From 6be5672eac6aa29aafd09732a74a037c942865a0 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Wed, 3 Aug 2022 22:07:42 -0500
Subject: [PATCH 01/15] Adding support for Conduit: First temps: Some rough
 templates

---
 .../templates/conduit/conduit.toml.j2         | 52 +++++++++++++++++++
 .../conduit/systemd/matrix-conduit.service.j2 | 35 +++++++++++++
 2 files changed, 87 insertions(+)
 create mode 100644 roles/matrix-conduit/templates/conduit/conduit.toml.j2
 create mode 100644 roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2

diff --git a/roles/matrix-conduit/templates/conduit/conduit.toml.j2 b/roles/matrix-conduit/templates/conduit/conduit.toml.j2
new file mode 100644
index 00000000..a6819ef4
--- /dev/null
+++ b/roles/matrix-conduit/templates/conduit/conduit.toml.j2
@@ -0,0 +1,52 @@
+# =============================================================================
+#  This is the official example config for Conduit.
+#  If you use it for your server, you will need to adjust it to your own needs.
+#  At the very least, change the server_name field!
+# =============================================================================
+
+
+[global]
+# The server_name is the pretty name of this server. It is used as a suffix for user
+# and room ids. Examples: matrix.org, conduit.rs
+
+# The Conduit server needs all /_matrix/ requests to be reachable at
+# https://your.server.name/ on port 443 (client-server) and 8448 (federation).
+
+# If that's not possible for you, you can create /.well-known files to redirect
+# requests. See
+# https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client
+# and
+# https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server
+# for more information
+
+server_name = "{{ matrix_domain }}"
+
+# This is the only directory where Conduit will save its data
+database_path = "/var/lib/matrix-conduit/"
+database_backend = "rocksdb"
+
+# The port Conduit will be running on. You need to set up a reverse proxy in
+# your web server (e.g. apache or nginx), so all requests to /_matrix on port
+# 443 and 8448 will be forwarded to the Conduit instance running on this port
+# Docker users: Don't change this, you'll need to map an external port to this.
+port = {{ matrix_conduit_port_number }}
+
+# Max size for uploads
+max_request_size = {{ matrix_conduit_max_request_size }}
+
+# Enables registration. If set to false, no users can register on this server.
+allow_registration = {{ matrix_conduit_allow_registration }}
+
+allow_federation = {{ matrix_conduit_allow_federation }}
+
+# Enable the display name lightning bolt on registration.
+enable_lightning_bolt = {{ matrix_conduit_enable_lightning_bolt }}
+
+trusted_servers = {{ matrix_conduit_trusted_servers }}
+
+max_concurrent_requests = {{ matrix_conduit_max_concurrent_requests }}
+
+log = "info,state_res=warn,rocket=off,_=off,sled=off"
+
+address = "0.0.0.0"
+
diff --git a/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2 b/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
new file mode 100644
index 00000000..1254fcf1
--- /dev/null
+++ b/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
@@ -0,0 +1,35 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Conduit Matrix homeserver
+After=network.target
+
+[Service]
+Type=simple
+Environment="HOME={{ matrix_systemd_unit_home_path }}"
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-conduit 2>/dev/null || true'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-conduit 2>/dev/null || true'
+
+ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-conduit \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--read-only \
+			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_conduit_tmp_directory_size_mb }}m \
+			--network={{ matrix_docker_network }} \
+			-p 8448:6167 \
+			--mount type=bind,src={{ matrix_conduit_config_dir_path }},dst=/etc/matrix-conduit,ro \
+			--mount type=bind,src={{ matrix_conduit_data_dir_path }},dst=/var/lib/conduit \
+			{% for arg in matrix_conduit_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_conduit_docker_image }}
+
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-conduit 2>/dev/null || true'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-conduit 2>/dev/null || true'
+ExecReload={{ matrix_host_command_docker }} exec matrix-conduit /bin/sh -c 'kill -HUP 1'
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-conduit
+
+[Install]
+WantedBy=multi-user.target

From a5476e18571e9125c1c39ea5841f6adf1c74eb62 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Thu, 4 Aug 2022 12:36:13 -0500
Subject: [PATCH 02/15] Fixes to the conduit systemd config

---
 .../templates/conduit/systemd/matrix-conduit.service.j2     | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2 b/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
index 1254fcf1..195e5d58 100644
--- a/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
+++ b/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
@@ -1,7 +1,10 @@
 #jinja2: lstrip_blocks: "True"
 [Unit]
 Description=Conduit Matrix homeserver
-After=network.target
+{% for service in matrix_conduit_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
 
 [Service]
 Type=simple
@@ -16,7 +19,6 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-conduit \
 			--read-only \
 			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_conduit_tmp_directory_size_mb }}m \
 			--network={{ matrix_docker_network }} \
-			-p 8448:6167 \
 			--mount type=bind,src={{ matrix_conduit_config_dir_path }},dst=/etc/matrix-conduit,ro \
 			--mount type=bind,src={{ matrix_conduit_data_dir_path }},dst=/var/lib/conduit \
 			{% for arg in matrix_conduit_container_extra_arguments %}

From c484c6294d35ec36000a3a2936e758f1b15bc56b Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Thu, 4 Aug 2022 12:37:08 -0500
Subject: [PATCH 03/15] First pass at creating defaults and tasks for Conduit

---
 roles/matrix-conduit/defaults/main.yml        | 49 +++++++++++++++++++
 roles/matrix-conduit/tasks/conduit/setup.yml  |  7 +++
 .../tasks/conduit/setup_install.yml           | 31 ++++++++++++
 .../tasks/conduit/setup_uninstall.yml         | 30 ++++++++++++
 roles/matrix-conduit/tasks/init.yml           |  5 ++
 roles/matrix-conduit/tasks/main.yml           | 17 +++++++
 roles/matrix-conduit/tasks/setup_conduit.yml  | 14 ++++++
 7 files changed, 153 insertions(+)
 create mode 100644 roles/matrix-conduit/defaults/main.yml
 create mode 100644 roles/matrix-conduit/tasks/conduit/setup.yml
 create mode 100644 roles/matrix-conduit/tasks/conduit/setup_install.yml
 create mode 100644 roles/matrix-conduit/tasks/conduit/setup_uninstall.yml
 create mode 100644 roles/matrix-conduit/tasks/init.yml
 create mode 100644 roles/matrix-conduit/tasks/main.yml
 create mode 100644 roles/matrix-conduit/tasks/setup_conduit.yml

