feat(web-app-matrix): central coturn + DiD-host-network via MDAD fork

Switch the ansible flavor over to a forked
github.com/kevinveenbirkenbach/matrix-docker-ansible-deploy that
supports container_network='host'. Inside the matrix-mdad DiD
container, every homeserver-stack service (synapse, element, coturn)
runs with --network=host so it shares matrix-mdad's network
namespace, which is attached to the outer compose's `postgres` and
`openldap` networks. Synapse/bridges therefore resolve `database`,
`openldap` via outer Docker DNS — no inner postgres or LDAP needed.

meta/services.yml:
- upstream.repo -> the fork; ref kept at `master` (the host-network
  patches live there). The pinned-commit story comes once the fork
  push lands.
- postgres.enabled stays `true` (matrix always needs a DB); postgres.shared
  becomes `'svc-db-postgres' in group_names` again — central when the
  DB role is up, dedicated per-app when it isn't. Both paths reach
  matrix-mdad's NS via the outer Docker daemon's DNS now that we run
  Synapse on --network=host.
- coturn becomes a first-class shared-service toggle: enabled+shared
  follow `'web-svc-coturn' in group_names`. When the central role is
  present, MDAD's bundled coturn stays off and Synapse's TURN URIs
  point at the central coturn (`turn:HOST:STUN_PORT` + tls variant)
  with the shared static_auth_secret pulled from web-svc-coturn
  credentials.

meta/variants.yml:
- V1 (ansible all-on): postgres.shared=true, coturn.shared=true.
- V2 (ansible no-auth): postgres.shared=false (dedicated path),
  coturn off — exercises both polarities for the variant-coverage
  lint and the dedicated DB code path.
- V3 (compose all-on): postgres.shared=true, coturn.shared=true.

vars/main.yml:
- MATRIX_COTURN_SHARED + MATRIX_COTURN_{HOST,STUN_TURN_PORT,STUN_TURN_TLS_PORT,AUTH_SECRET}
  lookups (gated on shared so dedicated runs don't try to read
  credentials that are not in scope).

templates/flavor/ansible/vars.yml.j2:
- matrix_homeserver_container_network / matrix_synapse_container_network
  / matrix_client_element_container_network / matrix_coturn_docker_network
  all pinned to `host`. Hits the fork's `when: var not in ['', 'host']`
  task guards (no 403 on docker_network create) and the
  `{% if var not in ['', 'host'] %}` systemd-template guards (no
  ExecStartPre=docker network connect against an additional bridge,
  which is invalid on host networking).
- When central coturn is shared: matrix_coturn_enabled=false +
  matrix_synapse_turn_uris (udp/tcp + turns udp/tcp) +
  matrix_synapse_turn_shared_secret wired to MATRIX_COTURN_AUTH_SECRET.

Tests: 186/186 green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

roles/web-app-matrix/meta/services.yml

@@ -18,10 +18,14 @@ matomo:
 email:
   enabled: "{{ 'web-app-mailu' in group_names }}"
   shared: "{{ 'web-app-mailu' in group_names }}"
+# nocheck: playwright-service-flag — TURN/STUN server, no Playwright surface (provider: web-svc-coturn)
+coturn:
+  enabled: "{{ 'web-svc-coturn' in group_names }}"
+  shared: "{{ 'web-svc-coturn' in group_names }}"
 # nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
 postgres:
-  enabled: true # nocheck: dynamic-flag
-  shared: true # nocheck: dynamic-flag — matrix requires central postgres for both flavors
+  enabled: true # nocheck: dynamic-flag — matrix always needs a database
+  shared: "{{ 'svc-db-postgres' in group_names }}"
 synapse:
   version: latest
   image: matrixdotorg/synapse
@@ -76,8 +80,8 @@ prometheus:
 matrix:
   flavor: ansible
   upstream:
-    repo: https://github.com/spantaleev/matrix-docker-ansible-deploy
-    ref: 9634cc3f7956e312eaf04647d85cbab46173f2e9
+    repo: https://github.com/kevinveenbirkenbach/matrix-docker-ansible-deploy
+    ref: master
     migration_validated_version: v2026.05.18.0
   runner:
     image: infinito/web-app-matrix-mdad-runner:1

