing so is not recommended for additional security. See [official Synapse reverse-proxying recommendations](https://element-hq.github.io/synapse/latest/reverse_proxy.html#synapse-administration-endpoints)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:150
+#: ../../../docs/configuring-playbook-bot-draupnir.md:161
 msgid "The APIs can also be accessed via [Ketesa](https://github.com/etkecc/ketesa), a web UI tool you can use to administrate users, rooms, media, etc. on your Matrix server. The playbook can install and configure Ketesa for you. For details about it, see [this page](configuring-playbook-ketesa.md)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:152
+#: ../../../docs/configuring-playbook-bot-draupnir.md:163
 msgid "Add the configuration"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:154
+#: ../../../docs/configuring-playbook-bot-draupnir.md:165
 msgid "This is automatically done if Ketesa is enabled. Otherwise, to expose the APIs publicly, add the following configuration to your `vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:160
+#: ../../../docs/configuring-playbook-bot-draupnir.md:171
 msgid "Obtain an access token for admin account"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:162
+#: ../../../docs/configuring-playbook-bot-draupnir.md:173
 msgid "Manual access to Synapse's Admin APIs requires an access token for a homeserver admin account. Refer to the documentation on [how to obtain an access token](obtaining-access-tokens.md)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:165
+#: ../../../docs/configuring-playbook-bot-draupnir.md:176
 msgid "Access tokens are sensitive information. Do not include them in any bug reports, messages, or logs. Do not share the access token with anyone."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:167
+#: ../../../docs/configuring-playbook-bot-draupnir.md:178
 msgid "Run the `curl` command"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:169
+#: ../../../docs/configuring-playbook-bot-draupnir.md:180
 msgid "To disable rate limiting, run the following command on systems that ship curl. Before running it, make sure to replace:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:171
+#: ../../../docs/configuring-playbook-bot-draupnir.md:182
 msgid "`ADMIN_ACCESS_TOKEN_HERE` with the access token of the admin account"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:172
+#: ../../../docs/configuring-playbook-bot-draupnir.md:183
 msgid "`example.com` with your base domain"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:173
+#: ../../../docs/configuring-playbook-bot-draupnir.md:184
 msgid "`@bot.draupnir:example.com` with the MXID of your Draupnir bot user"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:179
-#: ../../../docs/configuring-playbook-bot-draupnir.md:254
+#: ../../../docs/configuring-playbook-bot-draupnir.md:190
+#: ../../../docs/configuring-playbook-bot-draupnir.md:265
 msgid "**Notes**:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:181
+#: ../../../docs/configuring-playbook-bot-draupnir.md:192
 msgid "This does not work on outdated Windows 10 as curl is not available there."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:182
+#: ../../../docs/configuring-playbook-bot-draupnir.md:193
 msgid "Even if the APIs are not exposed to the internet, you should still be able to run the command on the homeserver locally."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:184
+#: ../../../docs/configuring-playbook-bot-draupnir.md:195
 msgid "Abuse Reports"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:186
+#: ../../../docs/configuring-playbook-bot-draupnir.md:197
 msgid "Draupnir can receive reports in the management room."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:188
+#: ../../../docs/configuring-playbook-bot-draupnir.md:199
 msgid "The bot can intercept the report API endpoint of the client-server API, which requires integration with the reverse proxy in front of the homeserver. If you are using Traefik, this playbook can set this up for you:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:194
+#: ../../../docs/configuring-playbook-bot-draupnir.md:205
 msgid "Enabling synapse-http-antispam support"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:196
+#: ../../../docs/configuring-playbook-bot-draupnir.md:207
 msgid "Certain protections in Draupnir require the [synapse-http-antispam](https://github.com/maunium/synapse-http-antispam) module and a Synapse homeserver plus homeserver admin status to function. This module can be enabled in the playbook via setting `matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled` to `true` and making sure that Draupnir admin API access is enabled."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:206
+#: ../../../docs/configuring-playbook-bot-draupnir.md:217
 msgid "These protections need to be manually activated. Consulting the [enabling protections](#enabling-built-in-protections) guide and/or upstream documentation can be helpful."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:208
+#: ../../../docs/configuring-playbook-bot-draupnir.md:219
 msgid "The other method polls a Synapse Admin API endpoint, hence it is available only if using Synapse and if the Draupnir user is an admin. To enable it, set `pollReports: true` in your `vars.yml` file as below:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:215
+#: ../../../docs/configuring-playbook-bot-draupnir.md:226
 msgid "Extending the configuration"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:217
+#: ../../../docs/configuring-playbook-bot-draupnir.md:228
 msgid "There are some additional things you may wish to configure about the bot."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:219
+#: ../../../docs/configuring-playbook-bot-draupnir.md:230
 msgid "Take a look at:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:221
+#: ../../../docs/configuring-playbook-bot-draupnir.md:232
 msgid "`roles/custom/matrix-bot-draupnir/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bot_draupnir_configuration_extension_yaml` variable"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:223
+#: ../../../docs/configuring-playbook-bot-draupnir.md:234
 msgid "For example, to change Draupnir's `acceptInvitesFromSpace` option to `!qporfwt:example.com`, add the following configuration to your `vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:237
+#: ../../../docs/configuring-playbook-bot-draupnir.md:248
 msgid "Migrating from Mjolnir (Only required if migrating)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:239
+#: ../../../docs/configuring-playbook-bot-draupnir.md:250
 msgid "Replace your `matrix_bot_mjolnir` config with `matrix_bot_draupnir` config. Also disable Mjolnir if you're doing migration."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:241
+#: ../../../docs/configuring-playbook-bot-draupnir.md:252
 msgid "Note that Draupnir supports E2EE natively, so you can enable it instead of Pantalaimon. It is recommended to consult the instruction [here](#native-e2ee-support)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:243
+#: ../../../docs/configuring-playbook-bot-draupnir.md:254
 msgid "That is all you need to do due to that Draupnir can complete migration on its own."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:245
+#: ../../../docs/configuring-playbook-bot-draupnir.md:256
 msgid "Installing"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:247
+#: ../../../docs/configuring-playbook-bot-draupnir.md:258
 msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:256
+#: ../../../docs/configuring-playbook-bot-draupnir.md:267
 msgid "The `ensure-matrix-users-created` playbook tag makes the playbook automatically create the bot's user account."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:258
+#: ../../../docs/configuring-playbook-bot-draupnir.md:269
 msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:260
+#: ../../../docs/configuring-playbook-bot-draupnir.md:271
 msgid "`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:262
+#: ../../../docs/configuring-playbook-bot-draupnir.md:273
 msgid "If you change the bot password (`matrix_bot_draupnir_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [Ketesa](configuring-playbook-ketesa.md) to change it, and then update `matrix_bot_draupnir_password` to let the bot know its new password."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:264
+#: ../../../docs/configuring-playbook-bot-draupnir.md:275
 msgid "Usage"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:266
+#: ../../../docs/configuring-playbook-bot-draupnir.md:277
 msgid "You can refer to the upstream [documentation](https://the-draupnir-project.github.io/draupnir-documentation/) for additional ways to use and configure Draupnir and for a more detailed usage guide."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:268
+#: ../../../docs/configuring-playbook-bot-draupnir.md:279
 msgid "Below is a **non-exhaustive quick-start guide** for the impatient."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:270
+#: ../../../docs/configuring-playbook-bot-draupnir.md:281
 msgid "Making Draupnir join and protect a room"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:272
+#: ../../../docs/configuring-playbook-bot-draupnir.md:283
 msgid "Draupnir can be told to self-join public rooms, but it's better to follow this flow which works well for all kinds of rooms:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:274
+#: ../../../docs/configuring-playbook-bot-draupnir.md:285
 msgid "Invite the bot to the room manually ([inviting Draupnir to rooms](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-protected-rooms#inviting-draupnir-to-rooms)). Before joining, the bot *may* ask for confirmation in the Management Room"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:276
+#: ../../../docs/configuring-playbook-bot-draupnir.md:287