diff --git a/roles/matrix-conduit/defaults/main.yml b/roles/matrix-conduit/defaults/main.yml
new file mode 100644
index 00000000..a4a9289d
--- /dev/null
+++ b/roles/matrix-conduit/defaults/main.yml
@@ -0,0 +1,49 @@
+---
+# Conduit is a simple, fast and reliable chat server powered by Matrix
+# See: https://conduit.rs
+
+matrix_conduit_enabled: true
+
+matrix_conduit_docker_image: "{{ matrix_conduit_docker_image_name_prefix}}matrixconduit/matrix-conduit:{{ matrix_conduit_docker_image_tag }}"
+matrix_conduit_docker_image_name_prefix: "docker.io/"
+matrix_conduit_docker_image_tag: "v0.4.0"
+matrix_conduit_docker_image_force_pull: "{{ matrix_conduit_docker_image.endswith(':latest') }}"
+
+matrix_conduit_base_path: "{{ matrix_base_data_path }}/conduit"
+matrix_conduit_config_dir_path: "{{ matrix_conduit_base_path }}/config"
+matrix_conduit_storage_path: "{{ matrix_conduit_base_path }}/storage"
+
+matrix_conduit_port_number: 6167
+
+# List of systemd services that matrix-conduit.service depends on
+matrix_conduit_systemd_required_services_list: ["docker.service"]
+
+# List of systemd services that matrix-conduit.service wants
+matrix_conduit_systemd_wanted_services_list: []
+
+# Extra arguments for the Docker container
+matrix_conduit_container_extra_arguments: []
+
+# Specifies which template files to use when configuring Conduit.
+# If you'd like to have your own different configuration, feel free to copy and paste
+# the original files into your inventory (e.g. in `inventory/host_vars/<host>/`)
+# and then change the specific host's `vars.yaml` file like this:
+# matrix_conduit_template_conduit_config: "{{ playbook_dir }}/inventory/host_vars/<host>/conduit.yaml.j2"
+matrix_conduit_template_conduit_config: "{{ role_path }}/templates/conduit/conduit.toml.j2"
+
+# Max size for uploads, in bytes
+matrix_conduit_max_request_size: "20_000_000"
+
+# Enables registration. If set to false, no users can register on this server.
+matrix_conduit_allow_registration: true
+
+matrix_conduit_allow_federation: true
+
+# Enable the display name lightning bolt on registration.
+matrix_conduit_enable_lightning_bolt: true
+
+matrix_conduit_trusted_servers:
+ - "matrix.org"
+
+# How many requests Conduit sends to other servers at the same time
+matrix_conduit_max_concurrent_requests: 100
diff --git a/roles/matrix-conduit/tasks/conduit/setup.yml b/roles/matrix-conduit/tasks/conduit/setup.yml
new file mode 100644
index 00000000..57aaafdf
--- /dev/null
+++ b/roles/matrix-conduit/tasks/conduit/setup.yml
@@ -0,0 +1,7 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/conduit/setup_install.yml"
+  when: matrix_conduit_enabled|bool
+
+- import_tasks: "{{ role_path }}/tasks/conduit/setup_uninstall.yml"
+  when: "not matrix_conduit_enabled|bool"
diff --git a/roles/matrix-conduit/tasks/conduit/setup_install.yml b/roles/matrix-conduit/tasks/conduit/setup_install.yml
new file mode 100644
index 00000000..9fd933c7
--- /dev/null
+++ b/roles/matrix-conduit/tasks/conduit/setup_install.yml
@@ -0,0 +1,31 @@
+---
+- name: Ensure Conduit Docker image is pulled
+  docker_image:
+    name: "{{ matrix_conduit_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_conduit_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_conduit_docker_image_force_pull }}"
+  register: result
+  retries: "{{ matrix_container_retries_count }}"
+  delay: "{{ matrix_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure Conduit configuration installed
+  template:
+    src: "{{ role_path }}/templates/conduit/conduit.toml.j2"
+    dest: "{{ matrix_conduit_config_dir_path }}/conduit.toml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure matrix-conduit.service installed
+  template:
+    src: "{{ role_path }}/templates/conduit/systemd/matrix-conduit.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-conduit.service"
+    mode: 0644
+  register: matrix_conduit_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-conduit.service installation
+  service:
+    daemon_reload: true
+  when: "matrix_conduit_systemd_service_result.changed|bool"
diff --git a/roles/matrix-conduit/tasks/conduit/setup_uninstall.yml b/roles/matrix-conduit/tasks/conduit/setup_uninstall.yml
new file mode 100644
index 00000000..73722287
--- /dev/null
+++ b/roles/matrix-conduit/tasks/conduit/setup_uninstall.yml
@@ -0,0 +1,30 @@
+---
+
+- name: Check existence of matrix-conduit service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-conduit.service"
+  register: matrix_conduit_service_stat
+
+- name: Ensure matrix-conduit is stopped
+  service:
+    name: matrix-conduit
+    state: stopped
+    daemon_reload: true
+  register: stopping_result
+  when: "matrix_conduit_service_stat.stat.exists"
+
+- name: Ensure matrix-conduit.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-conduit.service"
+    state: absent
+  when: "matrix_conduit_service_stat.stat.exists"
+
+- name: Ensure systemd reloaded after matrix-conduit.service removal
+  service:
+    daemon_reload: true
+  when: "matrix_conduit_service_stat.stat.exists"
+
+- name: Ensure Conduit Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_conduit_docker_image }}"
+    state: absent
diff --git a/roles/matrix-conduit/tasks/init.yml b/roles/matrix-conduit/tasks/init.yml
new file mode 100644
index 00000000..464278b7
--- /dev/null
+++ b/roles/matrix-conduit/tasks/init.yml
@@ -0,0 +1,5 @@
+---
+
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-conduit.service'] }}"
+  when: matrix_conduit_enabled|bool
diff --git a/roles/matrix-conduit/tasks/main.yml b/roles/matrix-conduit/tasks/main.yml
new file mode 100644
index 00000000..8ace5f48
--- /dev/null
+++ b/roles/matrix-conduit/tasks/main.yml
@@ -0,0 +1,17 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- import_tasks: "{{ role_path }}/tasks/setup_conduit.yml"
+  when: run_setup|bool
+  tags:
+    - setup-all
+    - setup-conduit
+
+- name: Mark matrix-conduit role as executed
+  set_fact:
+    matrix_conduit_role_executed: true
+  tags:
+    - always
diff --git a/roles/matrix-conduit/tasks/setup_conduit.yml b/roles/matrix-conduit/tasks/setup_conduit.yml
new file mode 100644
index 00000000..7979aee4
--- /dev/null
+++ b/roles/matrix-conduit/tasks/setup_conduit.yml
@@ -0,0 +1,14 @@
+---
+- name: Ensure Conduit paths exist
+  file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_conduit_config_dir_path }}", when: true}
+    - {path: "{{ matrix_conduit_data_dir_path }}", when: true}
+  when: "matrix_conduit_enabled|bool and item.when"
+
+- import_tasks: "{{ role_path }}/tasks/conduit/setup.yml"

From f4afbe8edec3dd08926d1dfd3faaf6b23ab91883 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Thu, 4 Aug 2022 12:39:26 -0500
Subject: [PATCH 04/15] First pass at adding vars for Conduit