roles/web-app-matrix/meta/variants.yml

@@ -2,6 +2,9 @@
 - services:
     matrix:
       flavor: ansible
+    coturn:
+      enabled: true
+      shared: true
     css:
       enabled: true
       shared: true
@@ -20,6 +23,8 @@
     matomo:
       enabled: true
       shared: true
+    postgres:
+      shared: true
     sso:
       enabled: true
       shared: true
@@ -30,6 +35,9 @@
 - services:
     matrix:
       flavor: ansible
+    coturn:
+      enabled: false
+      shared: false
     css:
       enabled: false
       shared: false
@@ -48,6 +56,8 @@
     matomo:
       enabled: false
       shared: false
+    postgres:
+      shared: false
     sso:
       enabled: false
       shared: false
@@ -58,6 +68,9 @@
 - services:
     matrix:
       flavor: compose
+    coturn:
+      enabled: true
+      shared: true
     css:
       enabled: true
       shared: true
@@ -76,6 +89,8 @@
     matomo:
       enabled: true
       shared: true
+    postgres:
+      shared: true
     sso:
       enabled: true
       shared: true

roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2

@@ -22,7 +22,21 @@ matrix_synapse_database_user: "{{ MATRIX_POSTGRES_USER }}"
 matrix_synapse_database_password: "{{ MATRIX_POSTGRES_PASSWORD }}"
 matrix_synapse_database_database: "{{ MATRIX_POSTGRES_DATABASE }}"
 
+matrix_homeserver_container_network: host
 matrix_synapse_container_network: host
+matrix_client_element_container_network: host
+matrix_coturn_docker_network: host
+
+{% if MATRIX_COTURN_SHARED %}
+matrix_coturn_enabled: false
+matrix_synapse_turn_uris:
+  - "turn:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_PORT }}?transport=udp"
+  - "turn:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_PORT }}?transport=tcp"
+  - "turns:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_TLS_PORT }}?transport=udp"
+  - "turns:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_TLS_PORT }}?transport=tcp"
+matrix_synapse_turn_shared_secret: "{{ MATRIX_COTURN_AUTH_SECRET }}"
+{% endif %}
+
 matrix_synapse_container_client_api_host_bind_port: "0.0.0.0:{{ MATRIX_SYNAPSE_PORT }}"
 matrix_synapse_container_federation_api_plain_host_bind_port: "0.0.0.0:{{ MATRIX_FEDERATION_PORT }}"
 matrix_client_element_container_http_host_bind_port: "0.0.0.0:{{ MATRIX_ELEMENT_PORT }}"

roles/web-app-matrix/vars/main.yml

@@ -61,6 +61,12 @@ MATRIX_POSTGRES_USER: "{{ lookup('database', application_id, 'username') }}"
 MATRIX_POSTGRES_PASSWORD: "{{ lookup('database', application_id, 'password') }}"
 MATRIX_POSTGRES_DATABASE: "{{ lookup('database', application_id, 'name') }}"
 
+MATRIX_COTURN_SHARED: "{{ lookup('config', application_id, 'services.coturn.shared') | bool }}"
+MATRIX_COTURN_HOST: "{{ lookup('domain', 'web-svc-coturn') if MATRIX_COTURN_SHARED else '' }}"
+MATRIX_COTURN_STUN_TURN_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn') if MATRIX_COTURN_SHARED else '' }}"
+MATRIX_COTURN_STUN_TURN_TLS_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn_tls') if MATRIX_COTURN_SHARED else '' }}"
+MATRIX_COTURN_AUTH_SECRET: "{{ lookup('config', 'web-svc-coturn', 'credentials.auth_secret') if MATRIX_COTURN_SHARED else '' }}"
+
 MATRIX_OUTBOUND_MAIL_ENABLED: "{{ lookup('config', application_id, 'services.email.enabled') | bool }}"
 MATRIX_OUTBOUND_MAIL: "{{ lookup('email', application_id) if MATRIX_OUTBOUND_MAIL_ENABLED else {} }}"
 MATRIX_OUTBOUND_MAIL_HOST: "{{ MATRIX_OUTBOUND_MAIL.host | default('') }}"