 msgid "[Give the bot permissions to do its job](#giving-draupnir-permissions-to-do-its-job)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:278
+#: ../../../docs/configuring-playbook-bot-draupnir.md:289
 msgid "Tell it to protect the room (using the [rooms command](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-protected-rooms#using-the-draupnir-rooms-command)) by sending the following command to the Management Room: `!draupnir rooms add !qporfwt:example.com`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:280
+#: ../../../docs/configuring-playbook-bot-draupnir.md:291
 msgid "To have Draupnir provide useful room protection, you need do to a bit more work (at least the first time around). You may wish to [Subscribe to a public policy list](#subscribing-to-a-public-policy-list), [Create your own own policy and rules](#creating-your-own-policy-lists-and-rules) and [Enabling built-in protections](#enabling-built-in-protections)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:282
+#: ../../../docs/configuring-playbook-bot-draupnir.md:293
 msgid "Giving Draupnir permissions to do its job"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:284
+#: ../../../docs/configuring-playbook-bot-draupnir.md:295
 msgid "For Draupnir to do its job, you need to [give it permissions](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-protected-rooms#giving-draupnir-permissions) in rooms it's protecting. This involves **giving it an Administrator power level**."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:286
+#: ../../../docs/configuring-playbook-bot-draupnir.md:297
 msgid "**We recommend setting this power level as soon as the bot joins your room** (and before you create new rules), so that it can apply rules as soon as they are available. If the bot is under-privileged, it may fail to apply protections and may not retry for a while (or until your restart it)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:288
+#: ../../../docs/configuring-playbook-bot-draupnir.md:299
 msgid "Subscribing to a public policy list"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:290
+#: ../../../docs/configuring-playbook-bot-draupnir.md:301
 msgid "We recommend **subscribing to a public [policy list](https://the-draupnir-project.github.io/draupnir-documentation/concepts/policy-lists)** using the [watch command](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-policy-lists#using-draupnirs-watch-command-to-subscribe-to-policy-rooms)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:292
+#: ../../../docs/configuring-playbook-bot-draupnir.md:303
 msgid "Policy lists are maintained in Matrix rooms. Popular ones maintained in the public are:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:294
+#: ../../../docs/configuring-playbook-bot-draupnir.md:305
 msgid "`#community-moderation-effort-bl:neko.dev`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:295
+#: ../../../docs/configuring-playbook-bot-draupnir.md:306
 msgid "`#huginn-muninn-active-threats:feline.support`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:297
+#: ../../../docs/configuring-playbook-bot-draupnir.md:308
 msgid "You can tell Draupnir to subscribe to each of these by sending the following command to the Management Room: `!draupnir watch POLICY_LIST_ADDRESS_HERE` (e.g. `!draupnir watch #community-moderation-effort-bl:neko.dev`)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:299
+#: ../../../docs/configuring-playbook-bot-draupnir.md:310
 msgid "Creating your own policy lists and rules"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:301
+#: ../../../docs/configuring-playbook-bot-draupnir.md:312
 msgid "We also recommend **creating your own policy lists** with the [list create](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-policy-lists#using-draupnirs-list-create-command-to-create-a-policy-room) command."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:303
+#: ../../../docs/configuring-playbook-bot-draupnir.md:314
 msgid "You can do so by sending the following command to the Management Room: `!draupnir list create my-bans my-bans-bl`. This will create a policy list having a name (shortcode) of `my-bans` and stored in a public `#my-bans-bl:example.com` room on your server. As soon as you run this command, the bot will invite you to the policy list room."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:305
+#: ../../../docs/configuring-playbook-bot-draupnir.md:316
 msgid "A policy list does nothing by itself, so the next step is **adding some rules to your policy list**. Policies target a so-called `entity` (one of: `user`, `room` or `server`). These entities are mentioned on the [policy lists](https://the-draupnir-project.github.io/draupnir-documentation/concepts/policy-lists) documentation page and in the Matrix Spec [here](https://spec.matrix.org/v1.11/client-server-api/#mban-recommendation)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:307
+#: ../../../docs/configuring-playbook-bot-draupnir.md:318
 msgid "The simplest and most useful entity to target is `user`. Below are a few examples using the [ban command](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-users#the-ban-command) and targeting users."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:309
+#: ../../../docs/configuring-playbook-bot-draupnir.md:320
 msgid "To create rules, you run commands in the Management Room (**not** in the policy list room)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:311
+#: ../../../docs/configuring-playbook-bot-draupnir.md:322
 msgid "(ban a single user on a given homeserver): `!draupnir ban @charles:example.com my-bans Rude to others`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:312
+#: ../../../docs/configuring-playbook-bot-draupnir.md:323
 msgid "(ban all users on a given homeserver by using a [wildcard](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-users#wildcards)): `!draupnir ban @*:example.org my-bans Spam server, all users are fake`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:314
+#: ../../../docs/configuring-playbook-bot-draupnir.md:325
 msgid "As a result of running these commands, you may observe:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:316
+#: ../../../docs/configuring-playbook-bot-draupnir.md:327
 msgid "Draupnir creating `m.policy.rule.user` state events in the `#my-bans-bl:example.com` room on your server"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:317
+#: ../../../docs/configuring-playbook-bot-draupnir.md:328
 msgid "applying these rules against all rooms that Draupnir is an Administrator in"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:319
+#: ../../../docs/configuring-playbook-bot-draupnir.md:330
 msgid "You can undo bans with the [unban command](https://the-draupnir-project.github.io/draupnir-documentation/moderator/managing-users#the-unban-command)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:321
+#: ../../../docs/configuring-playbook-bot-draupnir.md:332
 msgid "Enabling built-in protections"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:323
+#: ../../../docs/configuring-playbook-bot-draupnir.md:334
 msgid "You can also **turn on various built-in [protections](https://the-draupnir-project.github.io/draupnir-documentation/protections)** like `JoinWaveShortCircuitProtection` (\"If X amount of users join in Y time, set the room to invite-only\")."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:325
+#: ../../../docs/configuring-playbook-bot-draupnir.md:336
 msgid "To **see which protections are available and which are enabled**, send a `!draupnir protections` command to the Management Room."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:327
+#: ../../../docs/configuring-playbook-bot-draupnir.md:338
 msgid "To [**see the configuration options for a given protection**](https://the-draupnir-project.github.io/draupnir-documentation/protections/configuring-protections#displaying-the-protection-settings), send a `!draupnir protections show PROTECTION_NAME` (e.g. `!draupnir protections show JoinWaveShortCircuitProtection`)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:329
+#: ../../../docs/configuring-playbook-bot-draupnir.md:340
 msgid "To [**set a specific option for a given protection**](https://the-draupnir-project.github.io/draupnir-documentation/protections/configuring-protections#changing-protection-settings), send a command like this: `!draupnir protections config set PROTECTION_NAME OPTION VALUE` (e.g. `!draupnir protections config set JoinWaveShortCircuitProtection timescaleMinutes 30`)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:331
+#: ../../../docs/configuring-playbook-bot-draupnir.md:342
 msgid "To [**enable a given protection**](https://the-draupnir-project.github.io/draupnir-documentation/protections/block-invitations-on-server-protection#enabling-the-protection), send a command like this: `!draupnir protections enable PROTECTION_NAME` (e.g. `!draupnir protections enable JoinWaveShortCircuitProtection`)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-draupnir.md:333
+#: ../../../docs/configuring-playbook-bot-draupnir.md:344
 msgid "To **disable a given protection**, send a command like this: `!draupnir protections disable PROTECTION_NAME` (e.g. `!draupnir protections disable JoinWaveShortCircuitProtection`)."
 msgstr ""

i18n/translation-templates/docs/configuring-playbook-bot-matrix-registration-bot.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-04-03 11:56+0100\n"
+"POT-Creation-Date: 2026-07-12 11:50+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -16,118 +16,18 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:13
-msgid "Setting up matrix-registration-bot (optional)"
+#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:22
+msgid "Setting up matrix-registration-bot (optional, removed)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:15
-msgid "The playbook can install and configure [matrix-registration-bot](https://github.com/moan0s/matrix-registration-bot) for you."