---
 roles/matrix-conduit/vars/main.yml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 roles/matrix-conduit/vars/main.yml

diff --git a/roles/matrix-conduit/vars/main.yml b/roles/matrix-conduit/vars/main.yml
new file mode 100644
index 00000000..f6cc471b
--- /dev/null
+++ b/roles/matrix-conduit/vars/main.yml
@@ -0,0 +1,6 @@
+---
+matrix_conduit_client_api_url_endpoint_public: "https://{{ matrix_server_fqn_matrix }}/_matrix/client/versions"
+matrix_conduit_federation_api_url_endpoint_public: "https://{{ matrix_server_fqn_matrix }}:{{ matrix_federation_public_port }}/_matrix/federation/v1/version"
+
+# Tells whether this role had executed or not. Toggled to `true` during runtime.
+matrix_conduit_role_executed: false

From 2d7c427504410199d81c278dccf000b1c8def936 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Thu, 4 Aug 2022 13:16:32 -0500
Subject: [PATCH 05/15] Fixes from a first trial run

---
 roles/matrix-conduit/defaults/main.yml                      | 4 +++-
 roles/matrix-conduit/templates/conduit/conduit.toml.j2      | 6 +++---
 .../templates/conduit/systemd/matrix-conduit.service.j2     | 3 ++-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/roles/matrix-conduit/defaults/main.yml b/roles/matrix-conduit/defaults/main.yml
index a4a9289d..05746651 100644
--- a/roles/matrix-conduit/defaults/main.yml
+++ b/roles/matrix-conduit/defaults/main.yml
@@ -11,10 +11,12 @@ matrix_conduit_docker_image_force_pull: "{{ matrix_conduit_docker_image.endswith
 
 matrix_conduit_base_path: "{{ matrix_base_data_path }}/conduit"
 matrix_conduit_config_dir_path: "{{ matrix_conduit_base_path }}/config"
-matrix_conduit_storage_path: "{{ matrix_conduit_base_path }}/storage"
+matrix_conduit_data_dir_path: "{{ matrix_conduit_base_path }}/storage"
 
 matrix_conduit_port_number: 6167
 
+matrix_conduit_tmp_directory_size_mb: 500
+
 # List of systemd services that matrix-conduit.service depends on
 matrix_conduit_systemd_required_services_list: ["docker.service"]
 
diff --git a/roles/matrix-conduit/templates/conduit/conduit.toml.j2 b/roles/matrix-conduit/templates/conduit/conduit.toml.j2
index a6819ef4..f92910e1 100644
--- a/roles/matrix-conduit/templates/conduit/conduit.toml.j2
+++ b/roles/matrix-conduit/templates/conduit/conduit.toml.j2
@@ -35,12 +35,12 @@ port = {{ matrix_conduit_port_number }}
 max_request_size = {{ matrix_conduit_max_request_size }}
 
 # Enables registration. If set to false, no users can register on this server.
-allow_registration = {{ matrix_conduit_allow_registration }}
+allow_registration = {{ matrix_conduit_allow_registration | to_json | replace("\"", "") }}
 
-allow_federation = {{ matrix_conduit_allow_federation }}
+allow_federation = {{ matrix_conduit_allow_federation | to_json | replace("\"", "") }}
 
 # Enable the display name lightning bolt on registration.
-enable_lightning_bolt = {{ matrix_conduit_enable_lightning_bolt }}
+enable_lightning_bolt = {{ matrix_conduit_enable_lightning_bolt | to_json | replace("\"", "") }}
 
 trusted_servers = {{ matrix_conduit_trusted_servers }}
 
diff --git a/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2 b/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
index 195e5d58..2d4d2453 100644
--- a/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
+++ b/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
@@ -19,8 +19,9 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-conduit \
 			--read-only \
 			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_conduit_tmp_directory_size_mb }}m \
 			--network={{ matrix_docker_network }} \
+			--env CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml \
+			--mount type=bind,src={{ matrix_conduit_data_dir_path }},dst=/var/lib/matrix-conduit \
 			--mount type=bind,src={{ matrix_conduit_config_dir_path }},dst=/etc/matrix-conduit,ro \
-			--mount type=bind,src={{ matrix_conduit_data_dir_path }},dst=/var/lib/conduit \
 			{% for arg in matrix_conduit_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}

From c228ad451d9e5cc589338773d1c2337e855cc879 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Thu, 4 Aug 2022 13:25:18 -0500
Subject: [PATCH 06/15] Updates to conduit paths

---
 roles/matrix-conduit/defaults/main.yml           |  4 ++--
 .../tasks/conduit/setup_install.yml              |  2 +-
 roles/matrix-conduit/tasks/setup_conduit.yml     | 16 ++++++++++++++--
 .../conduit/systemd/matrix-conduit.service.j2    |  4 ++--
 4 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/roles/matrix-conduit/defaults/main.yml b/roles/matrix-conduit/defaults/main.yml
index 05746651..f71f6f10 100644
--- a/roles/matrix-conduit/defaults/main.yml
+++ b/roles/matrix-conduit/defaults/main.yml
@@ -10,8 +10,8 @@ matrix_conduit_docker_image_tag: "v0.4.0"
 matrix_conduit_docker_image_force_pull: "{{ matrix_conduit_docker_image.endswith(':latest') }}"
 
 matrix_conduit_base_path: "{{ matrix_base_data_path }}/conduit"
-matrix_conduit_config_dir_path: "{{ matrix_conduit_base_path }}/config"
-matrix_conduit_data_dir_path: "{{ matrix_conduit_base_path }}/storage"
+matrix_conduit_config_path: "{{ matrix_conduit_base_path }}/config"
+matrix_conduit_data_path: "{{ matrix_conduit_base_path }}/storage"
 
 matrix_conduit_port_number: 6167
 
diff --git a/roles/matrix-conduit/tasks/conduit/setup_install.yml b/roles/matrix-conduit/tasks/conduit/setup_install.yml
index 9fd933c7..5611e3e3 100644
--- a/roles/matrix-conduit/tasks/conduit/setup_install.yml
+++ b/roles/matrix-conduit/tasks/conduit/setup_install.yml
@@ -13,7 +13,7 @@
 - name: Ensure Conduit configuration installed
   template:
     src: "{{ role_path }}/templates/conduit/conduit.toml.j2"
-    dest: "{{ matrix_conduit_config_dir_path }}/conduit.toml"
+    dest: "{{ matrix_conduit_config_path }}/conduit.toml"
     mode: 0644
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
diff --git a/roles/matrix-conduit/tasks/setup_conduit.yml b/roles/matrix-conduit/tasks/setup_conduit.yml
index 7979aee4..17738b17 100644
--- a/roles/matrix-conduit/tasks/setup_conduit.yml
+++ b/roles/matrix-conduit/tasks/setup_conduit.yml
@@ -7,8 +7,20 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
   with_items:
-    - {path: "{{ matrix_conduit_config_dir_path }}", when: true}
-    - {path: "{{ matrix_conduit_data_dir_path }}", when: true}
+    - {path: "{{ matrix_conduit_config_path }}", when: true}
+    - {path: "{{ matrix_conduit_data_path }}", when: true}
   when: "matrix_conduit_enabled|bool and item.when"
 
