chore: upgrade synapse to v1.161.0, MAS to 1.24.0, mautrix-telegram to v0.2609.0, mautrix-signal to v0.2609.0, nginx to 1.31.6; hold bridge DBs at postgres:13-alpine

Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/84

.env.sample

@@ -105,7 +105,7 @@ ENABLE_REGISTRATION=false
 SERVE_SERVER_WELLKNOWN=false
 
 # Serve /.well-known/matrix/{server,client} on SERVER_NAME via Traefik.
-# Can be used when SERVER_NAME != DOMAIN and SERVER_NAME is served by Traefik.
+# Can be used when SERVER_NAME is other than DOMAIN and SERVER_NAME is served by Traefik.
 #COMPOSE_FILE="$COMPOSE_FILE:compose.wellknown.yml"
 
 ALLOW_PUBLIC_ROOMS_FEDERATION=false
@@ -149,7 +149,6 @@ ENCRYPTED_BY_DEFAULT=all
 #SESSION_LIFETIME=60d
 #TRACK_PUPPETED_USER_IPS=true
 
-
 ## Room complexity limit (prevents joining large remote rooms that cause DB bloat)
 ## complexity ≈ state_events / 500. Default 100.0 blocks rooms with >50000 state events.
 #ROOM_COMPLEXITY_LIMIT=100.0
@@ -248,7 +247,6 @@ RETENTION_MAX_LIFETIME=4w
 ## Web Client (Redirect)
 #WEB_CLIENT_LOCATION=https://element-web.example.com
 
-
 ## State compression (reduces database bloat from federation)
 ## Runs synapse_auto_compressor daily, built from source on first start
 #COMPOSE_FILE="$COMPOSE_FILE:compose.compress-state.yml"

MAINTNANCE.md

@@ -0,0 +1,32 @@
+# matrix-synapse Recipe Maintenance
+
+All contributions should be made via a pull request. This is to ensure a
+certain quality and consistency, that others can rely on.
+
+## Maintainer Responsibilities
+
+A recipe maintainer has the following responsibilities:
+
+- Respond to pull requests / issues within two weeks
+- Make image security updates within a week
+- Make image major updates every three months
+
+In order to fullfill these responsibilities a recipe maintainer:
+
+- Has to watch the repository (to get notifications)
+- Needs to make sure renovate is configured properly
+
+## Pull Requests
+
+A pull request can be merged if it is approved by at least one maintainer. For
+pull requests opened by a maintainer they need to be approved by another
+maintainer. Even though it is okay to merge a pull request with one approval, it
+is always better if all maintainers looked at the pull request and approved it.
+
+## Become a maintainer
+
+Everyone can apply to be a recipe maintainer:
+1. Watch the repository to always get updates
+2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
+3. Once the pull request gets merged you will be added to the [matrix-synapse maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/matrix-synapse-maintainers).
+4. Join the room [#cc-|-matrix-synapse-maintenance:matrix.org](#cc-|-matrix-synapse-maintenance:matrix.org) and chat to other maintainers.

README.md

@@ -2,8 +2,9 @@
 
 <!-- metadata -->
 
+* **Maintainer**: Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
 * **Category**: Apps
-* **Status**: 0, work-in-progress
+* **Status**: 3
 * **Image**: [`matrixdotorg/synapse`](https://hub.docker.com/r/matrixdotorg/synapse), 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: No

compose.mas.yml

@@ -5,7 +5,7 @@ version: "3.8"
 
 services:
   mas:
-    image: ghcr.io/element-hq/matrix-authentication-service:1.14.0
+    image: ghcr.io/element-hq/matrix-authentication-service:1.24.0
     command: ["server", "--config=/etc/mas/config.yaml"]
     environment:
       - DOMAIN

compose.signal.yml

@@ -10,7 +10,7 @@ services:
       - signal-data:/signal-data
 
   signalbridge:
-    image: dock.mau.dev/mautrix/signal:v0.8.7
+    image: dock.mau.dev/mautrix/signal:v0.2609.0
     depends_on:
       - signaldb
     configs:

compose.telegram.yml

@@ -10,7 +10,7 @@ services:
       - telegram-data:/telegram-data
 
   telegrambridge:
-    image: dock.mau.dev/mautrix/telegram:v0.15.3
+    image: dock.mau.dev/mautrix/telegram:v0.2609.0
     depends_on:
       - telegramdb
     configs:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   web:
-    image: nginx:1.29.6
+    image: nginx:1.31.6
     networks:
       - proxy
       - internal
@@ -43,7 +43,7 @@ services:
       start_period: 2m
 
   app:
-    image: "matrixdotorg/synapse:v1.149.1"
+    image: "matrixdotorg/synapse:v1.161.0"
     volumes:
       - "data:/data"
     secrets:
@@ -114,7 +114,7 @@ services:
       restart_policy:
         condition: on-failure
       labels:
-        - "coop-cloud.${STACK_NAME}.version=7.1.1+v1.149.1"
+        - "coop-cloud.${STACK_NAME}.version=7.3.1+v1.157.1"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8008/health"]
@@ -124,10 +124,14 @@ services:
       start_period: 1m
 
   db:
-    image: pgautoupgrade/pgautoupgrade:17-alpine
+    image: pgautoupgrade/pgautoupgrade:18-alpine
     secrets:
       - db_password
     environment:
+      # postgres:18 relocated the default PGDATA to /var/lib/postgresql/18/docker.
+      # Pin it to the legacy path so pgautoupgrade finds the existing cluster on the
+      # mounted volume and upgrades it in place, instead of init'ing an empty one.
+      - PGDATA=/var/lib/postgresql/data
       - LC_COLLATE=C
       - LC_CTYPE=C
       - POSTGRES_DB=synapse

renovate.json

@@ -2,5 +2,10 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended"
+  ],
+  "reviewers": [
+    "moritz",
+    "simon",
+    "carla"
   ]
 }