+#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:24
+msgid "🪦 The playbook used to be able to install and configure [matrix-registration-bot](https://github.com/moan0s/matrix-registration-bot), but no longer includes this component, as it has been unmaintained."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:17
-msgid "The bot allows you to easily **create and manage registration tokens** aka. invitation codes. It can be used for an invitation-based server, where you invite someone by sending them a registration token (tokens look like this: `rbalQ0zkaDSRQCOp`). They can register as per normal but have to provide a valid registration token in the final step of the registration process."
+#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:26
+msgid "Uninstalling the component manually"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:19
-msgid "See the project's [documentation](https://github.com/moan0s/matrix-registration-bot/blob/master/README.md) to learn what it does and why it might be useful to you."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:21
-msgid "Adjusting the playbook configuration"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:23
-msgid "To enable the bot, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:46
-msgid "The bot account will be created automatically."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:48
-msgid "Extending the configuration"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:50
-msgid "There are some additional things you may wish to configure about the bot."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:52
-msgid "Take a look at:"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:54
-msgid "`roles/custom/matrix-bot-matrix-registration-bot/defaults/main.yml` for some variables that you can customize via your `vars.yml` file"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:55
-msgid "`roles/custom/matrix-bot-matrix-registration-bot/templates/config.yaml.j2` for the bridge's default configuration"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:57
-msgid "Installing"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:59
-msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:66
-msgid "**Notes**:"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:68
-msgid "The `ensure-matrix-users-created` playbook tag makes the playbook automatically create the bot's user account."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:70
-msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:72
-msgid "`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:74
-msgid "If you change the bot password (`matrix_bot_matrix_registration_bot_bot_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [Ketesa](configuring-playbook-ketesa.md) to change it, and then update `matrix_bot_matrix_registration_bot_bot_password` to let the bot know its new password."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:76
-msgid "Usage"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:78
-msgid "To use the bot, start a chat with `@bot.matrix-registration-bot:example.com` (where `example.com` is your base domain, not the `matrix.` domain)."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:80
-msgid "Send `help` to the bot to see the available commands."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:82
-msgid "You can also refer to the upstream [Usage documentation](https://github.com/moan0s/matrix-registration-bot#supported-commands)."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:84
-msgid "If you have any questions, or if you need help setting it up, read the [troubleshooting guide](https://github.com/moan0s/matrix-registration-bot/blob/main/docs/troubleshooting.md) or join [#matrix-registration-bot:hyteck.de](https://matrix.to/#/#matrix-registration-bot:hyteck.de)."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:86
-msgid "To clean the cache (session & encryption data) after you changed the bot's username, changed the login method from access_token to password etc… you can use:"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:92
-msgid "Troubleshooting"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:94
-msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-bot-matrix-registration-bot`."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:96
-msgid "Increase logging verbosity"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:98
-msgid "The default logging level for this component is `INFO`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:"
+#: ../../../docs/configuring-playbook-bot-matrix-registration-bot.md:28
+msgid "If you still have matrix-registration-bot installed on your Matrix server, the playbook can no longer help you uninstall it and you will need to do it manually. To uninstall manually, run these commands on the server:"
 msgstr ""

i18n/translation-templates/docs/configuring-playbook-bot-meowlnir.pot

@@ -0,0 +1,629 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) 2018-2026, Slavi Pantaleev, Aine Etke, MDAD community members
+# This file is distributed under the same license as the matrix-docker-ansible-deploy package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: matrix-docker-ansible-deploy \n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2026-08-22 05:21+0000\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:7
+msgid "Setting up Meowlnir (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:9
+msgid "The playbook can install and configure the [Meowlnir](https://github.com/maunium/meowlnir) moderation bot for you."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:11
+msgid "See the project's [documentation](https://docs.mau.fi/meowlnir/) to learn what it does and why it might be useful to you."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:13
+msgid "Meowlnir is an alternative to [Draupnir](configuring-playbook-bot-draupnir.md) and [Mjolnir](configuring-playbook-bot-mjolnir.md). It speaks the same [policy list](https://the-draupnir-project.github.io/draupnir-documentation/concepts/policy-lists) protocol, so it can subscribe to the same community ban lists, but it differs from them in a few ways that may matter to you:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:15
+msgid "It runs as an **appservice** and hosts **multiple bots**, each with its own management room. They live in Meowlnir's database, not its configuration file, but you still [declare them in your `vars.yml` file](#declaring-bots)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:16
+msgid "It can **override a policy coming from a list you do not control**, via unban policies combined with the ordering of your watched lists. See [Overriding a policy from someone else's list](#overriding-a-policy-from-someone-elses-list)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:17
+msgid "It is written in Go and is optimized for Synapse, using its database and admin APIs directly."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:19
+msgid "Meowlnir and Draupnir can run side by side, but not usefully in the *same* room: whichever bot you are migrating away from still watches the same community lists, so it re-applies the very bans your unban policies remove. Migrate room by room. See [Trialling Meowlnir alongside another bot](#trialling-meowlnir-alongside-another-bot)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:21
+msgid "Prerequisites"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:23
+msgid "Postgres"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:25
+msgid "Meowlnir stores its state in a Postgres database. The playbook creates one for you automatically when using the integrated Postgres server."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:27
+msgid "Adjusting DNS records"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:29
+msgid "**No DNS changes are necessary.** Meowlnir is reached by the homeserver over the container network, and the paths it optionally serves publicly (abuse reports and the policy server) are routed on your existing `matrix.example.com` domain."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:31
+msgid "Adjusting the playbook configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:33
+msgid "To enable Meowlnir, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:39
+msgid "Declaring bots"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:41
+msgid "That gets the service running, but Meowlnir does nothing until it has at least one bot. Declare the ones you want and the playbook creates them for you:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "Field"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "Required"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "Notes"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "`username`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "yes"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "The localpart of the bot's Matrix user. Awkward to change later, so choose it carefully."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "`displayname`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "The name shown in rooms. Safe to change at any time."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "`avatar_url`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "An `mxc://` URI, or `\"\"` for no avatar."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "`management_room_auto_create`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "Whether the playbook creates the bot's management room. Mutually exclusive with a non-empty `management_rooms`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "`management_rooms`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "Rooms you have created yourself, `[]` when auto-creating. See [Supplying your own management room](#supplying-your-own-management-room)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "`initial_managers`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "no"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:0
+msgid "Who to invite to an auto-created room. Defaults to the instance-wide list below."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:67
+msgid "Usernames have to start with `meowlnir_` (the value of `matrix_bot_meowlnir_user_prefix`), so that bots fall inside the user namespace the homeserver lets Meowlnir operate."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:69
+msgid "Changing `displayname` or `avatar_url` and re-running updates the bot in place. The comparison is against Meowlnir's own record, so profile edits made directly from a Matrix client are not reverted."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:71
+msgid "Initial managers"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:73
+msgid "With `management_room_auto_create: true`, the playbook creates each bot's management room and invites its initial managers to it. You only need to accept the room invitation."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:75
+msgid "`matrix_admin` is a single playbook variable which affects all bridges and bots, so setting it is usually a better move than setting anything specific to this role — **if it is already configured in your `vars.yml` file, there is nothing to do here**. If neither `matrix_admin` nor `matrix_bot_meowlnir_initial_managers` are set, the playbook would tell you about it."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:77
+msgid "A per-bot `initial_managers` replaces the instance-wide list. Declaring it empty means nobody, which fails the run for a bot relying on `management_room_auto_create`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:79
+msgid "The list is consulted only while the room is being created. Adding a name to it later invites nobody, because the room already exists — invite and promote further moderators from inside the room instead, as described in [Who can command a bot](#who-can-command-a-bot)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:81
+msgid "Rooms the playbook creates"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:83
+msgid "The bot creates the room with the `trusted_private_chat` preset, which gives every invitee the standing to command it. This is an additional room creator on room versions supporting [MSC4289](https://github.com/matrix-org/matrix-spec-proposals/pull/4289) (like v12) and power level 100 on older room versions. Creator status cannot be revoked subsequently."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:85