+# We do this as a separate task, because:
+# - we'd like to do it for the data path only, not for the base path (which contains root-owned environment variable files we'd like to leave as-is)
+# - matrix-postgres does something similar
+- name: Ensure Conduit data path ownership is correct
+  file:
+    path: "{{ matrix_conduit_data_path }}"
+    state: directory
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    recurse: true
+  when: matrix_conduit_enabled|bool
+
 - import_tasks: "{{ role_path }}/tasks/conduit/setup.yml"
diff --git a/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2 b/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
index 2d4d2453..51b204f6 100644
--- a/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
+++ b/roles/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2
@@ -20,8 +20,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-conduit \
 			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_conduit_tmp_directory_size_mb }}m \
 			--network={{ matrix_docker_network }} \
 			--env CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml \
-			--mount type=bind,src={{ matrix_conduit_data_dir_path }},dst=/var/lib/matrix-conduit \
-			--mount type=bind,src={{ matrix_conduit_config_dir_path }},dst=/etc/matrix-conduit,ro \
+			--mount type=bind,src={{ matrix_conduit_data_path }},dst=/var/lib/matrix-conduit \
+			--mount type=bind,src={{ matrix_conduit_config_path }},dst=/etc/matrix-conduit,ro \
 			{% for arg in matrix_conduit_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}

From 50c4c48f09c137e354c20ee4cb6312322f3ed96f Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Thu, 4 Aug 2022 13:31:28 -0500
Subject: [PATCH 07/15] Rename storage directory to data

---
 roles/matrix-conduit/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-conduit/defaults/main.yml b/roles/matrix-conduit/defaults/main.yml
index f71f6f10..94d1fcfa 100644
--- a/roles/matrix-conduit/defaults/main.yml
+++ b/roles/matrix-conduit/defaults/main.yml
@@ -11,7 +11,7 @@ matrix_conduit_docker_image_force_pull: "{{ matrix_conduit_docker_image.endswith
 
 matrix_conduit_base_path: "{{ matrix_base_data_path }}/conduit"
 matrix_conduit_config_path: "{{ matrix_conduit_base_path }}/config"
-matrix_conduit_data_path: "{{ matrix_conduit_base_path }}/storage"
+matrix_conduit_data_path: "{{ matrix_conduit_base_path }}/data"
 
 matrix_conduit_port_number: 6167
 

From 53cf0e18a4ee8d4eab691c78884c83e019f066e2 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Thu, 4 Aug 2022 13:32:01 -0500
Subject: [PATCH 08/15] Actually make the data dir writable this time

---
 roles/matrix-conduit/tasks/setup_conduit.yml | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/roles/matrix-conduit/tasks/setup_conduit.yml b/roles/matrix-conduit/tasks/setup_conduit.yml
index 17738b17..25632c80 100644
--- a/roles/matrix-conduit/tasks/setup_conduit.yml
+++ b/roles/matrix-conduit/tasks/setup_conduit.yml
@@ -1,26 +1,20 @@
 ---
-- name: Ensure Conduit paths exist
+- name: Ensure Conduit config path exists
   file:
-    path: "{{ item.path }}"
+    path: "{{ matrix_conduit_config_path }}"
     state: directory
     mode: 0750
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
-  with_items:
-    - {path: "{{ matrix_conduit_config_path }}", when: true}
-    - {path: "{{ matrix_conduit_data_path }}", when: true}
-  when: "matrix_conduit_enabled|bool and item.when"
+  when: "matrix_conduit_enabled|bool"
 
-# We do this as a separate task, because:
-# - we'd like to do it for the data path only, not for the base path (which contains root-owned environment variable files we'd like to leave as-is)
-# - matrix-postgres does something similar
-- name: Ensure Conduit data path ownership is correct
+- name: Ensure Conduit data path exists
   file:
     path: "{{ matrix_conduit_data_path }}"
     state: directory
+    mode: 0770
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
-    recurse: true
-  when: matrix_conduit_enabled|bool
+  when: "matrix_conduit_enabled|bool"
 
 - import_tasks: "{{ role_path }}/tasks/conduit/setup.yml"

From 20767b514913c1289a3d7a48a890e34511b7e945 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Thu, 4 Aug 2022 14:35:41 -0500
Subject: [PATCH 09/15] Fixes to enable Conduit in setup-all

---
 group_vars/matrix_servers                     | 31 ++++++++
 roles/matrix-base/defaults/main.yml           |  2 +-
 roles/matrix-base/tasks/sanity_check.yml      |  2 +-
 roles/matrix-conduit/defaults/main.yml        |  2 +-
 roles/matrix-nginx-proxy/defaults/main.yml    | 15 ++++
 .../tasks/setup_nginx_proxy.yml               | 13 ++++
 .../nginx/conf.d/matrix-conduit.conf.j2       | 77 +++++++++++++++++++
 setup.yml                                     |  1 +
 8 files changed, 140 insertions(+), 3 deletions(-)
 create mode 100644 roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-conduit.conf.j2

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 91324025..ed64c0a4 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -24,6 +24,7 @@ matrix_homeserver_container_url: |-
     'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else {
       'synapse': ('http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string),
       'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
+      'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string),
     }[matrix_homeserver_implementation]
   }}
 
@@ -32,6 +33,7 @@ matrix_homeserver_container_federation_url: |-
     'http://matrix-nginx-proxy:12088' if matrix_nginx_proxy_enabled else {
       'synapse': ('http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port|string),
       'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
+      'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string),
     }[matrix_homeserver_implementation]
   }}
 
@@ -1432,6 +1434,7 @@ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: |-
     {
       'synapse': matrix_synapse_max_upload_size_mb,
       'dendrite': (matrix_dendrite_max_file_size_bytes / 1024 / 1024) | round,
+      'conduit': (matrix_conduit_max_request_size / 1024 / 1024) | round,
     }[matrix_homeserver_implementation]|int
   }}
 
@@ -1464,6 +1467,7 @@ matrix_nginx_proxy_proxy_matrix_federation_api_enabled: |-
     {
       'synapse': (matrix_synapse_federation_port_enabled and not matrix_synapse_tls_federation_listener_enabled),
       'dendrite': matrix_dendrite_federation_enabled,
+      'conduit': matrix_conduit_allow_federation,
     }[matrix_homeserver_implementation]|bool
   }}
 
@@ -1482,6 +1486,12 @@ matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container: "127.0.0.1:{{
 matrix_nginx_proxy_proxy_dendrite_federation_api_addr_with_container: "matrix-dendrite:{{ matrix_dendrite_http_bind_port|string }}"
 matrix_nginx_proxy_proxy_dendrite_federation_api_addr_sans_container: "127.0.0.1:{{ matrix_dendrite_http_bind_port|string }}"
 
