diff --git a/CHANGELOG.md b/CHANGELOG.md
index c706b4a6..43af8dd1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,12 @@
+# 2021-11-11
+
+## Dropped support for Postgres v9.6
+
+Postgres v9.6 reached its end of life today, so the playbook will refuse to run for you if you're still on that version.
+
+Synapse still supports v9.6 (for now), but we're retiring support for it early, to avoid having to maintain support for so many Postgres versions. Users that are still on Postgres v9.6 can easily [upgrade Postgres](docs/maintenance-postgres.md#upgrading-postgresql) via the playbook.
+
+
 # 2021-10-23
 
 ## Hangouts bridge no longer updated, superseded by a Googlechat bridge
@@ -244,6 +253,8 @@ The fact that we've renamed Synapse's database from `homeserver` to `synapse` (i
 
 ## (Breaking Change) The mautrix-facebook bridge now requires a Postgres database
 
+**Update from 2021-11-15**: SQLite support has been re-added to the mautrix-facebook bridge in [v0.3.2](https://github.com/mautrix/facebook/releases/tag/v0.3.2). You can ignore this changelog entry.
+
 A new version of the [mautrix-facebook](https://github.com/tulir/mautrix-facebook) bridge has been released. It's a full rewrite of its backend and the bridge now requires Postgres. New versions of the bridge can no longer run on SQLite.
 
 **TLDR**: if you're NOT using an [external Postgres server](docs/configuring-playbook-external-postgres.md) and have NOT forcefully kept the bridge on SQLite during [The big move to all-on-Postgres (potentially dangerous)](#the-big-move-to-all-on-postgres-potentially-dangerous), you will be automatically upgraded without manual intervention. All you need to do is send a `login` message to the Facebook bridge bot again.
diff --git a/docs/configuring-playbook-bridge-mautrix-whatsapp.md b/docs/configuring-playbook-bridge-mautrix-whatsapp.md
index 1e5f7038..2af38be1 100644
--- a/docs/configuring-playbook-bridge-mautrix-whatsapp.md
+++ b/docs/configuring-playbook-bridge-mautrix-whatsapp.md
@@ -8,8 +8,25 @@ Use the following playbook configuration:
 
 ```yaml
 matrix_mautrix_whatsapp_enabled: true
-```
+``` 
+Whatsapp multidevice beta is required, now it is enough if Whatsapp is connected to the Internet every 2 weeks.
+
+## Enable backfilling history
+This requires a server with MSC2716 support, which is currently an experimental feature in synapse.
+Note that as of Synapse 1.46, there are still some bugs with the implementation, especially if using event persistence workers.
+Use the following playbook configuration:
 
+```yaml
+matrix_synapse_configuration_extension_yaml: |
+  experimental_features:
+    msc2716_enabled: true
+```
+```yaml
+matrix_mautrix_whatsapp_configuration_extension_yaml:
+  bridge:
+    history_sync:
+      backfill: true
+```
 
 ## Set up Double Puppeting
 
diff --git a/docs/configuring-playbook-matrix-corporal.md b/docs/configuring-playbook-matrix-corporal.md
index fb12e94a..eb635c64 100644
--- a/docs/configuring-playbook-matrix-corporal.md
+++ b/docs/configuring-playbook-matrix-corporal.md
@@ -37,6 +37,7 @@ matrix_synapse_ext_password_provider_rest_auth_endpoint: "http://matrix-corporal
 
 matrix_corporal_enabled: true
 
+# See below for an example of how to use a locally-stored static policy
 matrix_corporal_policy_provider_config: |
   {
     "Type": "http",
@@ -74,10 +75,48 @@ Matrix Corporal operates with a specific Matrix user on your server.
 By default, it's `matrix-corporal` (controllable by the `matrix_corporal_reconciliation_user_id_local_part` setting, see above).
 No matter what Matrix user id you configure to run it with, make sure that:
 
-- the Matrix Corporal user is created by [registering it](registering-users.md). Use a password you remember, as you'll need to log in from time to time to create or join rooms
+- the Matrix Corporal user is created by [registering it](registering-users.md) **with administrator privileges**. Use a password you remember, as you'll need to log in from time to time to create or join rooms
 
 - the Matrix Corporal user is joined and has Admin/Moderator-level access to any rooms you want it to manage
 
+### Using a locally-stored static policy
+
+If you'd like to use a [static policy file](https://github.com/devture/matrix-corporal/blob/master/docs/policy-providers.md#static-file-pull-style-policy-provider), you can use a configuration like this:
+
+```yaml
+matrix_corporal_policy_provider_config: |
+  {
+    "Type": "static_file",
+    "Path": "/etc/matrix-corporal/policy.json"
+  }
+
+# Modify the policy below as you see fit
+matrix_aux_file_definitions:
+  - dest: "{{ matrix_corporal_config_dir_path }}/policy.json"
+    content: |
+      {
+        "schemaVersion": 1,
+        "identificationStamp": "stamp-1",
+        "flags": {
+          "allowCustomUserDisplayNames": false,
+          "allowCustomUserAvatars": false,
+          "forbidRoomCreation": false,
+          "forbidEncryptedRoomCreation": true,
+          "forbidUnencryptedRoomCreation": false,
+          "allowCustomPassthroughUserPasswords": true,
+          "allowUnauthenticatedPasswordResets": false,
+          "allow3pidLogin": false
+        },
+        "managedCommunityIds": [],
+        "managedRoomIds": [],
+        "users": []
+      }
+```
+
+To learn more about what the policy configuration, see the matrix-corporal documentation on [policy](https://github.com/devture/matrix-corporal/blob/master/docs/policy.md).
+
+Each time you update the policy in your `vars.yml` file, you'd need to re-run the playbook and restart matrix-corporal (`--tags=setup-all,start` or `--tags=setup-aux-files,setup-corporal,start`).
+
 
 ## Matrix Corporal files
 
diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index d58f4dda..377c27cd 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -19,9 +19,9 @@ matrix_container_global_registry_prefix: "docker.io/"
 
 matrix_identity_server_url: "{{ ('https://' + matrix_server_fqn_matrix) if matrix_ma1sd_enabled else None }}"
 
-# If Synapse workers are enabled and matrix-nginx-proxy is disabled, certain APIs may not work over 'http://matrix-synapse:8008'.
+# If Synapse workers are enabled and matrix-nginx-proxy is disabled, certain APIs may not work over 'http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}'.
 # This is because we explicitly disable them for the main Synapse process.
-matrix_homeserver_container_url: "{{ 'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else 'http://matrix-synapse:8008' }}"
+matrix_homeserver_container_url: "{{ 'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string }}"
 
 ######################################################################
 #
@@ -113,6 +113,7 @@ matrix_appservice_webhooks_container_http_host_bind_port: "{{ '' if matrix_nginx
 
 matrix_appservice_webhooks_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'webhook.as.token') | to_uuid }}"
 
+matrix_appservice_webhooks_homeserver_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}"
 matrix_appservice_webhooks_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'webhook.hs.token') | to_uuid }}"
 
 matrix_appservice_webhooks_id_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'webhook.id.token') | to_uuid }}"
@@ -151,6 +152,7 @@ matrix_appservice_slack_container_http_host_bind_port: "{{ '' if matrix_nginx_pr
 
 matrix_appservice_slack_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'slack.as.token') | to_uuid }}"
 
+matrix_appservice_slack_homeserver_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}"
 matrix_appservice_slack_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'slack.hs.token') | to_uuid }}"
 
 matrix_appservice_slack_id_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'slack.id.token') | to_uuid }}"
@@ -567,6 +569,7 @@ matrix_sms_bridge_systemd_required_services_list: |
 
 matrix_sms_bridge_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'sms.as.token') | to_uuid }}"
 
+matrix_sms_bridge_homeserver_port: "{{ matrix_synapse_container_client_api_port }}"
 matrix_sms_bridge_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'sms.hs.token') | to_uuid }}"
 
 ######################################################################
@@ -1047,6 +1050,8 @@ matrix_dimension_enabled: false
 # the Dimension HTTP port to the local host.
 matrix_dimension_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8184' }}"
 
+matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{matrix_synapse_container_federation_api_plain_port|string}}"
+
 matrix_integration_manager_rest_url: "{{ matrix_dimension_integrations_rest_url if matrix_dimension_enabled else None }}"
 matrix_integration_manager_ui_url: "{{ matrix_dimension_integrations_ui_url if matrix_dimension_enabled else None }}"
 
@@ -1212,7 +1217,8 @@ matrix_ma1sd_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
 # Normally, matrix-nginx-proxy is enabled and nginx can reach ma1sd over the container network.
 # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
 # ma1sd's web-server port.
-matrix_ma1sd_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_ma1sd_default_port|string }}"
+matrix_ma1sd_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_ma1sd_container_port|string }}"
+
 
 # We enable Synapse integration via its Postgres database by default.
 # When using another Identity store, you might wish to disable this and define
@@ -1294,8 +1300,8 @@ matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corpor
 matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:41081"
 
 matrix_nginx_proxy_proxy_matrix_identity_api_enabled: "{{ matrix_ma1sd_enabled }}"
-matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}"
-matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}"
+matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}"
+matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}"
 
 # By default, we do TLS termination for the Matrix Federation API (port 8448) at matrix-nginx-proxy.
 # Unless this is handled there OR Synapse's federation listener port is disabled, we'll reverse-proxy.
@@ -1306,6 +1312,12 @@ matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container: "127.0.0.1:1
 # Settings controlling matrix-synapse-proxy.conf
 matrix_nginx_proxy_proxy_synapse_enabled: "{{ matrix_synapse_enabled }}"
 
+matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: "matrix-synapse:{{ matrix_synapse_container_client_api_port }}"
+matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: "127.0.0.1:{{ matrix_synapse_container_client_api_port }}"
+
+matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:{{matrix_synapse_container_federation_api_plain_port|string}}"
+matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:{{matrix_synapse_container_federation_api_plain_port|string}}"
+
 # When matrix-nginx-proxy is disabled, the actual port number that the vhost uses may begin to matter.
 matrix_nginx_proxy_proxy_matrix_federation_port: "{{ matrix_federation_public_port }}"
 
@@ -1709,18 +1721,18 @@ matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['arm6
 
 # When ma1sd is enabled, we can use it to validate email addresses and phone numbers.
 # Synapse can validate email addresses by itself as well, but it's probably not what we want by default when we have an identity server.
-matrix_synapse_account_threepid_delegates_email: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_default_port|string if matrix_ma1sd_enabled else '' }}"
-matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_default_port|string if matrix_ma1sd_enabled else '' }}"
+matrix_synapse_account_threepid_delegates_email: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_container_port|string if matrix_ma1sd_enabled else '' }}"
+matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_container_port|string if matrix_ma1sd_enabled else '' }}"
 
 # Normally, matrix-nginx-proxy is enabled and nginx can reach Synapse over the container network.
 # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it,
 # you can expose Synapse's ports to the host.
 #
 # For exposing the Matrix Client API's port (plain HTTP) to the local host.
-matrix_synapse_container_client_api_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8008' }}"
+matrix_synapse_container_client_api_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_synapse_container_client_api_port|string }}"
 #
 # For exposing the Matrix Federation API's plain port (plain HTTP) to the local host.
-matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8048' }}"
+matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_synapse_container_federation_api_plain_port|string }}"