+msgid "The room's encryption follows `matrix_bot_meowlnir_config_encryption_enable`, and its name and topic come from `matrix_bot_meowlnir_management_room_name` and `matrix_bot_meowlnir_management_room_topic`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:87
+msgid "Supplying your own management room"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:89
+msgid "If you would rather own the room outright, create it yourself and declare it instead. The bot is then merely an administrator in a room you created:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:102
+msgid "An empty, invite-only room is fine. The order matters, because **each step depends on the one before it**:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:104
+msgid "Declare the room and run the playbook. Do not invite the bot beforehand."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:105
+msgid "The playbook creates the bot and tells Meowlnir about the room. Meowlnir would try to join right away, but will fail for invite-only rooms (a harmless error in the log)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:106
+msgid "Invite the bot. It accepts the invitation, because the room is already marked as a management room for it."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:107
+msgid "Give it power level 50 or more (ideally 100), so that it can store its protected rooms and watched lists there."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:109
+msgid "Meowlnir supports several management rooms per bot, and `encrypted` is set per room. Marking a room encrypted only means something when [End-to-End Encryption support](#end-to-end-encryption-support) is switched on, which it is not by default."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:111
+msgid "Several management rooms for one bot"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:113
+msgid "Protected rooms, watched policy lists, protection settings and who may command the bot are properties of **a management room**, not of the bot. A room can be protected from exactly one management room, so moving a room means `!rooms unprotect` in the old room and `!rooms protect` in the new one, with its settings and subscriptions set up again there."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:115
+msgid "That is how you hand one room to another moderator without giving them power over everything else the bot moderates: a second management room, the room moved into it, and power level 50 for them there. That last part is revocable, unlike the creator status everyone invited at creation time receives."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:117
+msgid "Splitting rooms up this way does not split two other things:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:119
+msgid "The variables which name a single management room (`matrix_bot_meowlnir_synapse_http_antispam_management_room_id`, `matrix_bot_meowlnir_config_meowlnir_report_room`, `matrix_bot_meowlnir_config_meowlnir_room_ban_room`) keep pointing at the room you named there."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:120
+msgid "A policy list can be written to from any management room watching it, and its policies apply in every room those management rooms protect. Give a delegated management room a list of its own with `!lists create`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:122
+msgid "Create the room with `meowlnir-create-management-room` (see [Inspecting and driving Meowlnir directly](#inspecting-and-driving-meowlnir-directly)), then add its ID to `management_rooms` and re-run the playbook, which is what registers it with Meowlnir."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:124
+msgid "Switching a bot from an auto-created room to declared ones"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:126
+msgid "Auto-creation makes exactly one room, and since it is not declared anywhere, [pruning](#bots-which-are-no-longer-declared) leaves such a bot's rooms alone. Declaring a second room means taking over the declaration of all of them: list what Meowlnir knows about with `/matrix/meowlnir/bin/meowlnir-bots`, set `management_room_auto_create: false`, put **every** one of those rooms under `management_rooms`, and re-run the playbook."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:129
+msgid "A room left out of that list is unregistered on the next run. Nothing is destroyed, but the bot stops taking commands there and stops protecting the rooms attached to it, until you declare the room again."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:131
+msgid "Who can command a bot"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:133
+msgid "**Management room membership alone is not enough**, which is different from what [Draupnir](configuring-playbook-bot-draupnir.md) does, where everyone in the management room can issue commands."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:135
+msgid "Meowlnir decides who may drive a bot from power levels in its management room: anyone who can send the `fi.mau.meowlnir.watched_lists` state event (power level 50 by default), plus the room's creators."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:137
+msgid "Bots which are no longer declared"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:139
+msgid "The bot list (`matrix_bot_meowlnir_bots_custom`) is authoritative. Removing entries from there will make the playbook unregister them with the Meowlnir instance."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:141
+msgid "Removal only adjusts Meowlnir's own records. A removed bot's Matrix user remains activated and stays in the rooms it had joined. A removed management room leaves the room and the bot's membership in it intact - it's just that Meowlnir stops taking commands there."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:143
+msgid "Removal happens under the same `ensure-matrix-users-created` tag that creates bots. It's one Ansible tag for \"synchronizing the bots state\" (creation, changes, and removal)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:145
+msgid "To turn removal off entirely, set `matrix_bot_meowlnir_bots_pruning_enabled: false`. As a safety measure, the playbook refuses to prune when *no* bots are declared at all; override that with `matrix_bot_meowlnir_bots_pruning_on_empty_roster_enabled: true`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:147
+msgid "Trialling Meowlnir alongside another bot"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:149
+msgid "Meowlnir has a dry-run mode in which it does everything except take moderation actions:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:156
+msgid "Dry run does not cover the [synapse-http-antispam](#enabling-synapse-http-antispam-support) integration. It suppresses actions Meowlnir takes itself (bans, server ACLs, rejecting pending invites), but the verdicts it hands back to Synapse still block invites and joins. Leave that integration off while trialling."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:158
+msgid "Do not expect dry run to preview what Meowlnir would do in rooms another policy-list bot already moderates. Meowlnir only acts on users who are *in* a room, and the other bot has already removed everyone its lists match, so the preview comes out empty. Dry run also skips the power level check described under [Protecting a room](#protecting-a-room), so it will not surface a permissions problem either."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:160
+msgid "Abuse reports"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:162
+msgid "Meowlnir can intercept the report endpoints of the client-server API, so that abuse reports are delivered to a management room. This requires integration with the reverse proxy in front of the homeserver, which the playbook sets up for you when using Traefik:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:171
+msgid "Only the `v3` report endpoints are routed to Meowlnir. Requests to the legacy `r0` endpoints continue to reach the homeserver, because Meowlnir does not serve them."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:173
+msgid "Enabling synapse-http-antispam support"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:175
+msgid "Meowlnir can block invites and joins before they happen. This requires the [synapse-http-antispam](https://github.com/maunium/synapse-http-antispam) module, which the playbook can enable for you:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:185
+msgid "The playbook wires the module up to a single consumer, so this cannot be enabled at the same time as `matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled`. The playbook fails the run if both are enabled."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:187
+msgid "With the module in place, you can also block invitations to specific users outright, which is useful for accounts that attract spam:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:194
+msgid "Such an invitation can still be let through case by case with the `!allow-invite` command."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:196
+msgid "End-to-End Encryption support"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:198
+msgid "To let Meowlnir's bots participate in encrypted rooms:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:204
+msgid "When using Synapse, the playbook turns on the experimental features this depends on (`msc2409_to_device_messages_enabled` and `msc3202_transaction_extensions`) for you."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:206
+msgid "Policy server (MSC4284)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:208
+msgid "Meowlnir can act as a [policy server](https://github.com/matrix-org/matrix-spec-proposals/pull/4284), letting rooms ask it to vet events before they are accepted:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:214
+msgid "This exposes `/_matrix/policy` on your Matrix federation endpoint, so that other servers participating in a room can reach it."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:216
+msgid "That only stands the policy server up, though — no room is put behind it until you say so from the management room:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:222
+msgid "Given no room, `enable` applies to every protected room. Rooms which are not protected are skipped, with `Skipped ... as it is not a protected room`, so [protect a room](#protecting-a-room) before enabling it here. `!policyserver` on its own reports whether the policy server is available and prints its public key, and `!policyserver disable` reverses the change."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:224
+msgid "The playbook derives a stable signing key for you from `matrix_homeserver_generic_secret_key`. If you would rather use an independently generated one, produce it with the command below and set it as `matrix_bot_meowlnir_config_policy_server_signing_key`:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:230
+msgid "Synapse admin API access (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:232
+msgid "A few of Meowlnir's features go through Synapse's admin API, not the client-server API — suspending or deactivating users, and deleting rooms during a takedown. Those calls require the caller to be a Synapse **server admin**, which bots are not by default, so they come back as `M_FORBIDDEN` (\"You are not a server admin\"). Nothing else is affected: bans, server ACLs, protecting rooms and watching policy lists all go through the client-server API, where a sufficient power level is the only requirement."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:234
+msgid "To grant that access, point each bot at a token belonging to a server admin:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:241
+msgid "The key is the bot the token is used for; the token itself belongs to an administrator account, not to the bot."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:243
+msgid "If you have more than one management room, note that room bans are only processed in the one named by `matrix_bot_meowlnir_config_meowlnir_room_ban_room`, and ignored elsewhere."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:245