+matrix_nginx_proxy_proxy_conduit_enabled: "{{ matrix_conduit_enabled }}"
+matrix_nginx_proxy_proxy_conduit_client_api_addr_with_container: "matrix-conduit:{{ matrix_conduit_port_number|string }}"
+matrix_nginx_proxy_proxy_conduit_client_api_addr_sans_container: "127.0.0.1:{{ matrix_conduit_port_number|string }}"
+matrix_nginx_proxy_proxy_conduit_federation_api_addr_with_container: "matrix-conduit:{{ matrix_conduit_port_number|string }}"
+matrix_nginx_proxy_proxy_conduit_federation_api_addr_sans_container: "127.0.0.1:{{ matrix_conduit_port_number|string }}"
+
 # When matrix-nginx-proxy is disabled, the actual port number that the vhost uses may begin to matter.
 matrix_nginx_proxy_proxy_matrix_federation_port: "{{ matrix_federation_public_port }}"
 
@@ -2211,6 +2221,7 @@ matrix_registration_shared_secret: |-
     {
       'synapse': matrix_synapse_registration_shared_secret,
       'dendrite': matrix_dendrite_registration_shared_secret,
+      'conduit': ''
     }[matrix_homeserver_implementation]
   }}
 
@@ -2331,3 +2342,23 @@ matrix_dendrite_systemd_wanted_services_list: |
 # /matrix-dendrite
 #
 ######################################################################
+
+######################################################################
+#
+# matrix-conduit
+#
+######################################################################
+
+matrix_conduit_enabled: "{{ matrix_homeserver_implementation == 'conduit' }}"
+
+matrix_conduit_systemd_required_services_list: |
+  {{
+    (['docker.service'])
+  }}
+
+
+######################################################################
+#
+# /matrix-conduit
+#
+######################################################################
diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml
index ae39d00a..9d0ded4a 100644
--- a/roles/matrix-base/defaults/main.yml
+++ b/roles/matrix-base/defaults/main.yml
@@ -9,7 +9,7 @@
 matrix_domain: ~
 
 # This will contain the homeserver implementation that is in use.
-# Valid values: synapse, dendrite
+# Valid values: synapse, dendrite, conduit
 #
 # By default, we use Synapse, because it's the only full-featured Matrix server at the moment.
 #
diff --git a/roles/matrix-base/tasks/sanity_check.yml b/roles/matrix-base/tasks/sanity_check.yml
index f78510d7..ad3d35d6 100644
--- a/roles/matrix-base/tasks/sanity_check.yml
+++ b/roles/matrix-base/tasks/sanity_check.yml
@@ -3,7 +3,7 @@
 - name: Fail if invalid homeserver implementation
   fail:
     msg: "You need to set a valid homeserver implementation in `matrix_homeserver_implementation`"
-  when: "matrix_homeserver_implementation not in ['synapse', 'dendrite']"
+  when: "matrix_homeserver_implementation not in ['synapse', 'dendrite', 'conduit']"
 
 # We generally support Ansible 2.7.1 and above.
 - name: Fail if running on Ansible < 2.7.1
diff --git a/roles/matrix-conduit/defaults/main.yml b/roles/matrix-conduit/defaults/main.yml
index 94d1fcfa..9ee83282 100644
--- a/roles/matrix-conduit/defaults/main.yml
+++ b/roles/matrix-conduit/defaults/main.yml
@@ -34,7 +34,7 @@ matrix_conduit_container_extra_arguments: []
 matrix_conduit_template_conduit_config: "{{ role_path }}/templates/conduit/conduit.toml.j2"
 
 # Max size for uploads, in bytes
-matrix_conduit_max_request_size: "20_000_000"
+matrix_conduit_max_request_size: 20_000_000
 
 # Enables registration. If set to false, no users can register on this server.
 matrix_conduit_allow_registration: true
diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml
index de1a3146..8d606273 100644
--- a/roles/matrix-nginx-proxy/defaults/main.yml
+++ b/roles/matrix-nginx-proxy/defaults/main.yml
@@ -147,6 +147,21 @@ matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container: ""
 # A list of strings containing additional configuration blocks to add to the Dendrite's server configuration (matrix-dendrite.conf).
 matrix_nginx_proxy_proxy_dendrite_additional_server_configuration_blocks: []
 
+# Controls whether proxying for Conduit should be done.
+matrix_nginx_proxy_proxy_conduit_enabled: false
+matrix_nginx_proxy_proxy_conduit_hostname: "matrix-nginx-proxy"
+matrix_nginx_proxy_proxy_conduit_federation_api_enabled: "{{ matrix_nginx_proxy_proxy_matrix_federation_api_enabled }}"
+# Controls whether the Client API server (usually at matrix.DOMAIN:443) should explicitly reject `/_matrix/federation` endpoints.
+matrix_nginx_proxy_proxy_conduit_block_federation_api_on_client_port: true
+# The addresses where the Matrix Client API is, when using Conduit.
+matrix_nginx_proxy_proxy_conduit_client_api_addr_with_container: ""
+matrix_nginx_proxy_proxy_conduit_client_api_addr_sans_container: ""
+# The addresses where the Federation API is, when using Conduit.
+matrix_nginx_proxy_proxy_conduit_federation_api_addr_with_container: ""
+matrix_nginx_proxy_proxy_conduit_federation_api_addr_sans_container: ""
+# A list of strings containing additional configuration blocks to add to the Conduit's server configuration (matrix-conduit.conf).
+matrix_nginx_proxy_proxy_conduit_additional_server_configuration_blocks: []
+
 # Controls whether proxying the Element domain should be done.
 matrix_nginx_proxy_proxy_element_enabled: false
 matrix_nginx_proxy_proxy_element_hostname: "{{ matrix_server_fqn_element }}"
diff --git a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
index 92454e96..c546a083 100644
--- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
+++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
@@ -80,6 +80,19 @@
     state: absent
   when: "not matrix_nginx_proxy_proxy_dendrite_enabled|bool"
 