 #
 # For exposing the Matrix Federation API's TLS port (HTTPS) to the internet on all network interfaces.
 matrix_synapse_container_federation_api_tls_host_bind_port: "{{ matrix_federation_public_port if (matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled) else '' }}"
diff --git a/roles/matrix-awx/scripts/matrix_build_room_list.py b/roles/matrix-awx/scripts/matrix_build_room_list.py
index 3abfcd8c..94779ca7 100644
--- a/roles/matrix-awx/scripts/matrix_build_room_list.py
+++ b/roles/matrix-awx/scripts/matrix_build_room_list.py
@@ -5,10 +5,11 @@ import json
 
 janitor_token = sys.argv[1]
 synapse_container_ip = sys.argv[2]
+synapse_container_port = sys.argv[3]
 
 # collect total amount of rooms
 
-rooms_raw_url = 'http://' + synapse_container_ip + ':8008/_synapse/admin/v1/rooms'
+rooms_raw_url = 'http://' + synapse_container_ip + ':' + synapse_container_port + '/_synapse/admin/v1/rooms'
 rooms_raw_header = {'Authorization': 'Bearer ' + janitor_token}
 rooms_raw = requests.get(rooms_raw_url, headers=rooms_raw_header)
 rooms_raw_python = json.loads(rooms_raw.text)
@@ -19,7 +20,7 @@ total_rooms = rooms_raw_python["total_rooms"]
 room_list_file = open("/tmp/room_list_complete.json", "w")
 
 for i in range(0, total_rooms, 100):
-  rooms_inc_url = 'http://' + synapse_container_ip + ':8008/_synapse/admin/v1/rooms?from=' + str(i)
+  rooms_inc_url = 'http://' + synapse_container_ip + ':' + synapse_container_port + '/_synapse/admin/v1/rooms?from=' + str(i)
   rooms_inc = requests.get(rooms_inc_url, headers=rooms_raw_header)
   room_list_file.write(rooms_inc.text)
 
diff --git a/roles/matrix-awx/tasks/purge_database_build_list.yml b/roles/matrix-awx/tasks/purge_database_build_list.yml
index 5ca57d22..339510f0 100644
--- a/roles/matrix-awx/tasks/purge_database_build_list.yml
+++ b/roles/matrix-awx/tasks/purge_database_build_list.yml
@@ -2,9 +2,9 @@
 
 - name: Collect entire room list into stdout
   shell: |
-    curl -X GET --header "Authorization: Bearer {{ janitors_token.stdout[1:-1] }}" '{{ synapse_container_ip.stdout }}:8008/_synapse/admin/v1/rooms?from={{ item }}'
+    curl -X GET --header "Authorization: Bearer {{ janitors_token.stdout[1:-1] }}" '{{ synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/rooms?from={{ item }}'
   register: awx_rooms_output
-  
+
 - name: Print stdout to file
   delegate_to: 127.0.0.1
   shell: |
diff --git a/roles/matrix-awx/tasks/purge_database_events.yml b/roles/matrix-awx/tasks/purge_database_events.yml
index aaef3cba..586bc17c 100644
--- a/roles/matrix-awx/tasks/purge_database_events.yml
+++ b/roles/matrix-awx/tasks/purge_database_events.yml
@@ -2,11 +2,11 @@
 
 - name: Purge all rooms with more then N events
   shell: |
-    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
+    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
   register: awx_purge_command
 
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe
diff --git a/roles/matrix-awx/tasks/purge_database_main.yml b/roles/matrix-awx/tasks/purge_database_main.yml
index 6b132091..2cdf0330 100644
--- a/roles/matrix-awx/tasks/purge_database_main.yml
+++ b/roles/matrix-awx/tasks/purge_database_main.yml
@@ -31,7 +31,7 @@
 
 - name: Collect access token for janitor user
   shell: |
-    curl -X POST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:8008/_matrix/client/r0/login" | jq '.access_token'
+    curl -X POST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_matrix/client/r0/login" | jq '.access_token'
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
   register: awx_janitors_token
   no_log: True
@@ -47,7 +47,7 @@
 
 - name: Run build_room_list.py script
   shell: |
-    runuser -u matrix -- python3 /usr/local/bin/matrix_build_room_list.py {{ awx_janitors_token.stdout[1:-1] }} {{ awx_synapse_container_ip.stdout }}
+    runuser -u matrix -- python3 /usr/local/bin/matrix_build_room_list.py {{ awx_janitors_token.stdout[1:-1] }} {{ awx_synapse_container_ip.stdout }} {{ matrix_synapse_container_client_api_port.stdout }}
   register: awx_rooms_total
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
 
@@ -69,7 +69,7 @@
   shell: |
     jq 'try .rooms[] | select(.joined_local_members == 0) | .room_id' < /tmp/{{ subscription_id }}_room_list_complete.json > /tmp/{{ subscription_id }}_room_list_no_local_users.txt
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-  
+
 - name: Count number of rooms with no local users
   delegate_to: 127.0.0.1
   shell: |
@@ -84,7 +84,7 @@
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
 
 - name: Purge all rooms with no local users
-  include_tasks: purge_database_no_local.yml 
+  include_tasks: purge_database_no_local.yml
   loop: "{{ awx_room_list_no_local_users.splitlines() | flatten(levels=1) }}"
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
 
@@ -116,7 +116,7 @@
   no_log: True
 
 - name: Purge all rooms with more then N users
-  include_tasks: purge_database_users.yml 
+  include_tasks: purge_database_users.yml
   loop: "{{ awx_room_list_joined_members.splitlines() | flatten(levels=1) }}"
   when: awx_purge_mode.find("Number of users [slower]") != -1
 
@@ -141,7 +141,7 @@
   no_log: True
 
 - name: Purge all rooms with more then N events
-  include_tasks: purge_database_events.yml 
+  include_tasks: purge_database_events.yml
   loop: "{{ awx_room_list_state_events.splitlines() | flatten(levels=1) }}"
   when: awx_purge_mode.find("Number of events [slower]") != -1
 
@@ -171,7 +171,7 @@
     wait: yes
     tower_host: "https://{{ awx_host }}"
     tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: yes 
+    validate_certs: yes
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) or (awx_purge_mode.find("Skip purging rooms [faster]") != -1)
 
 - name: Revert 'Deploy/Update a Server' job template
@@ -237,7 +237,7 @@
     wait: yes
     tower_host: "https://{{ awx_host }}"
     tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: yes 
+    validate_certs: yes
   when: (awx_purge_mode.find("Perform final shrink") != -1)
 
 - name: Revert 'Deploy/Update a Server' job template
@@ -272,7 +272,7 @@
   when: (awx_purge_mode.find("Perform final shrink") != -1)
   no_log: True
 
-- name: Print total number of rooms processed 
+- name: Print total number of rooms processed
   debug:
     msg: '{{ awx_rooms_total.stdout }}'
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
diff --git a/roles/matrix-awx/tasks/purge_database_no_local.yml b/roles/matrix-awx/tasks/purge_database_no_local.yml
index 33f99c49..e464f56d 100644
--- a/roles/matrix-awx/tasks/purge_database_no_local.yml
+++ b/roles/matrix-awx/tasks/purge_database_no_local.yml
@@ -2,11 +2,11 @@
 
 - name: Purge all rooms with no local users
   shell: |
-    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "room_id": {{ item }} }' '{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_room'
+    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "room_id": {{ item }} }' '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_room'
   register: awx_purge_command
-  
+
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe
diff --git a/roles/matrix-awx/tasks/purge_database_users.yml b/roles/matrix-awx/tasks/purge_database_users.yml
index 1c8da14d..d315a9ef 100644
--- a/roles/matrix-awx/tasks/purge_database_users.yml
+++ b/roles/matrix-awx/tasks/purge_database_users.yml
@@ -2,11 +2,11 @@
 
 - name: Purge all rooms with more then N users
   shell: |
-    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
+    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
   register: awx_purge_command
-  
+
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe
diff --git a/roles/matrix-awx/tasks/purge_media_local.yml b/roles/matrix-awx/tasks/purge_media_local.yml
index 2074d5d8..7ef79eca 100644
--- a/roles/matrix-awx/tasks/purge_media_local.yml
+++ b/roles/matrix-awx/tasks/purge_media_local.yml
@@ -7,11 +7,11 @@
 
 - name: Purge local media to specific date
   shell: |
-    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/media/matrix.{{ matrix_domain }}/delete?before_ts={{ awx_epoche_time.stdout }}000'
+    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/media/matrix.{{ matrix_domain }}/delete?before_ts={{ awx_epoche_time.stdout }}000'
   register: awx_purge_command
-  
+
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe
diff --git a/roles/matrix-awx/tasks/purge_media_main.yml b/roles/matrix-awx/tasks/purge_media_main.yml
index 9c5f6bfb..0c322b85 100644
--- a/roles/matrix-awx/tasks/purge_media_main.yml
+++ b/roles/matrix-awx/tasks/purge_media_main.yml
@@ -9,7 +9,7 @@
   include_vars:
     file: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
   no_log: True
-  
+
 - name: Ensure curl and jq intalled on target machine
   apt:
     pkg:
@@ -23,7 +23,7 @@
 
 - name: Collect access token for janitor user
   shell: |
-    curl -XPOST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:8008/_matrix/client/r0/login" | jq '.access_token'
+    curl -XPOST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_matrix/client/r0/login" | jq '.access_token'
   register: awx_janitors_token
   no_log: True
 
@@ -31,7 +31,7 @@
   delegate_to: 127.0.0.1
   shell: "dateseq {{ matrix_purge_from_date }} {{ matrix_purge_to_date }}"
   register: awx_purge_dates
-    
+
 - name: Calculate initial size of local media repository
   shell: du -sh /matrix/synapse/storage/media-store/local*
   register: awx_local_media_size_before
@@ -47,12 +47,12 @@
   no_log: True
 
 - name: Purge local media with loop
-  include_tasks: purge_media_local.yml 
+  include_tasks: purge_media_local.yml
   loop: "{{ awx_purge_dates.stdout_lines | flatten(levels=1) }}"
   when: awx_purge_media_type == "Local Media"
 
 - name: Purge remote media with loop
-  include_tasks: purge_media_remote.yml 
+  include_tasks: purge_media_remote.yml
   loop: "{{ awx_purge_dates.stdout_lines | flatten(levels=1) }}"
   when: awx_purge_media_type == "Remote Media"
 
diff --git a/roles/matrix-awx/tasks/purge_media_remote.yml b/roles/matrix-awx/tasks/purge_media_remote.yml
index 1418d9a6..5bb71918 100644
--- a/roles/matrix-awx/tasks/purge_media_remote.yml
+++ b/roles/matrix-awx/tasks/purge_media_remote.yml
@@ -7,11 +7,11 @@
 
 - name: Purge remote media to specific date
   shell: |
-    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_media_cache?before_ts={{ awx_epoche_time.stdout }}000'
+    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_media_cache?before_ts={{ awx_epoche_time.stdout }}000'
   register: awx_purge_command
-  
+
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe
diff --git a/roles/matrix-awx/tasks/set_variables_ma1sd.yml b/roles/matrix-awx/tasks/set_variables_ma1sd.yml
index 81012d28..db5037d1 100755
--- a/roles/matrix-awx/tasks/set_variables_ma1sd.yml
+++ b/roles/matrix-awx/tasks/set_variables_ma1sd.yml
@@ -30,7 +30,7 @@
     insertafter: '# Synapse Extension Start'
   with_dict:
     'matrix_synapse_awx_password_provider_rest_auth_enabled': 'true'
-    'matrix_synapse_awx_password_provider_rest_auth_endpoint': '"http://matrix-ma1sd:{{ matrix_ma1sd_default_port }}"'
+    'matrix_synapse_awx_password_provider_rest_auth_endpoint': '"http://matrix-ma1sd:{{ matrix_ma1sd_container_port }}"'
   when: awx_matrix_ma1sd_auth_store == 'LDAP/AD'
 
 - name: Remove entire ma1sd configuration extension
diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml
index bf376c94..6639c223 100644
--- a/roles/matrix-base/defaults/main.yml
+++ b/roles/matrix-base/defaults/main.yml
@@ -91,7 +91,7 @@ matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}"
 # Specifies where the homeserver is on the container network.
 # Where this is depends on whether there's a reverse-proxy in front of it, etc.
 # This likely gets overriden elsewhere.
-matrix_homeserver_container_url: "http://matrix-synapse:8008"
+matrix_homeserver_container_url: ""
 
 matrix_identity_server_url: ~
 
diff --git a/roles/matrix-base/tasks/validate_config.yml b/roles/matrix-base/tasks/validate_config.yml
new file mode 100644
index 00000000..8bb3fca0
--- /dev/null
+++ b/roles/matrix-base/tasks/validate_config.yml
@@ -0,0 +1,9 @@
+---
+
+- name: Fail if required Matrix Base settings not defined
+  fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`) for using this playbook.
+  when: "vars[item] == ''"
+  with_items:
+    - "matrix_homeserver_container_url"
\ No newline at end of file
diff --git a/roles/matrix-bot-go-neb/tasks/setup_uninstall.yml b/roles/matrix-bot-go-neb/tasks/setup_uninstall.yml
index 49ad1fe7..3610eb44 100644
--- a/roles/matrix-bot-go-neb/tasks/setup_uninstall.yml
+++ b/roles/matrix-bot-go-neb/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-bot-go-neb
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_bot_go_neb_service_stat.stat.exists|bool"
diff --git a/roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml b/roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml
index 141e61ba..d7e41201 100644
--- a/roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml
+++ b/roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-bot-matrix-reminder-bot
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_bot_matrix_reminder_bot_service_stat.stat.exists|bool"
diff --git a/roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml b/roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml
index 7127543e..7fff5e13 100644
--- a/roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml
+++ b/roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-bot-mjolnir
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_bot_mjolnir_service_stat.stat.exists|bool"
diff --git a/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml b/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml
index 6d3fdd0f..546e5043 100644
--- a/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml
+++ b/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml
@@ -54,6 +54,7 @@
   service:
     name: matrix-appservice-discord
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_appservice_discord_stat_db.stat.exists"
diff --git a/roles/matrix-bridge-appservice-discord/tasks/setup_uninstall.yml b/roles/matrix-bridge-appservice-discord/tasks/setup_uninstall.yml
index 4e8c1fdc..5dd8075d 100644
--- a/roles/matrix-bridge-appservice-discord/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-appservice-discord/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-appservice-discord
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_appservice_discord_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml b/roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml
index 2b5e5dfd..51507817 100644
--- a/roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-appservice-irc
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_appservice_irc_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-appservice-slack/defaults/main.yml b/roles/matrix-bridge-appservice-slack/defaults/main.yml
index 10b3d7b4..4f4d5e2f 100644
--- a/roles/matrix-bridge-appservice-slack/defaults/main.yml
+++ b/roles/matrix-bridge-appservice-slack/defaults/main.yml
@@ -33,7 +33,7 @@ matrix_appservice_slack_slack_port: 9003
 matrix_appservice_slack_container_http_host_bind_port: ''
 
 matrix_appservice_slack_homeserver_media_url: "{{ matrix_server_fqn_matrix }}"
-matrix_appservice_slack_homeserver_url: "http://matrix-synapse:8008"
+matrix_appservice_slack_homeserver_url: ""
 matrix_appservice_slack_homeserver_domain: "{{ matrix_domain }}"
 matrix_appservice_slack_appservice_url: 'http://matrix-appservice-slack'
 
@@ -82,7 +82,7 @@ matrix_appservice_slack_configuration_extension_yaml: |
     # Optional
     #matrix_admin_room: "!aBcDeF:matrix.org"
     #homeserver:
-    #    url: http://localhost:8008
+    #    url: http://localhost:{{ matrix_synapse_container_client_api_port }}
     #    server_name: my.server
     # Optional
     #tls:
diff --git a/roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml b/roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml
index 0b83d02e..2dfe1c7b 100644
--- a/roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-appservice-slack
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_appservice_slack_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-appservice-slack/tasks/validate_config.yml b/roles/matrix-bridge-appservice-slack/tasks/validate_config.yml
index 8af10f2f..e02c6ab0 100644
--- a/roles/matrix-bridge-appservice-slack/tasks/validate_config.yml
+++ b/roles/matrix-bridge-appservice-slack/tasks/validate_config.yml
@@ -8,5 +8,6 @@
   with_items:
     - "matrix_appservice_slack_control_room_id"
     - "matrix_appservice_slack_appservice_token"
+    - "matrix_appservice_slack_homeserver_url"
     - "matrix_appservice_slack_homeserver_token"
     - "matrix_appservice_slack_id_token"
diff --git a/roles/matrix-bridge-appservice-webhooks/defaults/main.yml b/roles/matrix-bridge-appservice-webhooks/defaults/main.yml
index 2b9fe310..25419900 100644
--- a/roles/matrix-bridge-appservice-webhooks/defaults/main.yml
+++ b/roles/matrix-bridge-appservice-webhooks/defaults/main.yml
@@ -36,7 +36,7 @@ matrix_appservice_webhooks_matrix_port: 6789
 matrix_appservice_webhooks_container_http_host_bind_port: ''
 
 matrix_appservice_webhooks_homeserver_media_url: "{{ matrix_server_fqn_matrix }}"
-matrix_appservice_webhooks_homeserver_url: "http://matrix-synapse:8008"
+matrix_appservice_webhooks_homeserver_url: ""
 matrix_appservice_webhooks_homeserver_domain: "{{ matrix_domain }}"
 matrix_appservice_webhooks_appservice_url: 'http://matrix-appservice-webhooks'
 
diff --git a/roles/matrix-bridge-appservice-webhooks/tasks/setup_uninstall.yml b/roles/matrix-bridge-appservice-webhooks/tasks/setup_uninstall.yml
index d8e973ce..81440b88 100644
--- a/roles/matrix-bridge-appservice-webhooks/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-appservice-webhooks/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-appservice-webhooks
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_appservice_webhooks_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-appservice-webhooks/tasks/validate_config.yml b/roles/matrix-bridge-appservice-webhooks/tasks/validate_config.yml
index b92a0eb9..48f63e68 100644
--- a/roles/matrix-bridge-appservice-webhooks/tasks/validate_config.yml
+++ b/roles/matrix-bridge-appservice-webhooks/tasks/validate_config.yml
@@ -7,6 +7,7 @@
   when: "vars[item] == ''"
   with_items:
     - "matrix_appservice_webhooks_appservice_token"
+    - "matrix_appservice_webhooks_homeserver_url"
     - "matrix_appservice_webhooks_homeserver_token"
     - "matrix_appservice_webhooks_id_token"
     - "matrix_appservice_webhooks_api_secret"
diff --git a/roles/matrix-bridge-beeper-linkedin/tasks/setup_uninstall.yml b/roles/matrix-bridge-beeper-linkedin/tasks/setup_uninstall.yml
index 004b788e..175613f0 100644
--- a/roles/matrix-bridge-beeper-linkedin/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-beeper-linkedin/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-beeper-linkedin
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_beeper_linkedin_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-heisenbridge/defaults/main.yml b/roles/matrix-bridge-heisenbridge/defaults/main.yml
index 2cb6e491..cd5a0858 100644
--- a/roles/matrix-bridge-heisenbridge/defaults/main.yml
+++ b/roles/matrix-bridge-heisenbridge/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_heisenbridge_enabled: true
 
-matrix_heisenbridge_version: 1.4.1
+matrix_heisenbridge_version: 1.7.1
 matrix_heisenbridge_docker_image: "{{ matrix_container_global_registry_prefix }}hif1/heisenbridge:{{ matrix_heisenbridge_version }}"
 matrix_heisenbridge_docker_image_force_pull: "{{ matrix_heisenbridge_docker_image.endswith(':latest') }}"
 
diff --git a/roles/matrix-bridge-heisenbridge/tasks/setup_uninstall.yml b/roles/matrix-bridge-heisenbridge/tasks/setup_uninstall.yml
index 853faf7a..cf100a89 100644
--- a/roles/matrix-bridge-heisenbridge/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-heisenbridge/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-heisenbridge
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_heisenbridge_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
index 6c1d6b69..2b453bab 100644
--- a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
@@ -6,7 +6,7 @@ matrix_mautrix_facebook_enabled: true
 matrix_mautrix_facebook_container_image_self_build: false
 matrix_mautrix_facebook_container_image_self_build_repo: "https://mau.dev/mautrix/facebook.git"
 
-matrix_mautrix_facebook_version: v0.3.1
+matrix_mautrix_facebook_version: v0.3.2
 matrix_mautrix_facebook_docker_image: "{{ matrix_mautrix_facebook_docker_image_name_prefix }}mautrix/facebook:{{ matrix_mautrix_facebook_version }}"
 matrix_mautrix_facebook_docker_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_facebook_container_image_self_build else 'dock.mau.dev/' }}"
 matrix_mautrix_facebook_docker_image_force_pull: "{{ matrix_mautrix_facebook_docker_image.endswith(':latest') }}"
diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
index fb9dcca4..d5230bca 100644
--- a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
@@ -86,6 +86,7 @@
   service:
     name: matrix-mautrix-facebook
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mautrix_facebook_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-facebook/tasks/setup_uninstall.yml
index efc8aa74..abbce350 100644
--- a/roles/matrix-bridge-mautrix-facebook/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mautrix-facebook/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mautrix-facebook
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mautrix_facebook_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml b/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml
index 0879bad9..1e482efb 100644
--- a/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml
+++ b/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml
@@ -10,22 +10,14 @@
     - "matrix_mautrix_facebook_homeserver_token"
 
 - block:
-    - name: Fail if on SQLite, unless on the last version supporting SQLite
-      fail:
-        msg: >-
-          You're trying to use the mautrix-facebook bridge with an SQLite database.
-          Going forward, this bridge only supports Postgres.
-          To learn more about this, see our changelog: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#breaking-change-the-mautrix-facebook-bridge-now-requires-a-postgres-database
-      when: "not matrix_mautrix_facebook_docker_image.endswith(':da1b4ec596e334325a1589e70829dea46e73064b')"
-
-    - name: Inject warning if still on SQLite
+    - name: Inject warning if on an old SQLite-supporting version
       set_fact:
         matrix_playbook_runtime_results: |
           {{
             matrix_playbook_runtime_results|default([])
             +
             [
-              "NOTE: Your mautrix-facebook bridge setup is still on SQLite. Your bridge is not getting any updates and will likely stop working at some point. To learn more about this, see our changelog: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#breaking-change-the-mautrix-facebook-bridge-now-requires-a-postgres-database"
+              "NOTE: Your mautrix-facebook bridge is still on SQLite and on the last version that supported it, before support was dropped. Support has been subsequently re-added in v0.3.2, so we advise you to upgrade (by removing your `matrix_mautrix_facebook_docker_image` definition from vars.yml)"
             ]
           }}
-  when: "matrix_mautrix_facebook_database_engine == 'sqlite'"
+  when: "matrix_mautrix_facebook_database_engine == 'sqlite' and matrix_mautrix_facebook_docker_image.endswith(':da1b4ec596e334325a1589e70829dea46e73064b')"
diff --git a/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml
index f68ee505..293e8817 100644
--- a/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml
@@ -85,6 +85,7 @@
   service:
     name: matrix-mautrix-googlechat
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mautrix_googlechat_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mautrix-googlechat/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-googlechat/tasks/setup_uninstall.yml
index d3adb7e2..bdcaa6e7 100644
--- a/roles/matrix-bridge-mautrix-googlechat/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mautrix-googlechat/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mautrix-googlechat
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mautrix_googlechat_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
index d5373134..fb5236fd 100644
--- a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
@@ -85,6 +85,7 @@
   service:
     name: matrix-mautrix-hangouts
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mautrix_hangouts_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_uninstall.yml
index 14413e94..34348cfd 100644
--- a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mautrix-hangouts
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mautrix_hangouts_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mautrix-instagram/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-instagram/tasks/setup_uninstall.yml
index c5c8a3e6..02e20b61 100644
--- a/roles/matrix-bridge-mautrix-instagram/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mautrix-instagram/tasks/setup_uninstall.yml
@@ -8,6 +8,7 @@
   service:
     name: matrix-mautrix-instagram
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mautrix_instagram_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml
index 2ca6a9a9..b36ef81d 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml
@@ -10,6 +10,7 @@
   service:
     name: matrix-mautrix-signal-daemon
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mautrix_signal_daemon_service_stat.stat.exists"
 
@@ -29,6 +30,7 @@
   service:
     name: matrix-mautrix-signal
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mautrix_signal_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml
index e2e583f2..1e87f1ae 100644
--- a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml
@@ -107,6 +107,7 @@
   service:
     name: matrix-mautrix-telegram
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mautrix_telegram_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mautrix-telegram/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-telegram/tasks/setup_uninstall.yml
index b14bd737..bc84edbb 100644
--- a/roles/matrix-bridge-mautrix-telegram/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mautrix-telegram/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mautrix-telegram
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mautrix_telegram_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml b/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml
index 7409fb4d..3d630fcf 100644
--- a/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml
@@ -36,7 +36,6 @@ matrix_mautrix_whatsapp_homeserver_token: ''
 
 matrix_mautrix_whatsapp_appservice_bot_username: whatsappbot
 
-
 # Database-related configuration fields.
 #
 # To use SQLite, stick to these defaults.
@@ -71,9 +70,14 @@ matrix_mautrix_whatsapp_appservice_database_uri: "{{
 	}[matrix_mautrix_whatsapp_database_engine]
 }}"
 
-
 # Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
 matrix_mautrix_whatsapp_login_shared_secret: ''
+matrix_mautrix_whatsapp_bridge_login_shared_secret_map:
+  "{{ {matrix_mautrix_whatsapp_homeserver_domain: matrix_mautrix_whatsapp_login_shared_secret} if matrix_mautrix_whatsapp_login_shared_secret else {} }}"
+
+# Servers to always allow double puppeting from
+matrix_mautrix_whatsapp_bridge_double_puppet_server_map:
+    "{{ matrix_mautrix_whatsapp_homeserver_domain :  matrix_mautrix_whatsapp_homeserver_address }}"
 
 # Default mautrix-whatsapp configuration template which covers the generic use case.
 # You can customize it by controlling the various variables inside it.
diff --git a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml
index f3dd0570..ddd49dd0 100644
--- a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml
@@ -93,6 +93,7 @@
   service:
     name: matrix-mautrix-whatsapp
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mautrix_whatsapp_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_uninstall.yml
index 93f5c4c8..7dd4b402 100644
--- a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mautrix-whatsapp
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mautrix_whatsapp_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2
index b3b1caf1..394f16a6 100644
--- a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2
@@ -7,15 +7,17 @@ homeserver:
     domain: {{ matrix_mautrix_whatsapp_homeserver_domain }}
 # Application service host/registration related details.
 # Changing these values requires regeneration of the registration.
+    # The URL to push real-time bridge status to.
+    # If set, the bridge will make POST requests to this URL whenever a user's whatsapp connection state changes.
+    # The bridge will use the appservice as_token to authorize requests.
+    status_endpoint: "null"
 
 appservice:
     # The address that the homeserver can use to connect to this appservice.
     address: {{ matrix_mautrix_whatsapp_appservice_address }}
-
     # The hostname and port where this appservice should listen.
     hostname: 0.0.0.0
     port: 8080
-
     # Database config.
     database:
         # The database type. "sqlite3" and "postgres" are supported.
@@ -27,10 +29,6 @@ appservice:
         # Maximum number of connections. Mostly relevant for Postgres.
         max_open_conns: 20
         max_idle_conns: 2
-
-    # Path to the Matrix room state store.
-    state_store_path: ./mx-state.json
-
     # The unique ID of this appservice.
     id: whatsapp
     # Appservice bot details.
@@ -41,7 +39,6 @@ appservice:
         # to leave display name/avatar as-is.
         displayname: WhatsApp bridge bot
         avatar: mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr
-
     # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
     as_token: "{{ matrix_mautrix_whatsapp_appservice_token }}"
     hs_token: "{{ matrix_mautrix_whatsapp_homeserver_token }}"
@@ -51,79 +48,137 @@ bridge:
     # Localpart template of MXIDs for WhatsApp users.
     # {{ '{{.}}' }} is replaced with the phone number of the WhatsApp user.
     username_template: "{{ 'whatsapp_{{.}}' }}"
-    # Displayname template for WhatsApp users.
-    # {{ '{{.Notify'}}' }} - nickname set by the WhatsApp user
-    # {{ '{{.Jid}}' }}    - phone number (international format)
-    # The following variables are also available, but will cause problems on multi-user instances:
-    # {{ '{{.Name}}' }}   - display name from contact list
-    # {{ '{{.Short}}' }}  - short display name from contact list
-    displayname_template: "{{ '{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)' }}"
-    # WhatsApp connection timeout in seconds.
-    connection_timeout: 20
-    # Maximum number of times to retry connecting on connection error.
-    max_connection_attempts: 3
-    # Number of seconds to wait between connection attempts.
-    # Negative numbers are exponential backoff: -connection_retry_delay + 1 + 2^attempts
-    connection_retry_delay: -1
-    # Whether or not the bridge should send a notice to the user's management room when it retries connecting.
-    # If false, it will only report when it stops retrying.
-    report_connection_retry: true
-    # Maximum number of seconds to wait for chats to be sent at startup.
-    # If this is too low and you have lots of chats, it could cause backfilling to fail.
-    chat_list_wait: 30
-    # Maximum number of seconds to wait to sync portals before force unlocking message processing.
-    # If this is too low and you have lots of chats, it could cause backfilling to fail.
-    portal_sync_wait: 600
-
-    # Whether or not to send call start/end notices to Matrix.
-    call_notices:
-        start: true
-        end: true
-
-    # Number of chats to sync for new users.
-    initial_chat_sync_count: 10
-    # Number of old messages to fill when creating new portal rooms.
-    initial_history_fill_count: 20
-    # Maximum number of chats to sync when recovering from downtime.
-    # Set to -1 to sync all new chats during downtime.
-    recovery_chat_sync_limit: -1
-    # Whether or not to sync history when recovering from downtime.
-    recovery_history_backfill: true
-    # Maximum number of seconds since last message in chat to skip
-    # syncing the chat in any case. This setting will take priority
-    # over both recovery_chat_sync_limit and initial_chat_sync_count.
-    # Default is 3 days = 259200 seconds
-    sync_max_chat_age: 259200
-
-    # Whether or not to sync with custom puppets to receive EDUs that
-    # are not normally sent to appservices.
+    displayname_template: "{{ '{{if .PushName}}{{.PushName}}{{else if .BusinessName}}{{.BusinessName}}{{else}}{{.JID}}{{end}} (WA)' }}"
+    # Should the bridge send a read receipt from the bridge bot when a message has been sent to WhatsApp?
+    delivery_receipts: false
+    # Should incoming calls send a message to the Matrix room?
+    call_start_notices: true
+    # Should another user's cryptographic identity changing send a message to Matrix?
+    identity_change_notices: false
+    # Should a "reactions not yet supported" warning be sent to the Matrix room when a user reacts to a message?
+    reaction_notices: true
+    portal_message_buffer: 128
+    # Settings for handling history sync payloads. These settings only apply right after login,
+    # because the phone only sends the history sync data once, and there's no way to re-request it
+    # (other than logging out and back in again).
+    history_sync:
+        # Should the bridge create portals for chats in the history sync payload?
+        create_portals: true
+        # Maximum age of chats in seconds to create portals for. Set to 0 to create portals for all chats in sync payload.
+        max_age: 604800
+        # Enable backfilling history sync payloads from WhatsApp using batch sending?
+        # This requires a server with MSC2716 support, which is currently an experimental feature in synapse.
+        # It can be enabled by setting experimental_features -> msc2716_enabled to true in homeserver.yaml.
+        # Note that as of Synapse 1.46, there are still some bugs with the implementation, especially if using event persistence workers.
+        backfill: false
+        # Use double puppets for backfilling?
+        # In order to use this, the double puppets must be in the appservice's user ID namespace
+        # (because the bridge can't use the double puppet access token with batch sending).
+        # This only affects double puppets on the local server, double puppets on other servers will never be used.
+        # Doesn't work out of box with this playbook
+        double_puppet_backfill: false
+        # Should the bridge request a full sync from the phone when logging in?
+        # This bumps the size of history syncs from 3 months to 1 year.
+        request_full_sync: false
+    user_avatar_sync: true
+    # Should Matrix users leaving groups be bridged to WhatsApp?
+    bridge_matrix_leave: true
+    # Should the bridge sync with double puppeting to receive EDUs that aren't normally sent to appservices.
     sync_with_custom_puppets: true
-    # Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth
+    # Should the bridge update the m.direct account data event when double puppeting is enabled.
+    # Note that updating the m.direct event is not atomic (except with mautrix-asmux)
+    # and is therefore prone to race conditions.
+    sync_direct_chat_list: false
+    # When double puppeting is enabled, users can use `!wa toggle` to change whether
+    # presence and read receipts are bridged. These settings set the default values.
+    # Existing users won't be affected when these are changed.
+    default_bridge_receipts: true
+    default_bridge_presence: true
+    # Servers to always allow double puppeting from
+    double_puppet_server_map:
+        "{{ matrix_mautrix_whatsapp_homeserver_domain }}": {{ matrix_mautrix_whatsapp_homeserver_address }}
+    # Allow using double puppeting from any server with a valid client .well-known file.
+    double_puppet_allow_discovery: false
+    # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth
     #
-    # If set, custom puppets will be enabled automatically for local users
+    # If set, double puppeting will be enabled automatically for local users
     # instead of users having to find an access token and run `login-matrix`
     # manually.
-    login_shared_secret: {{ matrix_mautrix_whatsapp_login_shared_secret|to_json }}
-
-    # Whether or not to invite own WhatsApp user's Matrix puppet into private
-    # chat portals when backfilling if needed.
-    # This always uses the default puppet instead of custom puppets due to
-    # rate limits and timestamp massaging.
-    invite_own_puppet_for_backfilling: true
-    # Whether or not to explicitly set the avatar and room name for private
-    # chat portal rooms. This can be useful if the previous field works fine,
-    # but causes room avatar/name bugs.
+    login_shared_secret_map: {{ matrix_mautrix_whatsapp_bridge_login_shared_secret_map|to_json }}
+    # Should the bridge explicitly set the avatar and room name for private chat portal rooms?
     private_chat_portal_meta: false
-
+    # Should Matrix m.notice-type messages be bridged?
+    bridge_notices: true
+    # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run.
+    # This field will automatically be changed back to false after it, except if the config file is not writable.
+    resend_bridge_info: false
+    # When using double puppeting, should muted chats be muted in Matrix?
+    mute_bridging: false
+    # When using double puppeting, should archived chats be moved to a specific tag in Matrix?
+    # Note that WhatsApp unarchives chats when a message is received, which will also be mirrored to Matrix.
+    # This can be set to a tag (e.g. m.lowpriority), or null to disable.
+    archive_tag: null
+    # Same as above, but for pinned chats. The favorite tag is called m.favourite
+    pinned_tag: null
+    # Should mute status and tags only be bridged when the portal room is created?
+    tag_only_on_create: true
+    # Should WhatsApp status messages be bridged into a Matrix room?
+    # Disabling this won't affect already created status broadcast rooms.
+    enable_status_broadcast: true
+    # Should the status broadcast room be muted and moved into low priority by default?
+    # This is only applied when creating the room, the user can unmute/untag it later.
+    mute_status_broadcast: true
+    # Should the bridge use thumbnails from WhatsApp?
+    # They're disabled by default due to very low resolution.
+    whatsapp_thumbnail: false
     # Allow invite permission for user. User can invite any bots to room with whatsapp
     # users (private chat and groups)
     allow_user_invite: false
+    # Whether or not created rooms should have federation enabled.
+    # If false, created portal rooms will never be federated.
+    federate_rooms: true
 
     # The prefix for commands. Only required in non-management rooms.
     command_prefix: "!wa"
 
+    # Messages sent upon joining a management room.
+    # Markdown is supported. The defaults are listed below.
+    management_room_text:
+        # Sent when joining a room.
+        welcome: "Hello, I'm a WhatsApp bridge bot."
+        # Sent when joining a management room and the user is already logged in.
+        welcome_connected: "Use `help` for help."
+        # Sent when joining a management room and the user is not logged in.
+        welcome_unconnected: "Use `help` for help or `login` to log in."
+        # Optional extra text sent when joining a management room.
+        additional_help: ""
+
+    # End-to-bridge encryption support options.
+    #
+    # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.
+    encryption:
+        # Allow encryption, work in group chat rooms with e2ee enabled
+        allow: false
+        # Default to encryption, force-enable encryption in all portals the bridge creates
+        # This will cause the bridge bot to be in private chats for the encryption to work properly.
+        # It is recommended to also set private_chat_portal_meta to true when using this.
+        default: false
+        # Options for automatic key sharing.
+        key_sharing:
+            # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
+            # You must use a client that supports requesting keys from other users to use this feature.
+            allow: false
+            # Require the requesting device to have a valid cross-signing signature?
+            # This doesn't require that the bridge has verified the device, only that the user has verified it.
+            # Not yet implemented.
+            require_cross_signing: false
+            # Require devices to be verified by the bridge?
+            # Verification by the bridge is not yet implemented.
+            require_verification: true
+
     # Permissions for using the bridge.
     # Permitted values:
+    #    relay - Talk through the relaybot (if enabled), no access otherwise
     #     user - Access to use the bridge to chat with a WhatsApp account.
     #    admin - User level and some additional administration tools
     # Permitted keys:
@@ -133,15 +188,13 @@ bridge:
     permissions:
         "{{ matrix_mautrix_whatsapp_homeserver_domain }}": user
 
-    relaybot:
-        # Whether or not relaybot support is enabled.
+    # Settings for relay mode
+    relay:
+        # Whether relay mode should be allowed. If allowed, `!wa set-relay` can be used to turn any
+        # authenticated user into a relaybot for that chat.
         enabled: false
-        # The management room for the bot. This is where all status notifications are posted and
-        # in this room, you can use `!wa <command>` instead of `!wa relaybot <command>`. Omitting
-        # the command prefix completely like in user management rooms is not possible.
-        management: '!foo:example.com'
-        # List of users to invite to all created rooms that include the relaybot.
-        invites: []
+        # Should only admins be allowed to set themselves as relay users?
+        admin_only: true
         # The formats to use when sending messages to WhatsApp via the relaybot.
         message_formats:
             m.text: "<b>{{ '{{ .Sender.Displayname }}' }}</b>: {{ '{{ .Message }}' }}"
@@ -152,6 +205,7 @@ bridge:
             m.audio: "<b>{{ '{{ .Sender.Displayname }}' }}</b>: sent an audio file"
             m.video: "<b>{{ '{{ .Sender.Displayname }}' }}</b>: sent a video"
             m.location: "<b>{{ '{{ .Sender.Displayname }}' }}</b>: sent a location"
+
 # Logging config.
 logging:
     # The directory for log files. Will be created if not found.
diff --git a/roles/matrix-bridge-mx-puppet-discord/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-discord/tasks/setup_uninstall.yml
index b5b83c98..a0298ad9 100644
--- a/roles/matrix-bridge-mx-puppet-discord/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mx-puppet-discord/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mx-puppet-discord
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mx_puppet_discord_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml
index b1d5f0b5..3ed4867c 100644
--- a/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml
@@ -31,6 +31,7 @@
   service:
     name: matrix-mx-puppet-groupme
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mx_puppet_groupme_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_uninstall.yml
index cc4fdfa5..f9ecce58 100644
--- a/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mx-puppet-groupme
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mx_puppet_groupme_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_uninstall.yml
index 4b5e67ac..9ad4e13d 100644
--- a/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mx-puppet-instagram
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mx_puppet_instagram_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
index 997a6317..a39e7acf 100644
--- a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
@@ -31,6 +31,7 @@
   service:
     name: matrix-mx-puppet-skype
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mx_puppet_skype_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_uninstall.yml
index 72b3a945..a1af7e33 100644
--- a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mx-puppet-skype
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mx_puppet_skype_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
index d816ceeb..8ef8ac4e 100644
--- a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
@@ -31,6 +31,7 @@
   service:
     name: matrix-mx-puppet-slack
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mx_puppet_slack_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_uninstall.yml
index 73314a66..f6e7d33e 100644
--- a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mx-puppet-slack
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mx_puppet_slack_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
index 3bcef36e..a92d63fb 100644
--- a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
@@ -31,6 +31,7 @@
   service:
     name: matrix-mx-puppet-steam
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mx_puppet_steam_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_uninstall.yml
index 1ee95eb3..608bde73 100644
--- a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mx-puppet-steam
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mx_puppet_steam_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
index 5767ed17..a6250a16 100644
--- a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
@@ -31,6 +31,7 @@
   service:
     name: matrix-mx-puppet-twitter
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_mx_puppet_twitter_stat_database.stat.exists"
diff --git a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_uninstall.yml
index 1d663531..1382ee58 100644
--- a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-mx-puppet-twitter
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mx_puppet_twitter_service_stat.stat.exists"
 
diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 55f99101..d3a686ce 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -26,7 +26,7 @@ matrix_sms_bridge_systemd_wanted_services_list: []
 
 matrix_sms_bridge_appservice_url: 'http://matrix-sms-bridge:8080'
 matrix_sms_bridge_homeserver_hostname: 'matrix-synapse'
-matrix_sms_bridge_homeserver_port: '8008'
+matrix_sms_bridge_homeserver_port: ""
 
 matrix_sms_bridge_homserver_domain: "{{ matrix_domain }}"
 matrix_sms_bridge_default_room: ''
diff --git a/roles/matrix-bridge-sms/tasks/setup_uninstall.yml b/roles/matrix-bridge-sms/tasks/setup_uninstall.yml
index 03ddaad0..ad8442bc 100644
--- a/roles/matrix-bridge-sms/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-sms/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-sms-bridge
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_sms_bridge_service_stat.stat.exists"
 
@@ -16,4 +17,4 @@
   file:
     path: "{{ matrix_systemd_path }}/matrix-sms-bridge.service"
     state: absent
-  when: "matrix_sms_bridge_service_stat.stat.exists"
\ No newline at end of file
+  when: "matrix_sms_bridge_service_stat.stat.exists"
diff --git a/roles/matrix-bridge-sms/tasks/validate_config.yml b/roles/matrix-bridge-sms/tasks/validate_config.yml
index 6dc6ce9c..f89b18fa 100644
--- a/roles/matrix-bridge-sms/tasks/validate_config.yml
+++ b/roles/matrix-bridge-sms/tasks/validate_config.yml
@@ -7,6 +7,7 @@
   when: "vars[item] == ''"
   with_items:
     - "matrix_sms_bridge_appservice_token"
+    - "matrix_sms_bridge_homeserver_port"
     - "matrix_sms_bridge_homeserver_token"
     - "matrix_sms_bridge_default_region"
     - "matrix_sms_bridge_default_timezone"
diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml
index 104b778f..b05f0d85 100644
--- a/roles/matrix-client-element/defaults/main.yml
+++ b/roles/matrix-client-element/defaults/main.yml
@@ -7,7 +7,7 @@ matrix_client_element_container_image_self_build_repo: "https://github.com/vecto
 # - https://github.com/vector-im/element-web/issues/19544
 matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_memtotal_mb < 4096 }}"
 
-matrix_client_element_version: v1.9.3
+matrix_client_element_version: v1.9.5
 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}"
 matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}"
diff --git a/roles/matrix-client-element/tasks/migrate_riot_web.yml b/roles/matrix-client-element/tasks/migrate_riot_web.yml
index dd0eb0f8..304e9fbf 100644
--- a/roles/matrix-client-element/tasks/migrate_riot_web.yml
+++ b/roles/matrix-client-element/tasks/migrate_riot_web.yml
@@ -10,6 +10,7 @@
   service:
     name: matrix-riot-web
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_client_element_enabled|bool and matrix_client_riot_web_service_stat.stat.exists"
diff --git a/roles/matrix-client-element/tasks/setup_uninstall.yml b/roles/matrix-client-element/tasks/setup_uninstall.yml
index 74a4720e..82805b78 100644
--- a/roles/matrix-client-element/tasks/setup_uninstall.yml
+++ b/roles/matrix-client-element/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-client-element
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_client_element_service_stat.stat.exists|bool"
diff --git a/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml b/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml
index d72f9e3f..64d20166 100644
--- a/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml
+++ b/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-client-hydrogen
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_client_hydrogen_service_stat.stat.exists|bool"
diff --git a/roles/matrix-corporal/defaults/main.yml b/roles/matrix-corporal/defaults/main.yml
index 313f79a8..dfc71479 100644
--- a/roles/matrix-corporal/defaults/main.yml
+++ b/roles/matrix-corporal/defaults/main.yml
@@ -22,7 +22,7 @@ matrix_corporal_container_extra_arguments: []
 # List of systemd services that matrix-corporal.service depends on
 matrix_corporal_systemd_required_services_list: ['docker.service']
 
-matrix_corporal_version: 2.1.2
+matrix_corporal_version: 2.2.1
 matrix_corporal_docker_image: "{{ matrix_corporal_docker_image_name_prefix }}devture/matrix-corporal:{{ matrix_corporal_docker_image_tag }}"
 matrix_corporal_docker_image_name_prefix: "{{ 'localhost/' if matrix_corporal_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_corporal_docker_image_tag: "{{ matrix_corporal_version }}" # for backward-compatibility
@@ -36,7 +36,7 @@ matrix_corporal_var_dir_path: "{{ matrix_corporal_base_path }}/var"
 
 matrix_corporal_matrix_homeserver_domain_name: "{{ matrix_domain }}"
 
-# Controls where matrix-corporal can reach your Synapse server (e.g. "http://matrix-synapse:8008").
+# Controls where matrix-corporal can reach your Synapse server (e.g. "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}").
 # If Synapse runs on the same machine, you may need to add its service to `matrix_corporal_systemd_required_services_list`.
 matrix_corporal_matrix_homeserver_api_endpoint: ""
 
diff --git a/roles/matrix-corporal/tasks/setup_corporal.yml b/roles/matrix-corporal/tasks/setup_corporal.yml
index e668de27..8e007c4f 100644
--- a/roles/matrix-corporal/tasks/setup_corporal.yml
+++ b/roles/matrix-corporal/tasks/setup_corporal.yml
@@ -83,6 +83,7 @@
   service:
     name: matrix-corporal
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_corporal_enabled|bool and matrix_corporal_service_stat.stat.exists"
diff --git a/roles/matrix-coturn/tasks/setup_uninstall.yml b/roles/matrix-coturn/tasks/setup_uninstall.yml
index 4674903f..b642c6d0 100644
--- a/roles/matrix-coturn/tasks/setup_uninstall.yml
+++ b/roles/matrix-coturn/tasks/setup_uninstall.yml
@@ -10,6 +10,7 @@
   service:
     name: matrix-coturn
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_coturn_service_stat.stat.exists|bool"
 
@@ -17,6 +18,7 @@
   service:
     name: matrix-coturn
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_coturn_service_stat.stat.exists|bool"
diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml
index f7a84ca1..fc1f17a6 100644
--- a/roles/matrix-dimension/defaults/main.yml
+++ b/roles/matrix-dimension/defaults/main.yml
@@ -39,7 +39,7 @@ matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension
 matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"]
 matrix_dimension_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi"
 
-matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:8048"
+matrix_dimension_homeserver_federationUrl: ""
 
 
 # Database-related configuration fields.
diff --git a/roles/matrix-dimension/tasks/setup_uninstall.yml b/roles/matrix-dimension/tasks/setup_uninstall.yml
index 9bc4ac8b..21f34df0 100644
--- a/roles/matrix-dimension/tasks/setup_uninstall.yml
+++ b/roles/matrix-dimension/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-dimension
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_dimension_service_stat.stat.exists|bool"
diff --git a/roles/matrix-dynamic-dns/tasks/uninstall.yml b/roles/matrix-dynamic-dns/tasks/uninstall.yml
index f3caba25..9d511051 100644
--- a/roles/matrix-dynamic-dns/tasks/uninstall.yml
+++ b/roles/matrix-dynamic-dns/tasks/uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-dynamic-dns
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_dynamic_dns_service_stat.stat.exists"
 
diff --git a/roles/matrix-email2matrix/tasks/setup_uninstall.yml b/roles/matrix-email2matrix/tasks/setup_uninstall.yml
index b0b44cca..270b9250 100644
--- a/roles/matrix-email2matrix/tasks/setup_uninstall.yml
+++ b/roles/matrix-email2matrix/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-email2matrix
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_email2matrix_service_stat.stat.exists|bool"
diff --git a/roles/matrix-etherpad/tasks/setup_uninstall.yml b/roles/matrix-etherpad/tasks/setup_uninstall.yml
index 8f40f420..a63d3fb1 100644
--- a/roles/matrix-etherpad/tasks/setup_uninstall.yml
+++ b/roles/matrix-etherpad/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-etherpad
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_etherpad_service_stat.stat.exists|bool"
diff --git a/roles/matrix-grafana/tasks/setup.yml b/roles/matrix-grafana/tasks/setup.yml
index 00d2e230..c5cee64c 100644
--- a/roles/matrix-grafana/tasks/setup.yml
+++ b/roles/matrix-grafana/tasks/setup.yml
@@ -93,6 +93,7 @@
   service:
     name: matrix-grafana
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_grafana_enabled|bool and matrix_grafana_service_stat.stat.exists"
diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_jicofo.yml b/roles/matrix-jitsi/tasks/setup_jitsi_jicofo.yml
index dd2a7bd2..4e2be696 100644
--- a/roles/matrix-jitsi/tasks/setup_jitsi_jicofo.yml
+++ b/roles/matrix-jitsi/tasks/setup_jitsi_jicofo.yml
@@ -68,6 +68,7 @@
   service:
     name: matrix-jitsi-jicofo
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_jitsi_enabled|bool and matrix_jitsi_jicofo_service_stat.stat.exists"
diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml b/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml
index b73426db..558a6cf1 100644
--- a/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml
+++ b/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml
@@ -68,6 +68,7 @@
   service:
     name: matrix-jitsi-jvb
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_jitsi_enabled|bool and matrix_jitsi_jvb_service_stat.stat.exists"
diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_prosody.yml b/roles/matrix-jitsi/tasks/setup_jitsi_prosody.yml
index fd051fda..39a571ae 100644
--- a/roles/matrix-jitsi/tasks/setup_jitsi_prosody.yml
+++ b/roles/matrix-jitsi/tasks/setup_jitsi_prosody.yml
@@ -59,6 +59,7 @@
   service:
     name: matrix-jitsi-prosody
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_jitsi_enabled|bool and matrix_jitsi_prosody_service_stat.stat.exists"
diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_web.yml b/roles/matrix-jitsi/tasks/setup_jitsi_web.yml
index 2b8a2cd2..4fdcc67b 100644
--- a/roles/matrix-jitsi/tasks/setup_jitsi_web.yml
+++ b/roles/matrix-jitsi/tasks/setup_jitsi_web.yml
@@ -69,6 +69,7 @@
   service:
     name: matrix-jitsi-web
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_jitsi_enabled|bool and matrix_jitsi_web_service_stat.stat.exists"
diff --git a/roles/matrix-jitsi/templates/jvb/env.j2 b/roles/matrix-jitsi/templates/jvb/env.j2
index a927314e..6edae6d4 100644
--- a/roles/matrix-jitsi/templates/jvb/env.j2
+++ b/roles/matrix-jitsi/templates/jvb/env.j2
@@ -22,4 +22,6 @@ JVB_OCTO_BIND_ADDRESS
 JVB_OCTO_PUBLIC_ADDRESS
 JVB_OCTO_BIND_PORT
 JVB_OCTO_REGION
-TZ={{ matrix_jitsi_timezone }}
\ No newline at end of file
+TZ={{ matrix_jitsi_timezone }}
+
+{{ matrix_jitsi_jvb_environment_variables_extension }}
diff --git a/roles/matrix-jitsi/templates/web/env.j2 b/roles/matrix-jitsi/templates/web/env.j2
index c4faa5ba..2ff6befc 100644
--- a/roles/matrix-jitsi/templates/web/env.j2
+++ b/roles/matrix-jitsi/templates/web/env.j2
@@ -91,4 +91,6 @@ XMPP_DOMAIN={{ matrix_jitsi_xmpp_domain }}
 XMPP_GUEST_DOMAIN={{ matrix_jitsi_xmpp_guest_domain }}
 XMPP_MUC_DOMAIN={{ matrix_jitsi_xmpp_muc_domain }}
 XMPP_RECORDER_DOMAIN={{ matrix_jitsi_recorder_domain }}
-TOKEN_AUTH_URL
\ No newline at end of file
+TOKEN_AUTH_URL
+
+{{ matrix_jitsi_web_environment_variables_extension }}
diff --git a/roles/matrix-ma1sd/defaults/main.yml b/roles/matrix-ma1sd/defaults/main.yml
index adee0b44..6929f5cd 100644
--- a/roles/matrix-ma1sd/defaults/main.yml
+++ b/roles/matrix-ma1sd/defaults/main.yml
@@ -19,8 +19,8 @@ matrix_ma1sd_docker_src_files_path: "{{ matrix_ma1sd_base_path }}/docker-src/ma1
 matrix_ma1sd_config_path: "{{ matrix_ma1sd_base_path }}/config"
 matrix_ma1sd_data_path: "{{ matrix_ma1sd_base_path }}/data"
 
-matrix_ma1sd_default_port: 8090
-# Controls whether the matrix-ma1sd container exposes its HTTP port (tcp/{{ matrix_ma1sd_default_port }} in the container).
+matrix_ma1sd_container_port: 8090
+# Controls whether the matrix-ma1sd container exposes its HTTP port (tcp/{{ matrix_ma1sd_container_port }} in the container).
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8090"), or empty string to not expose.
 matrix_ma1sd_container_http_host_bind_port: ''
@@ -83,7 +83,7 @@ matrix_ma1sd_threepid_medium_email_connectors_smtp_password: ""
 # so that ma1sd can rewrite the original URL to one that would reach the homeserver.
 matrix_ma1sd_dns_overwrite_enabled: false
 matrix_ma1sd_dns_overwrite_homeserver_client_name: "{{ matrix_server_fqn_matrix }}"
-matrix_ma1sd_dns_overwrite_homeserver_client_value: "http://matrix-synapse:8008"
+matrix_ma1sd_dns_overwrite_homeserver_client_value: ""
 
 # Override the default session templates
 # To use this, fill in the template variables with the full desired template as a multi-line YAML variable
diff --git a/roles/matrix-ma1sd/tasks/migrate_mxisd.yml b/roles/matrix-ma1sd/tasks/migrate_mxisd.yml
index 1d966204..c36c3de9 100644
--- a/roles/matrix-ma1sd/tasks/migrate_mxisd.yml
+++ b/roles/matrix-ma1sd/tasks/migrate_mxisd.yml
@@ -23,6 +23,7 @@
   service:
     name: matrix-mxisd
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_mxisd_service_stat.stat.exists"
 
diff --git a/roles/matrix-ma1sd/tasks/setup_uninstall.yml b/roles/matrix-ma1sd/tasks/setup_uninstall.yml
index b36ab508..153f6e08 100644
--- a/roles/matrix-ma1sd/tasks/setup_uninstall.yml
+++ b/roles/matrix-ma1sd/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-ma1sd
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_ma1sd_service_stat.stat.exists|bool"
diff --git a/roles/matrix-ma1sd/tasks/validate_config.yml b/roles/matrix-ma1sd/tasks/validate_config.yml
index 4f80b154..5f621fca 100644
--- a/roles/matrix-ma1sd/tasks/validate_config.yml
+++ b/roles/matrix-ma1sd/tasks/validate_config.yml
@@ -46,6 +46,7 @@
   when: "vars[item] == ''"
   with_items:
     - "matrix_ma1sd_threepid_medium_email_connectors_smtp_host"
+    - "matrix_ma1sd_dns_overwrite_homeserver_client_value"
 
 - name: (Deprecation) Catch and report renamed ma1sd variables
   fail:
@@ -56,6 +57,7 @@
   with_items:
     - {'old': 'matrix_ma1sd_container_expose_port', 'new': '<superseded by matrix_ma1sd_container_http_host_bind_port>'}
     - {'old': 'matrix_ma1sd_threepid_medium_email_custom_unbind_fraudulent_template', 'new': 'matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template'}
+    - {'old': 'matrix_ma1sd_default_port', 'new': 'matrix_ma1sd_container_port'}
 
 - name: (Deprecation) Catch and report mxisd variables
   fail:
diff --git a/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 b/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2
index 696e8008..8e5cc6dd 100644
--- a/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2
+++ b/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2
@@ -26,7 +26,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-ma1sd \
 			--tmpfs=/tmp:rw,exec,nosuid,size=10m \
 			--network={{ matrix_docker_network }} \
 			{% if matrix_ma1sd_container_http_host_bind_port %}
-			-p {{ matrix_ma1sd_container_http_host_bind_port }}:{{ matrix_ma1sd_default_port }} \
+			-p {{ matrix_ma1sd_container_http_host_bind_port }}:{{ matrix_ma1sd_container_port }} \
 			{% endif %}
 			{% if matrix_ma1sd_verbose_logging %}
 			-e MA1SD_LOG_LEVEL=debug \
diff --git a/roles/matrix-mailer/defaults/main.yml b/roles/matrix-mailer/defaults/main.yml
index 71a33752..e60ea50f 100644
--- a/roles/matrix-mailer/defaults/main.yml
+++ b/roles/matrix-mailer/defaults/main.yml
@@ -7,7 +7,7 @@ matrix_mailer_container_image_self_build_repository_url: "https://github.com/dev
 matrix_mailer_container_image_self_build_src_files_path: "{{ matrix_mailer_base_path }}/docker-src"
 matrix_mailer_container_image_self_build_version: "{{ matrix_mailer_docker_image.split(':')[1] }}"
 
-matrix_mailer_version: 4.94.2-r0-4
+matrix_mailer_version: 4.94.2-r0-5
 matrix_mailer_docker_image: "{{ matrix_mailer_docker_image_name_prefix }}devture/exim-relay:{{ matrix_mailer_version }}"
 matrix_mailer_docker_image_name_prefix: "{{ 'localhost/' if matrix_mailer_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_mailer_docker_image_force_pull: "{{ matrix_mailer_docker_image.endswith(':latest') }}"
diff --git a/roles/matrix-mailer/tasks/setup_mailer.yml b/roles/matrix-mailer/tasks/setup_mailer.yml
index 251a52da..def17883 100644
--- a/roles/matrix-mailer/tasks/setup_mailer.yml
+++ b/roles/matrix-mailer/tasks/setup_mailer.yml
@@ -79,6 +79,7 @@
   service:
     name: matrix-mailer
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_mailer_enabled|bool and matrix_mailer_service_stat.stat.exists"
diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml
index ff917c90..5a4a873c 100644
--- a/roles/matrix-nginx-proxy/defaults/main.yml
+++ b/roles/matrix-nginx-proxy/defaults/main.yml
@@ -1,5 +1,5 @@
 matrix_nginx_proxy_enabled: true
-matrix_nginx_proxy_version: 1.21.3-alpine
+matrix_nginx_proxy_version: 1.21.4-alpine
 
 # We use an official nginx image, which we fix-up to run unprivileged.
 # An alternative would be an `nginxinc/nginx-unprivileged` image, but
@@ -115,9 +115,10 @@ matrix_nginx_proxy_proxy_riot_compat_redirect_hostname: "riot.{{ matrix_domain }
 matrix_nginx_proxy_proxy_synapse_enabled: false
 matrix_nginx_proxy_proxy_synapse_hostname: "matrix-nginx-proxy"
 matrix_nginx_proxy_proxy_synapse_federation_api_enabled: "{{ matrix_nginx_proxy_proxy_matrix_federation_api_enabled }}"
+
 # The addresses where the Federation API is, when using Synapse.
-matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:8048"
-matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:8048"
+matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: ""
+matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: ""
 
 # Controls whether proxying the Element domain should be done.
 matrix_nginx_proxy_proxy_element_enabled: false
@@ -165,20 +166,20 @@ matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:410
 # This can be used to forward the API endpoint to another service, augmenting the functionality of Synapse's own User Directory Search.
 # To learn more, see: https://github.com/ma1uta/ma1sd/blob/master/docs/features/directory.md
 matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled: false
-matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}"
-matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}"
+matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}"
+matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}"
 
 # Controls whether proxying for 3PID-based registration (`/_matrix/client/r0/register/(email|msisdn)/requestToken`) should be done (on the matrix domain).
 # This allows another service to control registrations involving 3PIDs.
 # To learn more, see: https://github.com/ma1uta/ma1sd/blob/master/docs/features/registration.md
 matrix_nginx_proxy_proxy_matrix_3pid_registration_enabled: false
-matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}"
-matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}"
+matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}"
+matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}"
 
 # Controls whether proxying for the Identity API (`/_matrix/identity`) should be done (on the matrix domain)
 matrix_nginx_proxy_proxy_matrix_identity_api_enabled: false
-matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}"
-matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}"
+matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}"
+matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}"
 
 # Controls whether proxying for metrics (`/_synapse/metrics`) should be done (on the matrix domain)
 matrix_nginx_proxy_proxy_synapse_metrics: false
@@ -196,8 +197,8 @@ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "matrix-nginx-pr
 matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:12080"
 
 # The addresses where the Matrix Client API is, when using Synapse.
-matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: "matrix-synapse:8008"
-matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: "127.0.0.1:8008"
+matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: ""
+matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: ""
 
 # This needs to be equal or higher than the maximum upload size accepted by Synapse.
 matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 50
@@ -437,7 +438,7 @@ matrix_ssl_additional_domains_to_obtain_certificates_for: []
 
 # Controls whether to obtain production or staging certificates from Let's Encrypt.
 matrix_ssl_lets_encrypt_staging: false
-matrix_ssl_lets_encrypt_certbot_docker_image: "{{ matrix_container_global_registry_prefix }}certbot/certbot:{{ matrix_ssl_architecture }}-v1.20.0"
+matrix_ssl_lets_encrypt_certbot_docker_image: "{{ matrix_container_global_registry_prefix }}certbot/certbot:{{ matrix_ssl_architecture }}-v1.21.0"
 matrix_ssl_lets_encrypt_certbot_docker_image_force_pull: "{{ matrix_ssl_lets_encrypt_certbot_docker_image.endswith(':latest') }}"
 matrix_ssl_lets_encrypt_certbot_standalone_http_port: 2402
 matrix_ssl_lets_encrypt_support_email: ~
diff --git a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
index e577491b..d325d2f0 100644
--- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
+++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
@@ -193,6 +193,7 @@
   service:
     name: matrix-nginx-proxy
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_nginx_proxy_enabled|bool and matrix_nginx_proxy_service_stat.stat.exists"
diff --git a/roles/matrix-nginx-proxy/tasks/validate_config.yml b/roles/matrix-nginx-proxy/tasks/validate_config.yml
index 9661ae5e..0de93873 100644
--- a/roles/matrix-nginx-proxy/tasks/validate_config.yml
+++ b/roles/matrix-nginx-proxy/tasks/validate_config.yml
@@ -43,5 +43,9 @@
         msg: "The `{{ item }}` variable must be defined and have a non-null value"
       with_items:
         - "matrix_ssl_lets_encrypt_support_email"
+        - "matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container"
+        - "matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container"
+        - "matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container"
+        - "matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container"
       when: "vars[item] == '' or vars[item] is none"
   when: "matrix_ssl_retrieval_method == 'lets-encrypt'"
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2
index b0294283..3aff997d 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2
@@ -36,6 +36,7 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
 
 	server_name {{ matrix_nginx_proxy_base_domain_hostname }};
 	server_tokens off;
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-bot-go-neb.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-bot-go-neb.conf.j2
index 6cb5f57a..79269f43 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-bot-go-neb.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-bot-go-neb.conf.j2
@@ -33,6 +33,8 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
 	server_name {{ matrix_nginx_proxy_proxy_bot_go_neb_hostname }};
 
 	server_tokens off;
@@ -83,7 +85,7 @@ server {
 		ssl_stapling_verify on;
 		ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_bot_go_neb_hostname }}/chain.pem;
 	{% endif %}
-	
+
 	{% if matrix_nginx_proxy_ssl_session_tickets_off %}
 		ssl_session_tickets off;
 	{% endif %}
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-element.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-element.conf.j2
index 2f4f4aa1..095d5fcf 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-element.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-element.conf.j2
@@ -41,6 +41,8 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
 
 	server_name {{ matrix_nginx_proxy_proxy_element_hostname }};
 
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-hydrogen.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-hydrogen.conf.j2
index 1ea4a344..c0794205 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-hydrogen.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-hydrogen.conf.j2
@@ -39,6 +39,8 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
 
 	server_name {{ matrix_nginx_proxy_proxy_hydrogen_hostname }};
 
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2
index ef8ee972..292cc4c2 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2
@@ -36,6 +36,8 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
 	server_name {{ matrix_nginx_proxy_proxy_dimension_hostname }};
 
 	server_tokens off;
@@ -86,7 +88,7 @@ server {
 		ssl_stapling_verify on;
 		ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_dimension_hostname }}/chain.pem;
 	{% endif %}
-	
+
 	{% if matrix_nginx_proxy_ssl_session_tickets_off %}
 		ssl_session_tickets off;
 	{% endif %}
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2
index b6506b43..02201b9c 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2
@@ -161,6 +161,8 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
 	server_name {{ matrix_nginx_proxy_proxy_matrix_hostname }};
 
 	server_tokens off;
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-grafana.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-grafana.conf.j2
index 0f7c43c5..209c1cd0 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-grafana.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-grafana.conf.j2
@@ -43,6 +43,8 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
 
 	server_name {{ matrix_nginx_proxy_proxy_grafana_hostname }};
 
@@ -94,12 +96,12 @@ server {
 		ssl_stapling_verify on;
 		ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_grafana_hostname }}/chain.pem;
 	{% endif %}
-	
+
 	{% if matrix_nginx_proxy_ssl_session_tickets_off %}
 		ssl_session_tickets off;
 	{% endif %}
 	ssl_session_cache {{ matrix_nginx_proxy_ssl_session_cache }};
-	ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }};	
+	ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }};
 
 	{{ render_vhost_directives() }}
 }
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2
index 86d95453..7fccce94 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2
@@ -78,6 +78,8 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
 	server_name {{ matrix_nginx_proxy_proxy_jitsi_hostname }};
 
 	server_tokens off;
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-riot-web.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-riot-web.conf.j2
index d153d5c2..5bcbeba5 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-riot-web.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-riot-web.conf.j2
@@ -24,6 +24,8 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
 
 	server_name {{ matrix_nginx_proxy_proxy_riot_compat_redirect_hostname }};
 
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sygnal.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sygnal.conf.j2
index 9c4af1d9..ba442b37 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sygnal.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sygnal.conf.j2
@@ -35,6 +35,8 @@
 
 server {
 	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
 	server_name {{ matrix_nginx_proxy_proxy_sygnal_hostname }};
 
 	server_tokens off;
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2
index 6f569327..720b5086 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2
@@ -62,7 +62,9 @@
 
 server {
 	listen 12080;
-	server_name {{ matrix_nginx_proxy_proxy_synapse_hostname }};
+	{% if matrix_nginx_proxy_enabled %}
+		server_name {{ matrix_nginx_proxy_proxy_synapse_hostname }};
+	{% endif %}
 
 	server_tokens off;
 	root /dev/null;
@@ -118,7 +120,7 @@ server {
 			{% endfor %}
 			{% if matrix_nginx_proxy_synapse_presence_disabled %}
 			# FIXME: keep in sync with synapse workers documentation manually
-			location ~ ^/_matrix/client/(api/v1|r0|unstable)/presence/[^/]+/status {
+			location ~ ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/[^/]+/status {
 				proxy_pass http://frontend_proxy_upstream$request_uri;
 				proxy_set_header Host $host;
 			}
@@ -194,8 +196,10 @@ server {
 {% if matrix_nginx_proxy_proxy_synapse_federation_api_enabled %}
 server {
 	listen 12088;
+	{% if matrix_nginx_proxy_enabled %}
+		server_name {{ matrix_nginx_proxy_proxy_synapse_hostname }};
+	{% endif %}
 
-	server_name {{ matrix_nginx_proxy_proxy_synapse_hostname }};
 	server_tokens off;
 
 	root /dev/null;
diff --git a/roles/matrix-postgres-backup/defaults/main.yml b/roles/matrix-postgres-backup/defaults/main.yml
index 522764ac..e1f252fe 100644
--- a/roles/matrix-postgres-backup/defaults/main.yml
+++ b/roles/matrix-postgres-backup/defaults/main.yml
@@ -32,6 +32,7 @@ matrix_postgres_backup_docker_image_v10: "{{ matrix_container_global_registry_pr
 matrix_postgres_backup_docker_image_v11: "{{ matrix_container_global_registry_prefix }}prodrigestivill/postgres-backup-local:11{{ matrix_postgres_backup_docker_image_suffix }}"
 matrix_postgres_backup_docker_image_v12: "{{ matrix_container_global_registry_prefix }}prodrigestivill/postgres-backup-local:12{{ matrix_postgres_backup_docker_image_suffix }}"
 matrix_postgres_backup_docker_image_v13: "{{ matrix_container_global_registry_prefix }}prodrigestivill/postgres-backup-local:13{{ matrix_postgres_backup_docker_image_suffix }}"
+matrix_postgres_backup_docker_image_v14: "{{ matrix_container_global_registry_prefix }}prodrigestivill/postgres-backup-local:14{{ matrix_postgres_backup_docker_image_suffix }}"
 matrix_postgres_backup_docker_image_latest: "{{ matrix_postgres_backup_docker_image_v13 }}"
 
 # This variable is assigned at runtime. Overriding its value has no effect.
diff --git a/roles/matrix-postgres-backup/tasks/setup_postgres_backup.yml b/roles/matrix-postgres-backup/tasks/setup_postgres_backup.yml
index 9761088d..68eae443 100644
--- a/roles/matrix-postgres-backup/tasks/setup_postgres_backup.yml
+++ b/roles/matrix-postgres-backup/tasks/setup_postgres_backup.yml
@@ -69,6 +69,7 @@
   service:
     name: matrix-postgres-backup
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "not matrix_postgres_backup_enabled|bool and matrix_postgres_backup_service_stat.stat.exists"
 
diff --git a/roles/matrix-postgres-backup/tasks/util/detect_existing_postgres_version.yml b/roles/matrix-postgres-backup/tasks/util/detect_existing_postgres_version.yml
index 87a81f74..10828cc7 100644
--- a/roles/matrix-postgres-backup/tasks/util/detect_existing_postgres_version.yml
+++ b/roles/matrix-postgres-backup/tasks/util/detect_existing_postgres_version.yml
@@ -54,3 +54,8 @@
   set_fact:
     matrix_postgres_backup_detected_version_corresponding_docker_image: "{{ matrix_postgres_backup_docker_image_v12 }}"
   when: "matrix_postgres_backup_detected_version == '12' or matrix_postgres_backup_detected_version.startswith('12.')"
+
+- name: Determine corresponding Docker image to detected version (use 13.x, if detected)
+  set_fact:
+    matrix_postgres_backup_detected_version_corresponding_docker_image: "{{ matrix_postgres_backup_docker_image_v13 }}"
+  when: "matrix_postgres_backup_detected_version == '13' or matrix_postgres_backup_detected_version.startswith('13.')"
diff --git a/roles/matrix-postgres/defaults/main.yml b/roles/matrix-postgres/defaults/main.yml
index 91a31d99..42413286 100644
--- a/roles/matrix-postgres/defaults/main.yml
+++ b/roles/matrix-postgres/defaults/main.yml
@@ -18,11 +18,11 @@ matrix_postgres_architecture: amd64
 matrix_postgres_docker_image_suffix: "{{ '-alpine' if matrix_postgres_architecture in ['amd64', 'arm64'] else '' }}"
 
 matrix_postgres_docker_image_v9: "{{ matrix_container_global_registry_prefix }}postgres:9.6.23{{ matrix_postgres_docker_image_suffix }}"
-matrix_postgres_docker_image_v10: "{{ matrix_container_global_registry_prefix }}postgres:10.18{{ matrix_postgres_docker_image_suffix }}"
-matrix_postgres_docker_image_v11: "{{ matrix_container_global_registry_prefix }}postgres:11.13{{ matrix_postgres_docker_image_suffix }}"
-matrix_postgres_docker_image_v12: "{{ matrix_container_global_registry_prefix }}postgres:12.8{{ matrix_postgres_docker_image_suffix }}"
-matrix_postgres_docker_image_v13: "{{ matrix_container_global_registry_prefix }}postgres:13.4{{ matrix_postgres_docker_image_suffix }}"
-matrix_postgres_docker_image_v14: "{{ matrix_container_global_registry_prefix }}postgres:14.0{{ matrix_postgres_docker_image_suffix }}"
+matrix_postgres_docker_image_v10: "{{ matrix_container_global_registry_prefix }}postgres:10.19{{ matrix_postgres_docker_image_suffix }}"
+matrix_postgres_docker_image_v11: "{{ matrix_container_global_registry_prefix }}postgres:11.14{{ matrix_postgres_docker_image_suffix }}"
+matrix_postgres_docker_image_v12: "{{ matrix_container_global_registry_prefix }}postgres:12.9{{ matrix_postgres_docker_image_suffix }}"
+matrix_postgres_docker_image_v13: "{{ matrix_container_global_registry_prefix }}postgres:13.5{{ matrix_postgres_docker_image_suffix }}"
+matrix_postgres_docker_image_v14: "{{ matrix_container_global_registry_prefix }}postgres:14.1{{ matrix_postgres_docker_image_suffix }}"
 matrix_postgres_docker_image_latest: "{{ matrix_postgres_docker_image_v14 }}"
 
 # This variable is assigned at runtime. Overriding its value has no effect.
diff --git a/roles/matrix-postgres/tasks/migrate_postgres_data_directory.yml b/roles/matrix-postgres/tasks/migrate_postgres_data_directory.yml
index ef5fbf47..e62feee3 100644
--- a/roles/matrix-postgres/tasks/migrate_postgres_data_directory.yml
+++ b/roles/matrix-postgres/tasks/migrate_postgres_data_directory.yml
@@ -69,4 +69,4 @@
 - name: Ensure systemd reloaded after getting rid of outdated matrix-postgres.service
   service:
     daemon_reload: yes
-  when: "result_pg_old_data_dir_stat.stat.exists"
\ No newline at end of file
+  when: "result_pg_old_data_dir_stat.stat.exists"
diff --git a/roles/matrix-postgres/tasks/setup_postgres.yml b/roles/matrix-postgres/tasks/setup_postgres.yml
index 4294bc11..96a20d25 100644
--- a/roles/matrix-postgres/tasks/setup_postgres.yml
+++ b/roles/matrix-postgres/tasks/setup_postgres.yml
@@ -18,6 +18,11 @@
     matrix_postgres_docker_image_to_use: "{{ matrix_postgres_docker_image_latest if matrix_postgres_detected_version_corresponding_docker_image == '' else matrix_postgres_detected_version_corresponding_docker_image }}"
   when: matrix_postgres_enabled|bool
 
+- name: Abort if on an unsupported Postgres version
+  fail:
+    msg: "You're on Postgres {{ matrix_postgres_detected_version }}, which is no longer supported. To upgrade, see docs/maintenance-postgres.md"
+  when: "matrix_postgres_enabled|bool and matrix_postgres_detected_version.startswith('9.')"
+
 - name: Inject warning if on an old version of Postgres
   set_fact:
     matrix_playbook_runtime_results: |
diff --git a/roles/matrix-prometheus-node-exporter/tasks/setup.yml b/roles/matrix-prometheus-node-exporter/tasks/setup.yml
index 34086e6c..fa8eb767 100644
--- a/roles/matrix-prometheus-node-exporter/tasks/setup.yml
+++ b/roles/matrix-prometheus-node-exporter/tasks/setup.yml
@@ -38,6 +38,7 @@
   service:
     name: matrix-prometheus-node-exporter
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_prometheus_node_exporter_enabled|bool and matrix_prometheus_node_exporter_service_stat.stat.exists"
diff --git a/roles/matrix-prometheus-postgres-exporter/tasks/setup.yml b/roles/matrix-prometheus-postgres-exporter/tasks/setup.yml
index 076ece1a..37743b66 100644
--- a/roles/matrix-prometheus-postgres-exporter/tasks/setup.yml
+++ b/roles/matrix-prometheus-postgres-exporter/tasks/setup.yml
@@ -38,6 +38,7 @@
   service:
     name: matrix-prometheus-postgres-exporter
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_prometheus_postgres_exporter_enabled|bool and matrix_prometheus_postgres_exporter_service_stat.stat.exists"
diff --git a/roles/matrix-prometheus/tasks/setup_uninstall.yml b/roles/matrix-prometheus/tasks/setup_uninstall.yml
index dd46a222..d99c1a8e 100644
--- a/roles/matrix-prometheus/tasks/setup_uninstall.yml
+++ b/roles/matrix-prometheus/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-prometheus
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_prometheus_service_stat.stat.exists|bool"
diff --git a/roles/matrix-redis/tasks/setup_redis.yml b/roles/matrix-redis/tasks/setup_redis.yml
index 6f00282b..f1f32238 100644
--- a/roles/matrix-redis/tasks/setup_redis.yml
+++ b/roles/matrix-redis/tasks/setup_redis.yml
@@ -72,6 +72,7 @@
   service:
     name: matrix-redis
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "not matrix_redis_enabled|bool and matrix_redis_service_stat.stat.exists"
 
diff --git a/roles/matrix-registration/tasks/setup_uninstall.yml b/roles/matrix-registration/tasks/setup_uninstall.yml
index 573f8170..8afd1084 100644
--- a/roles/matrix-registration/tasks/setup_uninstall.yml
+++ b/roles/matrix-registration/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-registration
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_registration_service_stat.stat.exists|bool"
diff --git a/roles/matrix-sygnal/tasks/setup_uninstall.yml b/roles/matrix-sygnal/tasks/setup_uninstall.yml
index dc50078c..f2b6133f 100644
--- a/roles/matrix-sygnal/tasks/setup_uninstall.yml
+++ b/roles/matrix-sygnal/tasks/setup_uninstall.yml
@@ -9,6 +9,7 @@
   service:
     name: matrix-sygnal
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_sygnal_service_stat.stat.exists|bool"
diff --git a/roles/matrix-synapse-admin/tasks/setup.yml b/roles/matrix-synapse-admin/tasks/setup.yml
index 6fb47fb3..d54583af 100644
--- a/roles/matrix-synapse-admin/tasks/setup.yml
+++ b/roles/matrix-synapse-admin/tasks/setup.yml
@@ -59,6 +59,7 @@
   service:
     name: matrix-synapse-admin
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "not matrix_synapse_admin_enabled|bool and matrix_synapse_admin_service_stat.stat.exists"
diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml
index ce596c6b..56d448df 100644
--- a/roles/matrix-synapse/defaults/main.yml
+++ b/roles/matrix-synapse/defaults/main.yml
@@ -15,8 +15,8 @@ matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_cont
 # amd64 gets released first.
 # arm32 relies on self-building, so the same version can be built immediately.
 # arm64 users need to wait for a prebuilt image to become available.
-matrix_synapse_version: v1.46.0
-matrix_synapse_version_arm64: v1.46.0
+matrix_synapse_version: v1.47.1
+matrix_synapse_version_arm64: v1.47.1
 matrix_synapse_docker_image_tag: "{{ matrix_synapse_version if matrix_architecture in ['arm32', 'amd64'] else matrix_synapse_version_arm64 }}"
 matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}"
 
@@ -27,7 +27,13 @@ matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage"
 matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store"
 matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext"
 
-# Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/8008 in the container).
+matrix_synapse_container_client_api_port: 8008
+
+matrix_synapse_container_federation_api_tls_port: 8448
+
+matrix_synapse_container_federation_api_plain_port: 8048
+
+# Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/{{ matrix_synapse_container_client_api_port }} in the container).
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8008"), or empty string to not expose.
 matrix_synapse_container_client_api_host_bind_port: ''
@@ -146,7 +152,7 @@ matrix_synapse_federation_rr_transactions_per_room_per_second: 50
 
 # Controls whether the TLS federation listener is enabled (tcp/8448).
 # Only makes sense if federation is enabled (`matrix_synapse_federation_enabled`).
-# Note that federation may potentially be enabled as non-TLS on tcp/8048 as well.
+# Note that federation may potentially be enabled as non-TLS on `matrix_synapse_container_federation_api_plain_port` as well.
 # If you're serving Synapse behind an HTTPS-capable reverse-proxy,
 # you can disable the TLS listener (`matrix_synapse_tls_federation_listener_enabled: false`).
 matrix_synapse_tls_federation_listener_enabled: true
@@ -467,6 +473,8 @@ matrix_synapse_turn_allow_guests: False
 matrix_synapse_email_enabled: false
 matrix_synapse_email_smtp_host: ""
 matrix_synapse_email_smtp_port: 587
+matrix_synapse_email_smtp_user: ""
+matrix_synapse_email_smtp_pass: ""
 matrix_synapse_email_smtp_require_transport_security: false
 matrix_synapse_email_notif_from: "Matrix <matrix@{{ matrix_domain }}>"
 matrix_synapse_email_client_base_url: "https://{{ matrix_server_fqn_element }}"
diff --git a/roles/matrix-synapse/files/workers-doc-to-yaml.awk b/roles/matrix-synapse/files/workers-doc-to-yaml.awk
index d9295e32..ca58b486 100755
--- a/roles/matrix-synapse/files/workers-doc-to-yaml.awk
+++ b/roles/matrix-synapse/files/workers-doc-to-yaml.awk
@@ -86,7 +86,7 @@ enable_parsing {
 
                 # FIXME: https://github.com/matrix-org/synapse/issues/7530
                 # https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/456#issuecomment-719015911
-                if (api_endpoint_regex == "^/_matrix/client/(r0|unstable)/auth/.*/fallback/web$") {
+                if (api_endpoint_regex == "^/_matrix/client/(r0|v3|unstable)/auth/.*/fallback/web$") {
                     worker_stanza_append("  # FIXME: possible bug with SSO and multiple generic workers\n")
                     worker_stanza_append("  # see https://github.com/matrix-org/synapse/issues/7530\n")
                     worker_stanza_append("  # " api_endpoint_regex linefeed)
diff --git a/roles/matrix-synapse/tasks/goofys/setup_uninstall.yml b/roles/matrix-synapse/tasks/goofys/setup_uninstall.yml
index 91d43456..317a5371 100644
--- a/roles/matrix-synapse/tasks/goofys/setup_uninstall.yml
+++ b/roles/matrix-synapse/tasks/goofys/setup_uninstall.yml
@@ -7,6 +7,7 @@
   service:
     name: matrix-goofys
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_goofys_service_stat.stat.exists"
diff --git a/roles/matrix-synapse/tasks/import_media_store.yml b/roles/matrix-synapse/tasks/import_media_store.yml
index 487bcb35..42455b44 100644
--- a/roles/matrix-synapse/tasks/import_media_store.yml
+++ b/roles/matrix-synapse/tasks/import_media_store.yml
@@ -44,6 +44,7 @@
   service:
     name: matrix-synapse
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
 
diff --git a/roles/matrix-synapse/tasks/synapse/setup_install.yml b/roles/matrix-synapse/tasks/synapse/setup_install.yml
index b658cfff..09ec798d 100644
--- a/roles/matrix-synapse/tasks/synapse/setup_install.yml
+++ b/roles/matrix-synapse/tasks/synapse/setup_install.yml
@@ -67,8 +67,6 @@
     --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
     --cap-drop=ALL
     --mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data
-    -e UID={{ matrix_user_uid }}
-    -e GID={{ matrix_user_gid }}
     -e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
     -e SYNAPSE_SERVER_NAME={{ matrix_server_fqn_matrix }}
     -e SYNAPSE_REPORT_STATS=no
diff --git a/roles/matrix-synapse/tasks/synapse/setup_uninstall.yml b/roles/matrix-synapse/tasks/synapse/setup_uninstall.yml
index f1cdf167..070856e4 100644
--- a/roles/matrix-synapse/tasks/synapse/setup_uninstall.yml
+++ b/roles/matrix-synapse/tasks/synapse/setup_uninstall.yml
@@ -7,6 +7,7 @@
   service:
     name: matrix-synapse
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_synapse_service_stat.stat.exists"
diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2
index cebe7a1f..042ea083 100644
--- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2
+++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2
@@ -66,8 +66,28 @@ pid_file: /homeserver.pid
 # Otherwise, it should be the URL to reach Synapse's client HTTP listener (see
 # 'listeners' below).
 #
+# Defaults to 'https://<server_name>/'.
+#
 public_baseurl: https://{{ matrix_server_fqn_matrix }}/
 
+# Uncomment the following to tell other servers to send federation traffic on
+# port 443.
+#
+# By default, other servers will try to reach our server on port 8448, which can
+# be inconvenient in some environments.
+#
+# Provided 'https://<server_name>/' on port 443 is routed to Synapse, this
+# option configures Synapse to serve a file at
+# 'https://<server_name>/.well-known/matrix/server'. This will tell other
+# servers to send traffic to port 443 instead.
+#
+# See https://matrix-org.github.io/synapse/latest/delegate.html for more
+# information.
+#
+# Defaults to 'false'.
+#
+#serve_server_wellknown: true
+
 # Set the soft limit on the number of file descriptors synapse can use
 # Zero is used to indicate synapse should set the soft limit to the
 # hard limit.
@@ -269,14 +289,14 @@ default_room_version: {{ matrix_synapse_default_room_version|to_json }}
 listeners:
 {% if matrix_synapse_metrics_enabled %}
   - type: metrics
-    port: {{ matrix_synapse_metrics_port }}
+    port: {{ matrix_synapse_metrics_port|to_json }}
     bind_addresses:
       - '0.0.0.0'
 {% endif %}
 
 {% if matrix_synapse_federation_port_enabled and matrix_synapse_tls_federation_listener_enabled %}
   # TLS-enabled listener: for when matrix traffic is sent directly to synapse.
-  - port: 8448
+  - port: {{ matrix_synapse_container_federation_api_tls_port|to_json }}
     tls: true
     bind_addresses: ['::']
     type: http
@@ -289,7 +309,7 @@ listeners:
 
   # Unsecure HTTP listener (Client API): for when matrix traffic passes through a reverse proxy
   # that unwraps TLS.
-  - port: 8008
+  - port: {{ matrix_synapse_container_client_api_port|to_json }}
     tls: false
     bind_addresses: ['::']
     type: http
@@ -302,7 +322,7 @@ listeners:
 {% if matrix_synapse_federation_port_enabled %}
   # Unsecure HTTP listener (Federation API): for when matrix traffic passes through a reverse proxy
   # that unwraps TLS.
-  - port: 8048
+  - port: {{ matrix_synapse_container_federation_api_plain_port|to_json }}
     tls: false
     bind_addresses: ['::']
     type: http
@@ -1271,7 +1291,7 @@ allow_guest_access: {{ matrix_synapse_allow_guest_access|to_json }}
 # in on this server.
 #
 # (By default, no suggestion is made, so it is left up to the client.
-# This setting is ignored unless public_baseurl is also set.)
+# This setting is ignored unless public_baseurl is also explicitly set.)
 #
 #default_identity_server: https://matrix.org
 
@@ -1296,8 +1316,6 @@ allow_guest_access: {{ matrix_synapse_allow_guest_access|to_json }}
 # by the Matrix Identity Service API specification:
 # https://matrix.org/docs/spec/identity_service/latest
 #
-# If a delegate is specified, the config option public_baseurl must also be filled out.
-#
 account_threepid_delegates:
     email: {{ matrix_synapse_account_threepid_delegates_email|to_json }}
     msisdn: {{ matrix_synapse_account_threepid_delegates_msisdn|to_json }}
@@ -1990,11 +2008,10 @@ sso:
     # phishing attacks from evil.site. To avoid this, include a slash after the
     # hostname: "https://my.client/".
     #
-    # If public_baseurl is set, then the login fallback page (used by clients
-    # that don't natively support the required login flows) is whitelisted in
-    # addition to any URLs in this list.
+    # The login fallback page (used by clients that don't natively support the
+    # required login flows) is whitelisted in addition to any URLs in this list.
     #
-    # By default, this list is empty.
+    # By default, this list contains only the login fallback page.
     #
     #client_whitelist:
     #  - https://riot.im/develop
@@ -2321,9 +2338,8 @@ email:
 
   # Username/password for authentication to the SMTP server. By default, no
   # authentication is attempted.
-  #
-  #smtp_user: "exampleusername"
-  #smtp_pass: "examplepassword"
+  smtp_user: {{ matrix_synapse_email_smtp_user|string|to_json }}
+  smtp_pass: {{ matrix_synapse_email_smtp_pass|string|to_json }}
 
   # Uncomment the following to require TLS transport security for SMTP.
   # By default, Synapse will connect over plain text, and will then switch to
diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2
index 6c90c9a3..43dc42d1 100644
--- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2
+++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2
@@ -17,8 +17,6 @@ ExecStartPre={{ matrix_host_command_sleep }} 5
 ExecStart={{ matrix_host_command_docker }} run --rm --name {{ matrix_synapse_worker_container_name }} \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			-e UID={{ matrix_user_uid }} \
-			-e GID={{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
 			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_synapse_tmp_directory_size_mb }}m \
diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2
index 2fbaac7b..188db5ef 100644
--- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2
+++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2
@@ -33,20 +33,18 @@ ExecStartPre={{ matrix_host_command_sleep }} 3
 ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-synapse \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--env=UID={{ matrix_user_uid }} \
-			--env=GID={{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
 			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_synapse_tmp_directory_size_mb }}m \
 			--network={{ matrix_docker_network }} \
 			{% if matrix_synapse_container_client_api_host_bind_port %}
-			-p {{ matrix_synapse_container_client_api_host_bind_port }}:8008 \
+			-p {{ matrix_synapse_container_client_api_host_bind_port }}:{{ matrix_synapse_container_client_api_port }} \
 			{% endif %}
 			{% if matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled and matrix_synapse_container_federation_api_tls_host_bind_port %}
-			-p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:8448 \
+			-p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:{{ matrix_synapse_container_federation_api_tls_port }} \
 			{% endif %}
 			{% if matrix_synapse_federation_enabled and matrix_synapse_container_federation_api_plain_host_bind_port %}
-			-p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:8048 \
+			-p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:{{ matrix_synapse_container_federation_api_plain_port }} \
 			{% endif %}
 			{% if matrix_synapse_metrics_enabled and matrix_synapse_container_metrics_api_host_bind_port %}
 			-p {{ matrix_synapse_container_metrics_api_host_bind_port }}:{{ matrix_synapse_metrics_port }} \
diff --git a/roles/matrix-synapse/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2 b/roles/matrix-synapse/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2
index 456c0667..228cc9ea 100644
--- a/roles/matrix-synapse/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2
+++ b/roles/matrix-synapse/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2
@@ -11,7 +11,7 @@ password=$2
 admin=$3
 
 if [ "$admin" -eq "1" ]; then
-	docker exec matrix-synapse register_new_matrix_user -u "$user" -p "$password" -c /data/homeserver.yaml --admin http://localhost:8008
+	docker exec matrix-synapse register_new_matrix_user -u "$user" -p "$password" -c /data/homeserver.yaml --admin http://localhost:{{ matrix_synapse_container_client_api_port }}
 else
-	docker exec matrix-synapse register_new_matrix_user -u "$user" -p "$password" -c /data/homeserver.yaml --no-admin http://localhost:8008
+	docker exec matrix-synapse register_new_matrix_user -u "$user" -p "$password" -c /data/homeserver.yaml --no-admin http://localhost:{{ matrix_synapse_container_client_api_port }}
 fi
diff --git a/roles/matrix-synapse/templates/synapse/worker.yaml.j2 b/roles/matrix-synapse/templates/synapse/worker.yaml.j2
index 36ae5a7e..40714f44 100644
--- a/roles/matrix-synapse/templates/synapse/worker.yaml.j2
+++ b/roles/matrix-synapse/templates/synapse/worker.yaml.j2
@@ -38,7 +38,7 @@ worker_listeners:
 {% endif %}
 
 {% if matrix_synapse_worker_details.type == 'frontend_proxy' %}
-worker_main_http_uri: http://matrix-synapse:8008
+worker_main_http_uri: http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}
 {% endif %}
 
 worker_daemonize: false
diff --git a/roles/matrix-synapse/vars/workers.yml b/roles/matrix-synapse/vars/workers.yml
index 049ae9b5..def223f8 100644
--- a/roles/matrix-synapse/vars/workers.yml
+++ b/roles/matrix-synapse/vars/workers.yml
@@ -5,10 +5,10 @@ matrix_synapse_workers_generic_worker_endpoints:
   # expressions:
 
   # Sync requests
-  - ^/_matrix/client/(v2_alpha|r0)/sync$
-  - ^/_matrix/client/(api/v1|v2_alpha|r0)/events$
-  - ^/_matrix/client/(api/v1|r0)/initialSync$
-  - ^/_matrix/client/(api/v1|r0)/rooms/[^/]+/initialSync$
+  - ^/_matrix/client/(v2_alpha|r0|v3)/sync$
+  - ^/_matrix/client/(api/v1|v2_alpha|r0|v3)/events$
+  - ^/_matrix/client/(api/v1|r0|v3)/initialSync$
+  - ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$
 
   # Federation requests
   - ^/_matrix/federation/v1/event/
@@ -39,40 +39,40 @@ matrix_synapse_workers_generic_worker_endpoints:
   - ^/_matrix/federation/v1/send/
 
   # Client API requests
-  - ^/_matrix/client/(api/v1|r0|unstable)/createRoom$
-  - ^/_matrix/client/(api/v1|r0|unstable)/publicRooms$
-  - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/joined_members$
-  - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/context/.*$
-  - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/members$
-  - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/state$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/createRoom$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/.*$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$
   - ^/_matrix/client/unstable/org.matrix.msc2946/rooms/.*/spaces$
   - ^/_matrix/client/unstable/org.matrix.msc2946/rooms/.*/hierarchy$
   - ^/_matrix/client/unstable/im.nheko.summary/rooms/.*/summary$
-  - ^/_matrix/client/(api/v1|r0|unstable)/account/3pid$
-  - ^/_matrix/client/(api/v1|r0|unstable)/devices$
-  - ^/_matrix/client/(api/v1|r0|unstable)/keys/query$
-  - ^/_matrix/client/(api/v1|r0|unstable)/keys/changes$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/account/3pid$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/devices$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/keys/query$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/keys/changes$
   - ^/_matrix/client/versions$
-  - ^/_matrix/client/(api/v1|r0|unstable)/voip/turnServer$
-  - ^/_matrix/client/(api/v1|r0|unstable)/joined_groups$
-  - ^/_matrix/client/(api/v1|r0|unstable)/publicised_groups$
-  - ^/_matrix/client/(api/v1|r0|unstable)/publicised_groups/
-  - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/event/
-  - ^/_matrix/client/(api/v1|r0|unstable)/joined_rooms$
-  - ^/_matrix/client/(api/v1|r0|unstable)/search$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/joined_groups$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/publicised_groups$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/publicised_groups/
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/search$
 
   # Registration/login requests
-  - ^/_matrix/client/(api/v1|r0|unstable)/login$
-  - ^/_matrix/client/(r0|unstable)/register$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/login$
+  - ^/_matrix/client/(r0|v3|unstable)/register$
   - ^/_matrix/client/unstable/org.matrix.msc3231/register/org.matrix.msc3231.login.registration_token/validity$
 
   # Event sending requests
-  - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/redact
-  - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/send
-  - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/state/
-  - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$
-  - ^/_matrix/client/(api/v1|r0|unstable)/join/
-  - ^/_matrix/client/(api/v1|r0|unstable)/profile/
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/join/
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/profile/
 
 
   # Additionally, the following REST endpoints can be handled for GET requests:
@@ -86,7 +86,7 @@ matrix_synapse_workers_generic_worker_endpoints:
   # for the room are in flight:
 
   # FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually
-  # ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/messages$
+  # ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/messages$
 
   # Additionally, the following endpoints should be included if Synapse is configured
   # to use SSO (you only need to include the ones for whichever SSO provider you're
@@ -94,7 +94,7 @@ matrix_synapse_workers_generic_worker_endpoints:
 
   # for all SSO providers
   # FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually
-  # ^/_matrix/client/(api/v1|r0|unstable)/login/sso/redirect
+  # ^/_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
   # ^/_synapse/client/pick_idp$
   # ^/_synapse/client/pick_username
   # ^/_synapse/client/new_user_consent$
@@ -110,7 +110,7 @@ matrix_synapse_workers_generic_worker_endpoints:
 
   # CAS requests.
   # FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually
-  # ^/_matrix/client/(api/v1|r0|unstable)/login/cas/ticket$
+  # ^/_matrix/client/(api/v1|r0|v3|unstable)/login/cas/ticket$
 
   # Ensure that all SSO logins go to a single process.
   # For multiple workers not handling the SSO endpoints properly, see
@@ -271,19 +271,19 @@ matrix_synapse_workers_media_repository_endpoints:
   # expose the `media` resource. For example:
 
   # ```yaml
-  #     worker_listeners:
-  #      - type: http
-  #        port: 8085
-  #        resources:
-  #          - names:
-  #            - media
+  # worker_listeners:
+  #  - type: http
+  #    port: 8085
+  #    resources:
+  #      - names:
+  #        - media
   # ```
 
   # Note that if running multiple media repositories they must be on the same server
   # and you must configure a single instance to run the background tasks, e.g.:
 
   # ```yaml
-  #     media_instance_running_background_jobs: "media-repository-1"
+  # media_instance_running_background_jobs: "media-repository-1"
   # ```
 
   # Note that if a reverse proxy is used , then `/_matrix/media/` must be routed for both inbound client and federation requests (if they are handled separately).
@@ -292,7 +292,7 @@ matrix_synapse_workers_user_dir_endpoints:
   # Handles searches in the user directory. It can handle REST endpoints matching
   # the following regular expressions:
 
-  - ^/_matrix/client/(api/v1|r0|unstable)/user_directory/search$
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/user_directory/search$
 
   # When using this worker you must also set `update_user_directory: False` in the
   # shared configuration file to stop the main synapse running background
@@ -303,13 +303,13 @@ matrix_synapse_workers_frontend_proxy_endpoints:
   # load from the main synapse. It can handle REST endpoints matching the following
   # regular expressions:
 
-  - ^/_matrix/client/(api/v1|r0|unstable)/keys/upload
+  - ^/_matrix/client/(api/v1|r0|v3|unstable)/keys/upload
 
   # If `use_presence` is False in the homeserver config, it can also handle REST
   # endpoints matching the following regular expressions:
 
   # FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually
-  # ^/_matrix/client/(api/v1|r0|unstable)/presence/[^/]+/status
+  # ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/[^/]+/status
 
   # This "stub" presence handler will pass through `GET` request but make the
   # `PUT` effectively a no-op.
@@ -319,7 +319,9 @@ matrix_synapse_workers_frontend_proxy_endpoints:
   # the `worker_main_http_uri` setting in the `frontend_proxy` worker configuration
   # file. For example:
 
-  #     worker_main_http_uri: http://127.0.0.1:8008
+  # ```yaml
+  # worker_main_http_uri: http://127.0.0.1:8008
+  # ```
 
 matrix_synapse_workers_avail_list:
   - appservice