+msgid "Where the token comes from depends on how your homeserver authenticates. Ordinarily you [obtain an access token](obtaining-access-tokens.md) for an account which is a Synapse server admin. When [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md) is enabled, Synapse no longer decides who is an admin, so the token has to be issued by MAS with admin privileges:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:251
+msgid "Note that bot users are created by the appservice and are not known to Matrix Authentication Service, so the token cannot be issued for the bot itself — use an administrator account."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:253
+msgid "Access to the Synapse database (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:255
+msgid "Some room takedown features rely on Meowlnir reading room IDs directly from the Synapse database. Upstream expects a user with read-only permissions, which the playbook does not create. Enabling the integration below hands Meowlnir the same credentials Synapse itself uses, which also grant write access:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:261
+msgid "If you would rather not do that, create a read-only Postgres user yourself and point Meowlnir at it with `matrix_bot_meowlnir_synapse_database_uri`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:263
+msgid "Adopting an existing Meowlnir installation"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:265
+msgid "If you already run Meowlnir outside the playbook and want to bring it under this role, two things need attention before the first run."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:267
+msgid "Your bots exist in Meowlnir's database but not in your `vars.yml` file, and [pruning](#bots-which-are-no-longer-declared) is on by default, so the first run would remove them. Declare them in `matrix_bot_meowlnir_bots_custom` — with `management_room_auto_create: false` and their existing rooms under `management_rooms` — or set `matrix_bot_meowlnir_bots_pruning_enabled: false`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:269
+msgid "If the installation uses encryption, also copy the `pickle_key` from its old configuration file into `matrix_bot_meowlnir_config_encryption_pickle_key`. The crypto store cannot be read with a different key than it was written with, so leaving the playbook's default in place costs your bots their existing encryption sessions."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:271
+msgid "Extending the configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:273
+msgid "There are some additional things you may wish to configure about the bot."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:275
+msgid "Take a look at:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:277
+msgid "`roles/custom/matrix-bot-meowlnir/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bot_meowlnir_configuration_extension_yaml` variable"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:280
+msgid "Do not set any of Meowlnir's secrets to the literal value `generate`. Meowlnir re-runs its configuration upgrader on every start, so a `generate` placeholder would produce a brand new secret on every restart. The playbook derives stable values for you, and fails the run if it finds a `generate` placeholder."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:282
+msgid "Installing"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:284
+msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:290
+msgid "With `management_room_auto_create`, you then have an invitation waiting for you — accept it and start sending commands. If you supplied the management room yourself, carry on from step 3 of [Supplying your own management room](#supplying-your-own-management-room): invite the bot, then give it power level 50 or more."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:292
+msgid "**Notes**:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:294
+msgid "The `ensure-matrix-users-created` tag is what creates the bots declared in `matrix_bot_meowlnir_bots_custom`, registers their management rooms, and removes the ones you no longer declare. It deliberately does not run as part of `setup-all`, so that installing onto a server whose database you are about to restore from a backup does not write anything."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:296
+msgid "Re-running is safe and idempotent, so adding a bot later is a matter of extending the list and running the same command again."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:298
+msgid "If the homeserver turns out to be running without Meowlnir's appservice registration (which is the normal state of affairs on the run that first enables Meowlnir), the playbook restarts the homeserver during bot provisioning, so that everything completes in a single run."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:300
+msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:302
+msgid "Usage"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:304
+msgid "You can refer to the upstream [documentation](https://docs.mau.fi/meowlnir/) for a more detailed usage guide."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:306
+msgid "Below is a **non-exhaustive quick-start guide** for the impatient."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:308
+msgid "Inspecting and driving Meowlnir directly"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:310
+msgid "The playbook drives Meowlnir's management API for you based on `matrix_bot_meowlnir_bots_custom`, which is the recommended way. For anything it does not cover, helper scripts are installed under `/matrix/meowlnir/bin`, which find the management secret and reach the API inside the container:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:327
+msgid "`meowlnir-create-management-room` prints the new room's ID, which you then register with `meowlnir-api PUT /_meowlnir/v1/management_room/<room ID>`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:329
+msgid "See the upstream [bot creation documentation](https://docs.mau.fi/meowlnir/bot-create.html) for the full set of endpoints. Bear in mind that bots you create this way are not declared in your `vars.yml` file, so the next playbook run will remove them again (see [Bots which are no longer declared](#bots-which-are-no-longer-declared))."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:331
+msgid "If you have enabled encryption, each bot also needs verifying once. That step is left manual because it returns a recovery key you need to store somewhere safe:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:337
+msgid "Protecting a room"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:339
+msgid "Invite the bot to a room, give it a power level high enough to act (see below), and then tell it to protect the room by sending this command to its management room:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:345
+msgid "If the bot has more than one management room, send this to the one that should own the room: a room can only be protected from a single management room. See [Several management rooms for one bot](#several-management-rooms-for-one-bot)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:347
+msgid "Meowlnir refuses to protect a room unless its power level reaches that room's own `ban` and `redact` levels (50 in a default room). That is only enough for user bans, though: writing `m.room.server_acl` usually requires 100, and without it the server rules in your watched lists have no effect — which is most of what a list like [CME](https://matrix.to/#/%23community-moderation-effort-bl:neko.dev) carries. **Give the bot power level 100** unless you only care about user bans."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:349
+msgid "Set the power level *before* protecting the room. Meowlnir re-sends server ACLs when it starts and when a watched list changes, but not when its own power level goes up subsequently, so raising it afterwards leaves the room without ACLs until you restart the bot (`systemctl restart matrix-bot-meowlnir` or via the playbook's Ansible `start` tag)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:351
+msgid "Subscribing to a policy list"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:353
+msgid "Policy lists are maintained in Matrix rooms. Popular public ones are:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:355
+msgid "`#community-moderation-effort-bl:neko.dev`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:356
+msgid "`#huginn-muninn-active-threats:feline.support`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:358
+msgid "Subscribe to one by sending the following command to the management room:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:364
+msgid "The last argument is a shortcode, which you use to refer to the list in later commands."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:366
+msgid "Overriding a policy from someone else's list"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:368
+msgid "This is the main capability Meowlnir has that Draupnir does not."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:370
+msgid "When several watched lists carry a policy for the same user, **the first match wins**, and \"first\" means the order in which the lists are watched. So to be able to override a community list's ban, your own list has to come before it."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:372
+msgid "`!lists subscribe` appends, which makes subscription order the precedence order. Subscribe to your own list first, and to community lists afterwards:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:380
+msgid "To subscribe somewhere other than the end of the list, pass `--insert-before <shortcode>`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:382
+msgid "You can then publish an unban policy into your own list, which takes precedence over the community list's ban:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:389
+msgid "Unlike `!ban`, the `!add-unban` command does not treat its reason as a trailing argument, so a reason containing spaces is discarded. Use a single word (or hyphenate) until that is fixed upstream."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:392
+msgid "An unban policy stops a ban from being **re-applied**; it does not undo one that is already in place unless Meowlnir applied it itself and still has it on record. A ban placed by a human moderator, or by the Draupnir or Mjolnir you are migrating away from, stays. Unban such a user once by hand — from then on the policy keeps them unbanned, while you remain subscribed to the list that banned them."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:394
+msgid "Use `!match @alice:example.com` to see which policies currently apply to a user and which list each came from."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:397
+msgid "Unban policies use a Meowlnir-specific recommendation (`fi.mau.meowlnir.unban`) which is not part of the Matrix specification. If you publish your policy list for other people to subscribe to, subscribers running Draupnir or Mjolnir will ignore your unban policies."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:399
+msgid "There is also a blunter, server-wide escape hatch for policies that are too wide to tolerate at all — `matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_custom`, which makes Meowlnir ignore any policy matching the listed entities."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:401
+msgid "Troubleshooting"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:403
+msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by running a command like `journalctl -fu matrix-bot-meowlnir`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:405
+msgid "If bots appear to do nothing, check that they have an Administrator power level in the rooms they are meant to protect, and that the room has been added with `!rooms protect`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:407
+msgid "If commands in a management room get no reply at all, check the bot's power level *there* too — it needs at least 50 to record its own configuration."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-meowlnir.md:409
+msgid "A bare `!lists` returns nothing in a management room which has never had a policy list. That is an upstream bug and it clears as soon as you subscribe to one; `!lists subscribe` works from the start."