+- name: Ensure Matrix nginx-proxy configuration for matrix-conduit exists
+  template:
+    src: "{{ role_path }}/templates/nginx/conf.d/matrix-conduit.conf.j2"
+    dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-conduit.conf"
+    mode: 0644
+  when: matrix_nginx_proxy_proxy_conduit_enabled|bool
+
+- name: Ensure Matrix nginx-proxy configuration for matrix-conduit deleted
+  file:
+    path: "{{ matrix_nginx_proxy_confd_path }}/matrix-conduit.conf"
+    state: absent
+  when: "not matrix_nginx_proxy_proxy_conduit_enabled|bool"
+
 - name: Ensure Matrix nginx-proxy configuration for Element domain exists
   template:
     src: "{{ role_path }}/templates/nginx/conf.d/matrix-client-element.conf.j2"
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-conduit.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-conduit.conf.j2
new file mode 100644
index 00000000..2106acc4
--- /dev/null
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-conduit.conf.j2
@@ -0,0 +1,77 @@
+#jinja2: lstrip_blocks: "True"
+
+server {
+	listen 12080;
+	server_name {{ matrix_nginx_proxy_proxy_conduit_hostname }};
+
+	server_tokens off;
+	root /dev/null;
+
+	gzip on;
+	gzip_types text/plain application/json;
+
+	{% for configuration_block in matrix_nginx_proxy_proxy_conduit_additional_server_configuration_blocks %}
+		{{- configuration_block }}
+	{% endfor %}
+
+	{% if matrix_nginx_proxy_proxy_conduit_block_federation_api_on_client_port %}
+	location /_matrix/federation {
+		{% if matrix_nginx_proxy_proxy_conduit_federation_api_enabled %}
+			return 404 'The Federation API is served at https://{{ matrix_server_fqn_matrix }}:{{ matrix_federation_public_port }}';
+		{% else %}
+			return 404 'This Matrix server is running with federation disabled';
+		{% endif %}
+	}
+	{% endif %}
+
+	{# Everything else just goes to the API server ##}
+	location / {
+		{% if matrix_nginx_proxy_enabled %}
+			{# Use the embedded DNS resolver in Docker containers to discover the service #}
+			resolver 127.0.0.11 valid=5s;
+			set $backend "{{ matrix_nginx_proxy_proxy_conduit_client_api_addr_with_container }}";
+			proxy_pass http://$backend;
+		{% else %}
+			{# Generic configuration for use outside of our container setup #}
+			proxy_pass http://{{ matrix_nginx_proxy_proxy_conduit_client_api_addr_sans_container }};
+		{% endif %}
+
+		proxy_set_header Host $host;
+
+		client_body_buffer_size 25M;
+		client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb }}M;
+		proxy_max_temp_file_size 0;
+	}
+}
+
+{% if matrix_nginx_proxy_proxy_conduit_federation_api_enabled %}
+server {
+	listen 12088;
+
+	server_name {{ matrix_nginx_proxy_proxy_conduit_hostname }};
+	server_tokens off;
+
+	root /dev/null;
+
+	gzip on;
+	gzip_types text/plain application/json;
+
+	location / {
+		{% if matrix_nginx_proxy_enabled %}
+			{# Use the embedded DNS resolver in Docker containers to discover the service #}
+			resolver 127.0.0.11 valid=5s;
+			set $backend "{{ matrix_nginx_proxy_proxy_conduit_federation_api_addr_with_container }}";
+			proxy_pass http://$backend;
+		{% else %}
+			{# Generic configuration for use outside of our container setup #}
+			proxy_pass http://{{ matrix_nginx_proxy_proxy_conduit_federation_api_addr_sans_container }};
+		{% endif %}
+
+		proxy_set_header Host $host;
+
+		client_body_buffer_size 25M;
+		client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb }}M;
+		proxy_max_temp_file_size 0;
+	}
+}
+{% endif %}
diff --git a/setup.yml b/setup.yml
index de86665b..82429d43 100755
--- a/setup.yml
+++ b/setup.yml
@@ -42,6 +42,7 @@
     - matrix-bot-mjolnir
     - matrix-synapse
     - matrix-dendrite
+    - matrix-conduit
     - matrix-synapse-admin
     - matrix-prometheus-node-exporter
     - matrix-prometheus

From dffa91ec8e0a3a92e10ef58c932956aca3172fcd Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@fastmail.com>
Date: Fri, 5 Aug 2022 09:01:59 -0500
Subject: [PATCH 10/15] Suggested fix from spantaleev

Co-authored-by: Slavi Pantaleev <slavi@devture.com>
---
 group_vars/matrix_servers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index ed64c0a4..365ecd47 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -2221,7 +2221,7 @@ matrix_registration_shared_secret: |-
     {
       'synapse': matrix_synapse_registration_shared_secret,
       'dendrite': matrix_dendrite_registration_shared_secret,
-      'conduit': ''
+      'conduit': '',
     }[matrix_homeserver_implementation]
   }}
 

From 47caba38fb1de77288a90afd04b9626cfacd74f6 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Fri, 5 Aug 2022 09:59:35 -0500
Subject: [PATCH 11/15] Implemented suggestions from Slavi

---
 roles/matrix-conduit/tasks/conduit/setup.yml  | 18 +++++++++++++++++
 roles/matrix-conduit/tasks/main.yml           |  2 +-
 roles/matrix-conduit/tasks/setup_conduit.yml  | 20 -------------------
 .../templates/conduit/conduit.toml.j2         |  8 ++++----
 4 files changed, 23 insertions(+), 25 deletions(-)
 delete mode 100644 roles/matrix-conduit/tasks/setup_conduit.yml

diff --git a/roles/matrix-conduit/tasks/conduit/setup.yml b/roles/matrix-conduit/tasks/conduit/setup.yml
index 57aaafdf..055fbd27 100644
--- a/roles/matrix-conduit/tasks/conduit/setup.yml
+++ b/roles/matrix-conduit/tasks/conduit/setup.yml
@@ -1,5 +1,23 @@
 ---
 
+- name: Ensure Conduit config path exists
+  file:
+    path: "{{ matrix_conduit_config_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  when: "matrix_conduit_enabled|bool"
+
+- name: Ensure Conduit data path exists
+  file:
+    path: "{{ matrix_conduit_data_path }}"
+    state: directory
+    mode: 0770
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  when: "matrix_conduit_enabled|bool"
+
 - import_tasks: "{{ role_path }}/tasks/conduit/setup_install.yml"
   when: matrix_conduit_enabled|bool
 
diff --git a/roles/matrix-conduit/tasks/main.yml b/roles/matrix-conduit/tasks/main.yml
index 8ace5f48..20d91ac8 100644
--- a/roles/matrix-conduit/tasks/main.yml
+++ b/roles/matrix-conduit/tasks/main.yml
@@ -4,7 +4,7 @@
   tags:
     - always
 
-- import_tasks: "{{ role_path }}/tasks/setup_conduit.yml"
+- import_tasks: "{{ role_path }}/tasks/conduit/setup.yml"
   when: run_setup|bool
   tags:
     - setup-all
diff --git a/roles/matrix-conduit/tasks/setup_conduit.yml b/roles/matrix-conduit/tasks/setup_conduit.yml
deleted file mode 100644
index 25632c80..00000000
--- a/roles/matrix-conduit/tasks/setup_conduit.yml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-- name: Ensure Conduit config path exists
-  file:
-    path: "{{ matrix_conduit_config_path }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-  when: "matrix_conduit_enabled|bool"
-
-- name: Ensure Conduit data path exists
-  file:
-    path: "{{ matrix_conduit_data_path }}"
-    state: directory
-    mode: 0770
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-  when: "matrix_conduit_enabled|bool"
-
-- import_tasks: "{{ role_path }}/tasks/conduit/setup.yml"
diff --git a/roles/matrix-conduit/templates/conduit/conduit.toml.j2 b/roles/matrix-conduit/templates/conduit/conduit.toml.j2
index f92910e1..6f479084 100644
--- a/roles/matrix-conduit/templates/conduit/conduit.toml.j2
+++ b/roles/matrix-conduit/templates/conduit/conduit.toml.j2
@@ -35,14 +35,14 @@ port = {{ matrix_conduit_port_number }}
 max_request_size = {{ matrix_conduit_max_request_size }}
 
 # Enables registration. If set to false, no users can register on this server.
-allow_registration = {{ matrix_conduit_allow_registration | to_json | replace("\"", "") }}
+allow_registration = {{ matrix_conduit_allow_registration | to_json }}
 
-allow_federation = {{ matrix_conduit_allow_federation | to_json | replace("\"", "") }}
+allow_federation = {{ matrix_conduit_allow_federation | to_json }}
 
 # Enable the display name lightning bolt on registration.
-enable_lightning_bolt = {{ matrix_conduit_enable_lightning_bolt | to_json | replace("\"", "") }}
+enable_lightning_bolt = {{ matrix_conduit_enable_lightning_bolt | to_json }}
 
-trusted_servers = {{ matrix_conduit_trusted_servers }}
+trusted_servers = {{ matrix_conduit_trusted_servers | to_json }}
 
 max_concurrent_requests = {{ matrix_conduit_max_concurrent_requests }}
 

From 0ee44adde86398f6b38f339915aa5952d27ea63a Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Fri, 5 Aug 2022 13:44:56 -0500
Subject: [PATCH 12/15] Using ansible.builtin where possible

---
 roles/matrix-conduit/tasks/conduit/setup.yml           | 4 ++--
 roles/matrix-conduit/tasks/conduit/setup_install.yml   | 6 +++---
 roles/matrix-conduit/tasks/conduit/setup_uninstall.yml | 8 ++++----
 roles/matrix-conduit/tasks/init.yml                    | 2 +-
 roles/matrix-conduit/tasks/main.yml                    | 2 +-
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/roles/matrix-conduit/tasks/conduit/setup.yml b/roles/matrix-conduit/tasks/conduit/setup.yml
index 055fbd27..c4d3d6be 100644
--- a/roles/matrix-conduit/tasks/conduit/setup.yml
+++ b/roles/matrix-conduit/tasks/conduit/setup.yml
@@ -1,7 +1,7 @@
 ---
 
 - name: Ensure Conduit config path exists
-  file:
+  ansible.builtin.file:
     path: "{{ matrix_conduit_config_path }}"
     state: directory
     mode: 0750
@@ -10,7 +10,7 @@
   when: "matrix_conduit_enabled|bool"
 
 - name: Ensure Conduit data path exists
-  file:
+  ansible.builtin.file:
     path: "{{ matrix_conduit_data_path }}"
     state: directory
     mode: 0770
diff --git a/roles/matrix-conduit/tasks/conduit/setup_install.yml b/roles/matrix-conduit/tasks/conduit/setup_install.yml
index 5611e3e3..927d9fa3 100644
--- a/roles/matrix-conduit/tasks/conduit/setup_install.yml
+++ b/roles/matrix-conduit/tasks/conduit/setup_install.yml
@@ -11,7 +11,7 @@
   until: result is not failed
 
 - name: Ensure Conduit configuration installed
-  template:
+  ansible.builtin.template:
     src: "{{ role_path }}/templates/conduit/conduit.toml.j2"
     dest: "{{ matrix_conduit_config_path }}/conduit.toml"
     mode: 0644
@@ -19,13 +19,13 @@
     group: "{{ matrix_user_groupname }}"
 
 - name: Ensure matrix-conduit.service installed
-  template:
+  ansible.builtin.template:
     src: "{{ role_path }}/templates/conduit/systemd/matrix-conduit.service.j2"
     dest: "{{ matrix_systemd_path }}/matrix-conduit.service"
     mode: 0644
   register: matrix_conduit_systemd_service_result
 
 - name: Ensure systemd reloaded after matrix-conduit.service installation
-  service:
+  ansible.builtin.systemd:
     daemon_reload: true
   when: "matrix_conduit_systemd_service_result.changed|bool"
diff --git a/roles/matrix-conduit/tasks/conduit/setup_uninstall.yml b/roles/matrix-conduit/tasks/conduit/setup_uninstall.yml
index 73722287..3bbbc3a7 100644
--- a/roles/matrix-conduit/tasks/conduit/setup_uninstall.yml
+++ b/roles/matrix-conduit/tasks/conduit/setup_uninstall.yml
@@ -1,12 +1,12 @@
 ---
 
 - name: Check existence of matrix-conduit service
-  stat:
+  ansible.builtin.stat:
     path: "{{ matrix_systemd_path }}/matrix-conduit.service"
   register: matrix_conduit_service_stat
 
 - name: Ensure matrix-conduit is stopped
-  service:
+  ansible.builtin.systemd:
     name: matrix-conduit
     state: stopped
     daemon_reload: true
@@ -14,13 +14,13 @@
   when: "matrix_conduit_service_stat.stat.exists"
 
 - name: Ensure matrix-conduit.service doesn't exist
-  file:
+  ansible.builtin.file:
     path: "{{ matrix_systemd_path }}/matrix-conduit.service"
     state: absent
   when: "matrix_conduit_service_stat.stat.exists"
 
 - name: Ensure systemd reloaded after matrix-conduit.service removal
-  service:
+  ansible.builtin.systemd:
     daemon_reload: true
   when: "matrix_conduit_service_stat.stat.exists"
 
diff --git a/roles/matrix-conduit/tasks/init.yml b/roles/matrix-conduit/tasks/init.yml
index 464278b7..11b53e79 100644
--- a/roles/matrix-conduit/tasks/init.yml
+++ b/roles/matrix-conduit/tasks/init.yml
@@ -1,5 +1,5 @@
 ---
 
-- set_fact:
+- ansible.builtin.set_fact:
     matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-conduit.service'] }}"
   when: matrix_conduit_enabled|bool
diff --git a/roles/matrix-conduit/tasks/main.yml b/roles/matrix-conduit/tasks/main.yml
index 20d91ac8..e264853e 100644
--- a/roles/matrix-conduit/tasks/main.yml
+++ b/roles/matrix-conduit/tasks/main.yml
@@ -11,7 +11,7 @@
     - setup-conduit
 
 - name: Mark matrix-conduit role as executed
-  set_fact:
+  ansible.builtin.set_fact:
     matrix_conduit_role_executed: true
   tags:
     - always

From 5799b95c01c58483ca9d88667d3d68ec5bd0dca1 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Fri, 5 Aug 2022 13:48:45 -0500
Subject: [PATCH 13/15] Ensure space around pipe character for ansible-lint

---
 roles/matrix-conduit/tasks/conduit/setup.yml         | 8 ++++----
 roles/matrix-conduit/tasks/conduit/setup_install.yml | 2 +-
 roles/matrix-conduit/tasks/init.yml                  | 2 +-
 roles/matrix-conduit/tasks/main.yml                  | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/roles/matrix-conduit/tasks/conduit/setup.yml b/roles/matrix-conduit/tasks/conduit/setup.yml
index c4d3d6be..9b3d4487 100644
--- a/roles/matrix-conduit/tasks/conduit/setup.yml
+++ b/roles/matrix-conduit/tasks/conduit/setup.yml
@@ -7,7 +7,7 @@
     mode: 0750
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
-  when: "matrix_conduit_enabled|bool"
+  when: "matrix_conduit_enabled | bool"
 