+msgstr ""

i18n/translation-templates/docs/configuring-playbook-bot-mjolnir.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-08-13 05:03+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,251 +29,255 @@ msgid "See the project's [documentation](https://github.com/matrix-org/mjolnir/b
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-mjolnir.md:18
-msgid "Prerequisites"
+msgid "**Note**: you can also use the [Draupnir](configuring-playbook-bot-draupnir.md) or [Meowlnir](configuring-playbook-bot-meowlnir.md) bots, which speak the same [policy list](https://the-draupnir-project.github.io/draupnir-documentation/concepts/policy-lists) protocol."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-mjolnir.md:20
-msgid "Register the bot account"
+msgid "Prerequisites"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-mjolnir.md:22
-msgid "The playbook does not automatically create users for you. You **need to register the bot user manually** before setting up the bot."
+msgid "Register the bot account"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-mjolnir.md:24
-msgid "Generate a strong password for the bot. You can create one with a command like `pwgen -s 64 1`."
+msgid "The playbook does not automatically create users for you. You **need to register the bot user manually** before setting up the bot."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bot-mjolnir.md:26
+msgid "Generate a strong password for the bot. You can create one with a command like `pwgen -s 64 1`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:28
 msgid "You can use the playbook to [register a new user](registering-users.md):"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:32
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:34
 msgid "If you would like Mjolnir to be able to deactivate users, move aliases, shutdown rooms, etc then it must be a server admin so you need to change `admin=no` to `admin=yes` in the command above."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:34
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:36
 msgid "Obtain an access token"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:36
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:38
 msgid "The bot requires an access token to be able to connect to your homeserver. Refer to the documentation on [how to obtain an access token](obtaining-access-tokens.md)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:39
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:64
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:41
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:66
 msgid "Access tokens are sensitive information. Do not include them in any bug reports, messages, or logs. Do not share the access token with anyone."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:41
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:43
 msgid "Make sure the account is free from rate limiting"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:43
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:45
 msgid "If your homeserver's implementation is Synapse, you will need to prevent it from rate limiting the bot's account. **This is a required step. If you do not configure it, Mjolnir will crash.**"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:45
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:47
 msgid "This can be done using Synapse's [Admin APIs](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html#override-ratelimiting-for-users). They can be accessed both externally and internally."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:47
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:49
 msgid "**Note**: access to the APIs is restricted with a valid access token, so exposing them publicly should not be a real security concern. Still, doing so is not recommended for additional security. See [official Synapse reverse-proxying recommendations](https://element-hq.github.io/synapse/latest/reverse_proxy.html#synapse-administration-endpoints)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:49
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:51
 msgid "The APIs can also be accessed via [Ketesa](https://github.com/etkecc/ketesa), a web UI tool you can use to administrate users, rooms, media, etc. on your Matrix server. The playbook can install and configure Ketesa for you. For details about it, see [this page](configuring-playbook-ketesa.md)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:51
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:53
 msgid "Add the configuration"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:53
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:55
 msgid "To expose the APIs publicly, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:59
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:61
 msgid "Obtain an access token for admin account"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:61
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:63
 msgid "Manual access to Synapse's Admin APIs requires an access token for a homeserver admin account. Refer to the documentation on [how to obtain an access token](obtaining-access-tokens.md). If you have made Mjolnir an admin, you can just use the Mjolnir token."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:66
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:68
 msgid "Run the `curl` command"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:68
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:70
 msgid "To disable rate limiting, run the following command on systems that ship curl. Before running it, make sure to replace:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:70
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:72
 msgid "`ADMIN_ACCESS_TOKEN_HERE` with the access token of the admin account"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:71
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:73
 msgid "`example.com` with your base domain"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:72
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:74
 msgid "`@bot.mjolnir:example.com` with the MXID of your Mjolnir bot user"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:78
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:195
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:80
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:197
 msgid "**Notes**:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:79
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:81
 msgid "This does not work on outdated Windows 10 as curl is not available there."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:80
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:82
 msgid "Even if the APIs are not exposed to the internet, you should still be able to run the command on the homeserver locally."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:82
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:84
 msgid "Create a management room"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:84
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:86
 msgid "Using your own account, create a new invite only room that you will use to manage the bot. This is the room where you will see the status of the bot and where you will send commands to the bot, such as the command to ban a user from another room."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:87
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:89
 msgid "Anyone in this room can control the bot so it is important that you only invite trusted users to this room."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:89
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:91
 msgid "It is possible to make the management room encrypted (E2EE). If doing so, then you MUST enable and use Pantalaimon (see [below](#configuration-with-e2ee-support))."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:91
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:93
 msgid "Once you have created the room you need to copy the room ID so you can specify it on your `vars.yml` file. In Element Web you can check the ID by going to the room's settings and clicking \"Advanced\". The room ID will look something like `!qporfwt:example.com`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:93
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:95
 msgid "Finally invite the `@bot.mjolnir:example.com` account you created earlier into the room."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:95
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:97
 msgid "Adjusting the playbook configuration"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:97
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:99
 msgid "To enable the bot, add the following configuration to your `vars.yml` file. Make sure to replace `MANAGEMENT_ROOM_ID_HERE` with the one of the room which you have created just now."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:106
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:108
 msgid "End-to-End Encryption support"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:108
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:110
 msgid "Decide whether you want Mjolnir to be capable of operating in end-to-end encrypted (E2EE) rooms. This includes the management room and the moderated rooms."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:110
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:112
 msgid "To support E2EE, Mjolnir needs to [use Pantalaimon](configuring-playbook-pantalaimon.md)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:112
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:114
 msgid "Configuration with E2EE support"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:114
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:116
 msgid "When using Pantalaimon, Mjolnir will log in to its bot account itself through Pantalaimon, so configure its username and password."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:116
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:118
 msgid "Add the following configuration to your `vars.yml` file (adapt to your needs):"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:130
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:132
 msgid "The playbook's `group_vars` will configure other required settings. If using this role separately without the playbook, you also need to configure the two URLs that Mjolnir uses to reach the homeserver, one through Pantalaimon and one \"raw\". This example is taken from the playbook's `group_vars`:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:142
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:144
 msgid "Configuration without E2EE support"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:144
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:146
 msgid "When NOT using Pantalaimon, Mjolnir does not log in by itself and you must give it an access token for its bot account."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:146
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:148
 msgid "Add the following configuration to your `vars.yml` file. Make sure to replace `ACCESS_TOKEN_HERE` with the one created [above](#obtain-an-access-token)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:152
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:154
 msgid "Adding Mjolnir synapse antispam module (optional)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:154
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:156
 msgid "To enable Mjolnir synapse antispam module, add the following configuration to your `vars.yml` file (adapt to your needs):"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:164
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:166
 msgid "Extending the configuration"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:166
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:168
 msgid "There are some additional things you may wish to configure about the bot."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:168
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:170
 msgid "Take a look at:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:170
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:172
 msgid "`roles/custom/matrix-bot-mjolnir/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bot_mjolnir_configuration_extension_yaml` variable"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:172
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:174
 msgid "For example, to change Mjolnir's `recordIgnoredInvites` option to `true`, add the following configuration to your `vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:186
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:188
 msgid "Installing"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:188
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:190
 msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:197
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:199
 msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:199
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:201
 msgid "`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:201
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:203
 msgid "If you change the Pantalaimon's password (`matrix_bot_mjolnir_pantalaimon_password` in your `vars.yml` file) subsequently, its credentials on the homeserver won't be updated automatically. If you'd like to change the password, use a tool like [Ketesa](configuring-playbook-ketesa.md) to change it, and then update `matrix_bot_mjolnir_pantalaimon_password` to let Pantalaimon know its new password."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:203
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:205
 msgid "Usage"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:205
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:207
 msgid "You can refer to the upstream [documentation](https://github.com/matrix-org/mjolnir) for additional ways to use and configure Mjolnir. Check out their [quickstart guide](https://github.com/matrix-org/mjolnir#quickstart-guide) for some basic commands you can give to the bot."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:207
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:209
 msgid "Troubleshooting"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:209
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:211
 msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-bot-mjolnir`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:211
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:213
 msgid "Increase logging verbosity"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bot-mjolnir.md:213
+#: ../../../docs/configuring-playbook-bot-mjolnir.md:215
 msgid "The default logging level for this component is `INFO`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:"
 msgstr ""

i18n/translation-templates/docs/configuring-playbook-bridge-appservice-discord.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-16 13:47+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -73,7 +73,7 @@ msgid "`roles/custom/matrix-bridge-appservice-discord/defaults/main.yml` for som
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-appservice-discord.md:47
-msgid "`roles/custom/matrix-bridge-appservice-discord/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_appservice_discord_configuration_extension_yaml` variable"
+msgid "`roles/custom/matrix-bridge-appservice-discord/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bridge_appservice_discord_configuration_extension_yaml` variable"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-appservice-discord.md:49
@@ -150,7 +150,7 @@ msgid "To get started with Portal Bridging:"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-appservice-discord.md:101
-msgid "To invite the bot to Discord, retrieve the invite link from the `{{ matrix_appservice_discord_config_path }}/invite_link` file on the server (this defaults to `/matrix/appservice-discord/config/invite_link`). You need to peek at the file on the server via SSH, etc., because it's not available via HTTP(S)."
+msgid "To invite the bot to Discord, retrieve the invite link from the `{{ matrix_bridge_appservice_discord_config_path }}/invite_link` file on the server (this defaults to `/matrix/appservice-discord/config/invite_link`). You need to peek at the file on the server via SSH, etc., because it's not available via HTTP(S)."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-appservice-discord.md:102

i18n/translation-templates/docs/configuring-playbook-bridge-appservice-irc.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-16 13:47+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -57,7 +57,7 @@ msgid "`roles/custom/matrix-bridge-appservice-irc/defaults/main.yml` for some va
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-appservice-irc.md:79
-msgid "`roles/custom/matrix-bridge-appservice-irc/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_appservice_irc_configuration_extension_yaml` variable"
+msgid "`roles/custom/matrix-bridge-appservice-irc/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_bridge_appservice_irc_configuration_extension_yaml` variable"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-appservice-irc.md:81

i18n/translation-templates/docs/configuring-playbook-bridge-appservice-kakaotalk.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-07-16 13:47+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -17,109 +17,21 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 
 #: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:10
-msgid "Setting up Appservice Kakaotalk bridging (optional)"
+msgid "Setting up Appservice Kakaotalk bridging (optional, removed)"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:12
-msgid "The playbook can install and configure [matrix-appservice-kakaotalk](https://src.miscworks.net/fair/matrix-appservice-kakaotalk) for you, for bridging to [Kakaotalk](https://www.kakaocorp.com/page/service/service/KakaoTalk?lang=ENG). This bridge is based on [node-kakao](https://github.com/storycraft/node-kakao) (now unmaintained) and some [mautrix-facebook](https://github.com/mautrix/facebook) code."
+msgid "🪦 The playbook used to be able to install and configure [matrix-appservice-kakaotalk](https://src.miscworks.net/fair/matrix-appservice-kakaotalk) (a bridge to [Kakaotalk](https://www.kakaocorp.com/page/service/service/KakaoTalk?lang=ENG)), but no longer includes this component."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:14
-msgid "See the project's [documentation](https://src.miscworks.net/fair/matrix-appservice-kakaotalk/src/branch/master/README.md) to learn what it does and why it might be useful to you."
+msgid "The bridge could only be installed by self-building its source code, and its upstream repository has become unreachable, which makes installation impossible. The bridge was also based on the now-unmaintained [node-kakao](https://github.com/storycraft/node-kakao) library, and there have been reports that using it may get your Kakaotalk account banned."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:17
-msgid "There have been recent reports (~2022-09-16) that **using this bridge may get your account banned**."
+#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:16
+msgid "Uninstalling the component manually"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:19
-msgid "Prerequisite (optional)"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:21
-msgid "Enable Shared Secret Auth"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:23
-msgid "If you want to set up [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do) for this bridge automatically, you need to have enabled [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:25
-msgid "See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-puppeting-optional) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about setting up Double Puppeting."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:27
-msgid "**Note**: double puppeting with the Shared Secret Auth works at the time of writing, but is deprecated and will stop working in the future."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:29
-msgid "Adjusting the playbook configuration"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:31
-msgid "To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:37
-msgid "Extending the configuration"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:39
-msgid "There are some additional things you may wish to configure about the bridge."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:41
-msgid "Take a look at:"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:43
-msgid "`roles/custom/matrix-bridge-appservice-kakaotalk/defaults/main.yml` for some variables that you can customize via your `vars.yml` file"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:44
-msgid "`roles/custom/matrix-bridge-appservice-kakaotalk/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_appservice_kakaotalk_configuration_extension_yaml` variable"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:46
-msgid "Installing"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:48
-msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:55
-msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:57
-msgid "`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:59
-msgid "Usage"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:61
-msgid "To use the bridge, you need to start a chat with `@kakaotalkbot:example.com` (where `example.com` is your base domain, not the `matrix.` domain)."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:63
-msgid "You then need to send `login --save EMAIL_OR_PHONE_NUMBER` to the bridge bot to enable bridging for your Kakaotalk account. The `--save` flag may be omitted, if you'd rather not save your password."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:65
-msgid "Troubleshooting"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:67
-msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-appservice-kakaotalk`."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:69
-msgid "Increase logging verbosity"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:71
-msgid "The default logging level for this component is `WARNING`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:"
+#: ../../../docs/configuring-playbook-bridge-appservice-kakaotalk.md:18
+msgid "If you still have matrix-appservice-kakaotalk installed on your Matrix server, the playbook can no longer help you uninstall it and you will need to do it manually. To uninstall manually, run these commands on the server:"
 msgstr ""

i18n/translation-templates/docs/configuring-playbook-bridge-beeper-line.pot

@@ -0,0 +1,153 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) 2018-2026, Slavi Pantaleev, Aine Etke, MDAD community members
+# This file is distributed under the same license as the matrix-docker-ansible-deploy package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: matrix-docker-ansible-deploy \n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2026-08-01 17:14+0000\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:7
+msgid "Setting up Beeper LINE bridging (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:9
+msgid "<sup>Refer to the common guide for configuring mautrix bridges: [Setting up a Generic Mautrix Bridge](configuring-playbook-bridge-mautrix-bridges.md)</sup>"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:11
+msgid "The playbook can install and configure [beeper-line](https://github.com/beeper/line) for you, for bridging to [LINE](https://line.me/)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:13
+msgid "See the project's [documentation](https://github.com/beeper/line/blob/main/README.md) to learn what it does and which features it supports."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:15
+msgid "Prerequisites"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:17
+msgid "Prepare your LINE account"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:19
+msgid "The bridge logs in with the email address configured in your LINE account. If your account does not have an email address, set one in the LINE mobile app under **Settings** → **Account** → **Email address** before trying to log in."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:21
+msgid "The bridge identifies itself to LINE as a Chrome Extension client. LINE only permits one active Chrome Extension session, so the bridge and the real LINE Chrome Extension cannot be used at the same time. Logging in with either one invalidates the other session."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:23
+msgid "Enable Appservice Double Puppet (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:25
+msgid "If you want to set up [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) for this bridge automatically, you need to have enabled [Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md) for this playbook."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:27
+msgid "See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-puppeting-optional) on the common mautrix bridge guide for details."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:29
+msgid "Adjusting the playbook configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:31
+msgid "To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:37
+msgid "Using another container image"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:39
+msgid "Upstream does not publish container images publicly, as its CI only pushes them to Beeper's private registry. The playbook therefore uses [`docker.io/crispyduck/beeper-line`](https://hub.docker.com/r/crispyduck/beeper-line) by default, which is a community-maintained image built from the upstream source."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:41
+msgid "That image is only available for the amd64 architecture. On other architectures, the playbook self-builds the image from source automatically."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:43
+msgid "To use an image that you have built and published elsewhere, override the complete image name:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:50
+msgid "The role can also build the bridge directly from a Git repository on the Matrix server:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:58
+msgid "Self-building requires more time and resources on the server than pulling a prebuilt image."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:60
+msgid "Extending the configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:62
+msgid "There are additional things you may wish to configure about the bridge."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:64
+msgid "See [this section](configuring-playbook-bridge-mautrix-bridges.md#extending-the-configuration) on the common mautrix bridge guide for details about variables that you can customize and the bridge's default configuration, including [bridge permissions](configuring-playbook-bridge-mautrix-bridges.md#configure-bridge-permissions-optional), [encryption support](configuring-playbook-bridge-mautrix-bridges.md#enable-encryption-optional), [relay mode](configuring-playbook-bridge-mautrix-bridges.md#enable-relay-mode-optional), and the [bot's username](configuring-playbook-bridge-mautrix-bridges.md#set-the-bots-username-optional)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:66
+msgid "When following the common guide, replace `_mautrix_SERVICENAME_` in variable names with `_beeper_line_`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:68
+msgid "Installing"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:70
+msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:76
+msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:78
+msgid "`just install-all` is useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove other components, run `just setup-all` so those components are uninstalled."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:80
+msgid "Usage"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:82
+msgid "To use the bridge, start a chat with `@linebot:example.com` (where `example.com` is your base domain, not the `matrix.` domain)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:84
+msgid "Send `login` and enter your LINE email address and password when prompted. The bridge then shows you a PIN code, which you need to enter into the LINE app on your mobile device to approve the new session."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:86
+msgid "Troubleshooting"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:88
+msgid "As with all other services, you can find the logs in systemd-journald by logging in to the server with SSH and running:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:94
+msgid "Increase logging verbosity"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-line.md:96
+msgid "The default logging level for this component is `warn`. To increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:"
+msgstr ""

i18n/translation-templates/docs/configuring-playbook-bridge-beeper-linkedin.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-08-01 17:14+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -17,109 +17,113 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:11
-msgid "Setting up Beeper Linkedin bridging (optional)"
+msgid "Setting up Beeper Linkedin bridging (optional, unmaintained)"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:13
-msgid "The playbook can install and configure [beeper-linkedin](https://github.com/beeper/linkedin) for you, for bridging to [LinkedIn](https://www.linkedin.com/) Messaging. This bridge is based on the mautrix-python framework and can be configured in a similar way to the mautrix bridges."
+msgid "**Note**: this bridge is unmaintained. Its [upstream repository](https://github.com/beeper/linkedin) has been archived and has not seen a change since March 2025. For bridging to LinkedIn, consider using the [mautrix-linkedin](configuring-playbook-bridge-mautrix-linkedin.md) bridge instead, which is actively maintained and also supported by the playbook."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:15
-msgid "See the project's [documentation](https://github.com/beeper/linkedin/blob/master/README.md) to learn what it does and why it might be useful to you."
+msgid "The playbook can install and configure [beeper-linkedin](https://github.com/beeper/linkedin) for you, for bridging to [LinkedIn](https://www.linkedin.com/) Messaging. This bridge is based on the mautrix-python framework and can be configured in a similar way to the mautrix bridges."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:17
-msgid "Prerequisite"
+msgid "See the project's [documentation](https://github.com/beeper/linkedin/blob/master/README.md) to learn what it does and why it might be useful to you."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:19
-msgid "Enable Appservice Double Puppet or Shared Secret Auth (optional)"
+msgid "Prerequisite"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:21
-msgid "If you want to set up [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do) for this bridge automatically, you need to have enabled [Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md) or [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) service for this playbook."
+msgid "Enable Appservice Double Puppet or Shared Secret Auth (optional)"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:23
-msgid "See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-puppeting-optional) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about setting up Double Puppeting."
+msgid "If you want to set up [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do) for this bridge automatically, you need to have enabled [Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md) or [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) service for this playbook."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:25
-msgid "**Note**: double puppeting with the Shared Secret Auth works at the time of writing, but is deprecated and will stop working in the future."
+msgid "See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-puppeting-optional) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about setting up Double Puppeting."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:27
-msgid "Adjusting the playbook configuration"
+msgid "**Note**: double puppeting with the Shared Secret Auth works at the time of writing, but is deprecated and will stop working in the future."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:29
+msgid "Adjusting the playbook configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:31
 msgid "To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:35
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:37
 msgid "Extending the configuration"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:37
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:39
 msgid "There are some additional things you may wish to configure about the bridge."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:39
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:41
 msgid "See [this section](configuring-playbook-bridge-mautrix-bridges.md#extending-the-configuration) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about variables that you can customize and the bridge's default configuration, including [bridge permissions](configuring-playbook-bridge-mautrix-bridges.md#configure-bridge-permissions-optional), [encryption support](configuring-playbook-bridge-mautrix-bridges.md#enable-encryption-optional), [relay mode](configuring-playbook-bridge-mautrix-bridges.md#enable-relay-mode-optional), [bot's username](configuring-playbook-bridge-mautrix-bridges.md#set-the-bots-username-optional), etc."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:41
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:43
 msgid "**Note**: when following the guide to configure the bridge, make sure to replace `_mautrix_SERVICENAME_` in the variable names with `_beeper_linkedin_`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:43
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:45
 msgid "Installing"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:45
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:47
 msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:52
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:54
 msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:54
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:56
 msgid "`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:56
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:58
 msgid "Usage"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:58
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:60
 msgid "To use the bridge, you need to start a chat with `@linkedinbot:example.com` (where `example.com` is your base domain, not the `matrix.` domain)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:60
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:62
 msgid "You then need to send `login YOUR_LINKEDIN_EMAIL_ADDRESS` to the bridge bot to enable bridging for your LinkedIn account."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:62
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:64
 msgid "Troubleshooting"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:64
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:66
 msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-beeper-linkedin`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:66
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:68
 msgid "Increase logging verbosity"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:68
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:70
 msgid "The default logging level for this component is `WARNING`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:74
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:76
 msgid "Bridge asking for 2FA even if you don't have 2FA enabled"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:76
+#: ../../../docs/configuring-playbook-bridge-beeper-linkedin.md:78
 msgid "If you don't have 2FA enabled and are logging in from a strange IP for the first time, LinkedIn will send an email with a one-time code. You can use this code to authorize the bridge session. In my experience, once the IP is authorized, you will not be asked again."
 msgstr ""