 - name: Ensure Conduit data path exists
   ansible.builtin.file:
@@ -16,10 +16,10 @@
     mode: 0770
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
-  when: "matrix_conduit_enabled|bool"
+  when: "matrix_conduit_enabled | bool"
 
 - import_tasks: "{{ role_path }}/tasks/conduit/setup_install.yml"
-  when: matrix_conduit_enabled|bool
+  when: "matrix_conduit_enabled | bool"
 
 - import_tasks: "{{ role_path }}/tasks/conduit/setup_uninstall.yml"
-  when: "not matrix_conduit_enabled|bool"
+  when: "not matrix_conduit_enabled | bool"
diff --git a/roles/matrix-conduit/tasks/conduit/setup_install.yml b/roles/matrix-conduit/tasks/conduit/setup_install.yml
index 927d9fa3..f86db34f 100644
--- a/roles/matrix-conduit/tasks/conduit/setup_install.yml
+++ b/roles/matrix-conduit/tasks/conduit/setup_install.yml
@@ -28,4 +28,4 @@
 - name: Ensure systemd reloaded after matrix-conduit.service installation
   ansible.builtin.systemd:
     daemon_reload: true
-  when: "matrix_conduit_systemd_service_result.changed|bool"
+  when: "matrix_conduit_systemd_service_result.changed | bool"
diff --git a/roles/matrix-conduit/tasks/init.yml b/roles/matrix-conduit/tasks/init.yml
index 11b53e79..5f464e40 100644
--- a/roles/matrix-conduit/tasks/init.yml
+++ b/roles/matrix-conduit/tasks/init.yml
@@ -2,4 +2,4 @@
 
 - ansible.builtin.set_fact:
     matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-conduit.service'] }}"
-  when: matrix_conduit_enabled|bool
+  when: matrix_conduit_enabled | bool
diff --git a/roles/matrix-conduit/tasks/main.yml b/roles/matrix-conduit/tasks/main.yml
index e264853e..c8862bd7 100644
--- a/roles/matrix-conduit/tasks/main.yml
+++ b/roles/matrix-conduit/tasks/main.yml
@@ -5,7 +5,7 @@
     - always
 
 - import_tasks: "{{ role_path }}/tasks/conduit/setup.yml"
-  when: run_setup|bool
+  when: run_setup | bool
   tags:
     - setup-all
     - setup-conduit

From e74560c6efc556dfecdc6e83e77b3f2474626756 Mon Sep 17 00:00:00 2001
From: Charles Wright <cvwright@futo.org>
Date: Mon, 8 Aug 2022 22:08:09 -0500
Subject: [PATCH 14/15] Moved Conduit directory creation from setup.yml into
 setup_install.yml, as suggested by Slavi

---
 roles/matrix-conduit/tasks/conduit/setup.yml   | 18 ------------------
 .../tasks/conduit/setup_install.yml            | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/roles/matrix-conduit/tasks/conduit/setup.yml b/roles/matrix-conduit/tasks/conduit/setup.yml
index 9b3d4487..fa095f66 100644
--- a/roles/matrix-conduit/tasks/conduit/setup.yml
+++ b/roles/matrix-conduit/tasks/conduit/setup.yml
@@ -1,23 +1,5 @@
 ---
 
-- name: Ensure Conduit config path exists
-  ansible.builtin.file:
-    path: "{{ matrix_conduit_config_path }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-  when: "matrix_conduit_enabled | bool"
-
-- name: Ensure Conduit data path exists
-  ansible.builtin.file:
-    path: "{{ matrix_conduit_data_path }}"
-    state: directory
-    mode: 0770
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-  when: "matrix_conduit_enabled | bool"
-
 - import_tasks: "{{ role_path }}/tasks/conduit/setup_install.yml"
   when: "matrix_conduit_enabled | bool"
 
diff --git a/roles/matrix-conduit/tasks/conduit/setup_install.yml b/roles/matrix-conduit/tasks/conduit/setup_install.yml
index f86db34f..ac5be14d 100644
--- a/roles/matrix-conduit/tasks/conduit/setup_install.yml
+++ b/roles/matrix-conduit/tasks/conduit/setup_install.yml
@@ -10,6 +10,22 @@
   delay: "{{ matrix_container_retries_delay }}"
   until: result is not failed
 
+- name: Ensure Conduit config path exists
+  ansible.builtin.file:
+    path: "{{ matrix_conduit_config_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure Conduit data path exists
+  ansible.builtin.file:
+    path: "{{ matrix_conduit_data_path }}"
+    state: directory
+    mode: 0770
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
 - name: Ensure Conduit configuration installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/conduit/conduit.toml.j2"

From 1aff2ca24799dafd28201f128a658e35377dd2a6 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 9 Aug 2022 10:54:39 +0300
Subject: [PATCH 15/15] Fix ansible-lint errors

---
 roles/matrix-conduit/defaults/main.yml               | 2 +-
 roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/roles/matrix-conduit/defaults/main.yml b/roles/matrix-conduit/defaults/main.yml
index 9ee83282..25036939 100644
--- a/roles/matrix-conduit/defaults/main.yml
+++ b/roles/matrix-conduit/defaults/main.yml
@@ -4,7 +4,7 @@
 
 matrix_conduit_enabled: true
 
-matrix_conduit_docker_image: "{{ matrix_conduit_docker_image_name_prefix}}matrixconduit/matrix-conduit:{{ matrix_conduit_docker_image_tag }}"
+matrix_conduit_docker_image: "{{ matrix_conduit_docker_image_name_prefix }}matrixconduit/matrix-conduit:{{ matrix_conduit_docker_image_tag }}"
 matrix_conduit_docker_image_name_prefix: "docker.io/"
 matrix_conduit_docker_image_tag: "v0.4.0"
 matrix_conduit_docker_image_force_pull: "{{ matrix_conduit_docker_image.endswith(':latest') }}"
diff --git a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
index 2f65e656..4d93e769 100644
--- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
+++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
@@ -69,17 +69,17 @@
   when: "not matrix_nginx_proxy_proxy_dendrite_enabled | bool"
 
 - name: Ensure Matrix nginx-proxy configuration for matrix-conduit exists
-  template:
+  ansible.builtin.template:
     src: "{{ role_path }}/templates/nginx/conf.d/matrix-conduit.conf.j2"
     dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-conduit.conf"
     mode: 0644
-  when: matrix_nginx_proxy_proxy_conduit_enabled|bool
+  when: matrix_nginx_proxy_proxy_conduit_enabled | bool
 
 - name: Ensure Matrix nginx-proxy configuration for matrix-conduit deleted
-  file:
+  ansible.builtin.file:
     path: "{{ matrix_nginx_proxy_confd_path }}/matrix-conduit.conf"
     state: absent
-  when: "not matrix_nginx_proxy_proxy_conduit_enabled|bool"
+  when: "not matrix_nginx_proxy_proxy_conduit_enabled | bool"
 
 - name: Ensure Matrix nginx-proxy configuration for Element domain exists
   ansible.builtin.template: