From 9735a2f600b4c942343e5521c0bc1c3499a7ee3d Mon Sep 17 00:00:00 2001
From: Edgars Voroboks <edgars.voroboks@gmail.com>
Date: Thu, 7 Mar 2019 07:22:08 +0200
Subject: [PATCH 1/8] Implement self-hosted Dimension server

---
 group_vars/matrix-servers                     |  3 +
 roles/matrix-base/defaults/main.yml           |  3 +
 roles/matrix-dimension/defaults/main.yml      | 16 ++++
 roles/matrix-dimension/tasks/init.yml         |  3 +
 roles/matrix-dimension/tasks/main.yml         |  9 +++
 .../tasks/setup_dimension.yml                 | 79 ++++++++++++++++++
 .../matrix-dimension/templates/config.yaml.j2 | 80 +++++++++++++++++++
 .../systemd/matrix-dimension.service.j2       | 23 ++++++
 roles/matrix-nginx-proxy/defaults/main.yml    |  4 +
 .../tasks/setup_nginx_proxy.yml               | 13 +++
 .../nginx/conf.d/matrix-dimension.conf.j2     | 56 +++++++++++++
 setup.yml                                     |  1 +
 12 files changed, 290 insertions(+)
 mode change 100644 => 100755 group_vars/matrix-servers
 mode change 100644 => 100755 roles/matrix-base/defaults/main.yml
 create mode 100755 roles/matrix-dimension/defaults/main.yml
 create mode 100755 roles/matrix-dimension/tasks/init.yml
 create mode 100755 roles/matrix-dimension/tasks/main.yml
 create mode 100755 roles/matrix-dimension/tasks/setup_dimension.yml
 create mode 100755 roles/matrix-dimension/templates/config.yaml.j2
 create mode 100755 roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2
 mode change 100644 => 100755 roles/matrix-nginx-proxy/defaults/main.yml
 mode change 100644 => 100755 roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
 create mode 100755 roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2
 mode change 100644 => 100755 setup.yml

diff --git a/group_vars/matrix-servers b/group_vars/matrix-servers
old mode 100644
new mode 100755
index e3337bf2b..9e685b98b
--- a/group_vars/matrix-servers
+++ b/group_vars/matrix-servers
@@ -184,6 +184,7 @@ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: "{{ matrix_s
 
 matrix_nginx_proxy_proxy_matrix_enabled: true
 matrix_nginx_proxy_proxy_riot_enabled: "{{ matrix_riot_web_enabled }}"
+matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}"
 
 matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}"
 matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
@@ -222,6 +223,8 @@ matrix_ssl_domains_to_obtain_certificates_for: |
     ([matrix_server_fqn_matrix])
     +
     ([matrix_server_fqn_riot] if matrix_riot_web_enabled else [])
+    +
+    ([matrix_server_fqn_dimension] if matrix_dimension_enabled else [])
   }}
 
 ######################################################################
diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml
old mode 100644
new mode 100755
index 251221734..863694082
--- a/roles/matrix-base/defaults/main.yml
+++ b/roles/matrix-base/defaults/main.yml
@@ -15,6 +15,9 @@ matrix_server_fqn_matrix: "matrix.{{ matrix_domain }}"
 # This and the Matrix FQN (see above) are expected to be on the same server.
 matrix_server_fqn_riot: "riot.{{ matrix_domain }}"
 
+# This is where you access the Dimension.
+matrix_server_fqn_dimension: "dimension.{{ matrix_domain }}"
+
 matrix_user_username: "matrix"
 matrix_user_uid: 991
 matrix_user_gid: 991
diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml
new file mode 100755
index 000000000..5c1459d3d
--- /dev/null
+++ b/roles/matrix-dimension/defaults/main.yml
@@ -0,0 +1,16 @@
+matrix_dimension_enabled: false
+
+# For information on how to acquire an access token, visit https://t2bot.io/docs/access_tokens
+matrix_dimension_access_token: CHANGEME
+
+# Users in form: ['@user1:domain.com', '@user2:domain.com']
+matrix_dimension_admin: []
+
+matrix_dimension_base_path: "{{ matrix_base_data_path }}/dimension"
+
+matrix_dimension_docker_image: "turt2live/matrix-dimension:latest"
+
+matrix_dimension_integrations_ui_url: "https://{{ matrix_server_fqn_dimension }}/riot"
+matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension }}/api/v1/scalar"
+matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"]
+matrix_dimension_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi"
diff --git a/roles/matrix-dimension/tasks/init.yml b/roles/matrix-dimension/tasks/init.yml
new file mode 100755
index 000000000..3e98de9db
--- /dev/null
+++ b/roles/matrix-dimension/tasks/init.yml
@@ -0,0 +1,3 @@
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-dimension'] }}"
+  when: "matrix_dimension_enabled"
\ No newline at end of file
diff --git a/roles/matrix-dimension/tasks/main.yml b/roles/matrix-dimension/tasks/main.yml
new file mode 100755
index 000000000..4aa0d0810
--- /dev/null
+++ b/roles/matrix-dimension/tasks/main.yml
@@ -0,0 +1,9 @@
+- import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- import_tasks: "{{ role_path }}/tasks/setup_dimension.yml"
+  when: run_setup
+  tags:
+    - setup-all
+    - setup-dimension
\ No newline at end of file
diff --git a/roles/matrix-dimension/tasks/setup_dimension.yml b/roles/matrix-dimension/tasks/setup_dimension.yml
new file mode 100755
index 000000000..83d01dda4
--- /dev/null
+++ b/roles/matrix-dimension/tasks/setup_dimension.yml
@@ -0,0 +1,79 @@
+---
+
+#
+# Tasks related to setting up the dimension
+#
+
+- name: Ensure dimension base path exists
+  file:
+    path: "{{ matrix_dimension_base_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+  when: matrix_dimension_enabled
+
+- name: Ensure dimension environment variables file created
+  template:
+    src: "{{ role_path }}/templates/config.yaml.j2"
+    dest: "{{ matrix_dimension_base_path }}/config.yaml"
+    mode: 0644
+  when: matrix_dimension_enabled
+
+- name: Ensure dimension image is pulled
+  docker_image:
+    name: "{{ matrix_dimension_docker_image }}"
+  when: matrix_dimension_enabled
+
+- name: Ensure matrix-dimension.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-dimension.service.j2"
+    dest: "/etc/systemd/system/matrix-dimension.service"
+    mode: 0644
+  register: matrix_dimension_systemd_service_result
+  when: matrix_dimension_enabled
+
+- name: Ensure systemd reloaded after matrix-dimension.service installation
+  service:
+    daemon_reload: yes
+  when: "matrix_dimension_enabled and matrix_dimension_systemd_service_result.changed"
+
+#
+# Tasks related to getting rid of the dimension (if it was previously enabled)
+#
+
+- name: Check existence of matrix-dimension service
+  stat:
+    path: "/etc/systemd/system/matrix-dimension.service"
+  register: matrix_dimension_service_stat
+
+- name: Ensure matrix-dimension is stopped
+  service:
+    name: matrix-dimension
+    state: stopped
+    daemon_reload: yes
+  register: stopping_result
+  when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists"
+
+- name: Ensure matrix-dimension.service doesn't exist
+  file:
+    path: "/etc/systemd/system/matrix-dimension.service"
+    state: absent
+  when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists"
+
+- name: Ensure systemd reloaded after matrix-dimension.service removal
+  service:
+    daemon_reload: yes
+  when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists"
+
+- name: Ensure Matrix dimension environment variables path doesn't exist
+  file:
+    path: "{{ matrix_dimension_base_path }}"
+    state: absent
+  when: "not matrix_dimension_enabled"
+
+- name: Ensure dimension Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_dimension_docker_image }}"
+    state: absent
+  when: "not matrix_dimension_enabled"
diff --git a/roles/matrix-dimension/templates/config.yaml.j2 b/roles/matrix-dimension/templates/config.yaml.j2
new file mode 100755
index 000000000..887ecf68b
--- /dev/null
+++ b/roles/matrix-dimension/templates/config.yaml.j2
@@ -0,0 +1,80 @@
+# The web settings for the service (API and UI).
+# It is best to have this run on localhost and use a reverse proxy to access Dimension.
+web:
+  port: 8184
+  address: '0.0.0.0'
+
+# Homeserver configuration
+homeserver:
+  # The domain name of the homeserver. This is used in many places, such as with go-neb
+  # setups, to identify the homeserver.
+  name: "{{ matrix_domain }}"
+
+  # The URL that Dimension, go-neb, and other services provisioned by Dimension should
+  # use to access the homeserver with.
+  clientServerUrl: "https://{{ matrix_domain }}"
+
+  # The URL that Dimension should use when trying to communicate with federated APIs on
+  # the homeserver. If not supplied or left empty Dimension will try to resolve the address
+  # through the normal federation process.
+  #federationUrl: "https://t2bot.io:8448"
+
+  # The URL that Dimension will redirect media requests to for downloading media such as
+  # stickers. If not supplied or left empty Dimension will use the clientServerUrl.
+  #mediaUrl: "https://t2bot.io"
+
+  # The access token Dimension should use for miscellaneous access to the homeserver. This
+  # should be for a user on the configured homeserver: any user will do, however it is
+  # recommended to use a dedicated user (such as @dimension:t2bot.io). For information on
+  # how to acquire an access token, visit https://t2bot.io/docs/access_tokens
+  accessToken: "{{ matrix_dimension_access_token }}"
+
+# These users can modify the integrations this Dimension supports.
+# To access the admin interface, open Dimension in Riot and click the settings icon.
+admins: {{ matrix_dimension_admin }}
+
+# IPs and CIDR ranges listed here will be blocked from being widgets.
+# Note: Widgets may still be embedded with restricted content, although not through Dimension directly.
+widgetBlacklist:
+  - 10.0.0.0/8
+  - 172.16.0.0/12
+  - 192.168.0.0/16
+  - 127.0.0.0/8
+
+# Where the database for Dimension is
+database:
+  file: "dimension.db"
+
+# Display settings that apply to self-hosted go-neb instances
+goneb:
+  # The avatars to set for each bot. Usually these don't need to be changed, however if your homeserver
+  # is not able to reach t2bot.io then you should specify your own here. To not use an avatar for a bot,
+  # make the bot's avatar an empty string.
+  avatars:
+    giphy: "mxc://t2bot.io/c5eaab3ef0133c1a61d3c849026deb27"
+    imgur: "mxc://t2bot.io/6749eaf2b302bb2188ae931b2eeb1513"
+    github: "mxc://t2bot.io/905b64b3cd8e2347f91a60c5eb0832e1"
+    wikipedia: "mxc://t2bot.io/7edfb54e9ad9e13fec0df22636feedf1"
+    travisci: "mxc://t2bot.io/7f4703126906fab8bb27df34a17707a8"
+    rss: "mxc://t2bot.io/aace4fcbd045f30afc1b4e5f0928f2f3"
+    google: "mxc://t2bot.io/636ad10742b66c4729bf89881a505142"
+    guggy: "mxc://t2bot.io/e7ef0ed0ba651aaf907655704f9a7526"
+    echo: "mxc://t2bot.io/3407ff2db96b4e954fcbf2c6c0415a13"
+    circleci: "mxc://t2bot.io/cf7d875845a82a6b21f5f66de78f6bee"
+    jira: "mxc://t2bot.io/f4a38ebcc4280ba5b950163ca3e7c329"
+
+# Settings for interacting with Telegram. Currently only applies for importing
+# sticker packs from Telegram.
+telegram:
+  # Talk to @BotFather on Telegram to get a token
+  botToken: "YourTokenHere"
+
+# Settings for controlling how logging works
+logging:
+  file: logs/dimension.log
+  console: true
+  consoleLevel: info
+  fileLevel: verbose
+  rotate:
+    size: 52428800 # bytes, default is 50mb
+    count: 5
diff --git a/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2
new file mode 100755
index 000000000..04c70d7dc
--- /dev/null
+++ b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2
@@ -0,0 +1,23 @@
+[Unit]
+Description=Matrix Dimension
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=simple
+ExecStartPre=-/usr/bin/docker kill matrix-dimension
+ExecStartPre=-/usr/bin/docker rm matrix-dimension
+ExecStart=/usr/bin/docker run --rm --name matrix-dimension \
+			--log-driver=none \
+			--cap-drop=ALL \
+			--network={{ matrix_docker_network }} \
+			-p 127.0.0.1:8184:8184 \
+			-v {{ matrix_dimension_base_path }}:/data:rw \
+			{{ matrix_dimension_docker_image }}
+ExecStop=-/usr/bin/docker kill matrix-dimension
+ExecStop=-/usr/bin/docker rm matrix-dimension
+Restart=always
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml
old mode 100644
new mode 100755
index 0910dbc8b..4ecd92cf7
--- a/roles/matrix-nginx-proxy/defaults/main.yml
+++ b/roles/matrix-nginx-proxy/defaults/main.yml
@@ -28,6 +28,10 @@ matrix_nginx_proxy_proxy_riot_hostname: "{{ matrix_server_fqn_riot }}"
 matrix_nginx_proxy_proxy_matrix_enabled: false
 matrix_nginx_proxy_proxy_matrix_hostname: "{{ matrix_server_fqn_matrix }}"
 
+# Controls whether proxying the dimension domain should be done.
+matrix_nginx_proxy_proxy_dimension_enabled: false
+matrix_nginx_proxy_proxy_dimension_hostname: "{{ matrix_server_fqn_dimension }}"
+
 # Controls whether proxying for the matrix-corporal API (`/_matrix/corporal`) should be done (on the matrix domain)
 matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: false
 matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
diff --git a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
old mode 100644
new mode 100755
index b6aacab2f..267d2133c
--- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
+++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
@@ -66,6 +66,13 @@
     mode: 0644
   when: "matrix_nginx_proxy_proxy_riot_enabled"
 
+- name: Ensure Matrix nginx-proxy configuration for dimension domain exists
+  template:
+    src: "{{ role_path }}/templates/nginx/conf.d/matrix-dimension.conf.j2"
+    dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-dimension.conf"
+    mode: 0644
+  when: "matrix_nginx_proxy_proxy_dimension_enabled"
+
 #
 # Tasks related to setting up matrix-nginx-proxy
 #
@@ -139,6 +146,12 @@
     state: absent
   when: "not matrix_nginx_proxy_proxy_riot_enabled"
 
+- name: Ensure Matrix nginx-proxy configuration for dimension domain deleted
+  file:
+    path: "{{ matrix_nginx_proxy_confd_path }}/matrix-dimension.conf"
+    state: absent
+  when: "not matrix_nginx_proxy_proxy_dimension_enabled"
+
 - name: Ensure Matrix nginx-proxy configuration for main config override deleted
   file:
     path: "{{ matrix_nginx_proxy_data_path }}/nginx.conf"
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2
new file mode 100755
index 000000000..1886496b8
--- /dev/null
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2
@@ -0,0 +1,56 @@
+server {
+	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	server_name {{ matrix_nginx_proxy_proxy_dimension_hostname }};
+
+	server_tokens off;
+
+	location /.well-known/acme-challenge {
+		{% if matrix_nginx_proxy_enabled %}
+			{# Use the embedded DNS resolver in Docker containers to discover the service #}
+			resolver 127.0.0.11 valid=5s;
+			set $backend "matrix-certbot:8080";
+			proxy_pass http://$backend;
+		{% else %}
+			{# Generic configuration for use outside of our container setup #}
+			proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }};
+		{% endif %}
+	}
+
+	location / {
+		return 301 https://$http_host$request_uri;
+	}
+}
+
+server {
+	listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
+	listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
+
+	server_name {{ matrix_nginx_proxy_proxy_dimension_hostname }};
+
+	server_tokens off;
+	root /dev/null;
+
+	gzip on;
+	gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
+
+	ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_dimension_hostname }}/fullchain.pem;
+	ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_dimension_hostname }}/privkey.pem;
+	ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }};
+	ssl_prefer_server_ciphers on;
+	ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
+
+	location / {
+		{% if matrix_nginx_proxy_enabled %}
+			{# Use the embedded DNS resolver in Docker containers to discover the service #}
+			resolver 127.0.0.11 valid=5s;
+			set $backend "matrix-dimension:8184";
+			proxy_pass http://$backend;
+		{% else %}
+			{# Generic configuration for use outside of our container setup #}
+			proxy_pass http://127.0.0.1:8184;
+		{% endif %}
+
+		proxy_set_header Host $host;
+		proxy_set_header X-Forwarded-For $remote_addr;
+	}
+}
diff --git a/setup.yml b/setup.yml
old mode 100644
new mode 100755
index a15d60636..3db1e5ca9
--- a/setup.yml
+++ b/setup.yml
@@ -12,5 +12,6 @@
     - matrix-synapse
     - matrix-riot-web
     - matrix-mxisd
+    - matrix-dimension
     - matrix-nginx-proxy
     - matrix-common-after

From 1eb78ca93e328ab1f242796bb9d77106a8d6d8d0 Mon Sep 17 00:00:00 2001
From: Edgars Voroboks <edgars.voroboks@gmail.com>
Date: Fri, 8 Mar 2019 15:00:53 +0200
Subject: [PATCH 2/8] Add additional changes for Dimension to work

---
 group_vars/matrix-servers                     | 21 +++++++++++++++++++
 roles/matrix-dimension/defaults/main.yml      | 11 ++++++++--
 roles/matrix-dimension/tasks/main.yml         |  6 ++++++
 .../tasks/setup_dimension.yml                 |  9 +++++---
 .../tasks/validate_config.yml                 |  7 +++++++
 .../matrix-dimension/templates/config.yaml.j2 |  2 +-
 .../systemd/matrix-dimension.service.j2       |  3 +++
 7 files changed, 53 insertions(+), 6 deletions(-)
 create mode 100644 roles/matrix-dimension/tasks/validate_config.yml

diff --git a/group_vars/matrix-servers b/group_vars/matrix-servers
index 9e685b98b..773150ceb 100755
--- a/group_vars/matrix-servers
+++ b/group_vars/matrix-servers
@@ -99,6 +99,27 @@ matrix_coturn_enabled: true
 
 
 
+######################################################################
+#
+# matrix-dimension
+#
+######################################################################
+
+matrix_dimension_enabled: false
+
+# Normally, matrix-nginx-proxy is enabled and nginx can reach Dimension over the container network.
+# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
+# the Dimension HTTP port to the local host (`127.0.0.1:8184`).
+matrix_dimension_container_expose_port: {{ not matrix_nginx_proxy_enabled }}
+
+######################################################################
+#
+# /matrix-dimension
+#
+######################################################################
+
+
+
 ######################################################################
 #
 # matrix-mailer
diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml
index 5c1459d3d..6b0bf87fb 100755
--- a/roles/matrix-dimension/defaults/main.yml
+++ b/roles/matrix-dimension/defaults/main.yml
@@ -1,15 +1,22 @@
 matrix_dimension_enabled: false
 
+# You are required to specify an access token for Dimension to work.
 # For information on how to acquire an access token, visit https://t2bot.io/docs/access_tokens
-matrix_dimension_access_token: CHANGEME
+matrix_dimension_access_token: ""
 
 # Users in form: ['@user1:domain.com', '@user2:domain.com']
-matrix_dimension_admin: []
+matrix_dimension_admins: []
 
 matrix_dimension_base_path: "{{ matrix_base_data_path }}/dimension"
 
 matrix_dimension_docker_image: "turt2live/matrix-dimension:latest"
 
+# The user and group id correspond to the node user in the `turt2live/matrix-dimension` image.
+matrix_dimension_user_uid: 1000
+matrix_dimension_user_gid: 1000
+
+matrix_dimension_container_expose_port: false
+
 matrix_dimension_integrations_ui_url: "https://{{ matrix_server_fqn_dimension }}/riot"
 matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension }}/api/v1/scalar"
 matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"]
diff --git a/roles/matrix-dimension/tasks/main.yml b/roles/matrix-dimension/tasks/main.yml
index 4aa0d0810..dd3bfc516 100755
--- a/roles/matrix-dimension/tasks/main.yml
+++ b/roles/matrix-dimension/tasks/main.yml
@@ -2,6 +2,12 @@
   tags:
     - always
 
+- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
+  when: run_setup
+  tags:
+    - setup-all
+    - setup-dimension
+
 - import_tasks: "{{ role_path }}/tasks/setup_dimension.yml"
   when: run_setup
   tags:
diff --git a/roles/matrix-dimension/tasks/setup_dimension.yml b/roles/matrix-dimension/tasks/setup_dimension.yml
index 83d01dda4..30ed5a838 100755
--- a/roles/matrix-dimension/tasks/setup_dimension.yml
+++ b/roles/matrix-dimension/tasks/setup_dimension.yml
@@ -8,16 +8,18 @@
   file:
     path: "{{ matrix_dimension_base_path }}"
     state: directory
-    mode: 0750
+    mode: 0770
     owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_username }}"
+    group: "{{ matrix_dimension_user_gid }}"
   when: matrix_dimension_enabled
 
 - name: Ensure dimension environment variables file created
   template:
     src: "{{ role_path }}/templates/config.yaml.j2"
     dest: "{{ matrix_dimension_base_path }}/config.yaml"
-    mode: 0644
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_dimension_user_gid }}"
   when: matrix_dimension_enabled
 
 - name: Ensure dimension image is pulled
@@ -46,6 +48,7 @@
   stat:
     path: "/etc/systemd/system/matrix-dimension.service"
   register: matrix_dimension_service_stat
+  when: not matrix_dimension_enabled
 
 - name: Ensure matrix-dimension is stopped
   service:
diff --git a/roles/matrix-dimension/tasks/validate_config.yml b/roles/matrix-dimension/tasks/validate_config.yml
new file mode 100644
index 000000000..f5960142b
--- /dev/null
+++ b/roles/matrix-dimension/tasks/validate_config.yml
@@ -0,0 +1,7 @@
+- name: Fail if required Dimension settings not defined
+  fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`) for using Dimension.
+  with_items:
+    - "matrix_dimension_access_token"
+  when: "matrix_dimension_enabled and vars[item] == ''"
diff --git a/roles/matrix-dimension/templates/config.yaml.j2 b/roles/matrix-dimension/templates/config.yaml.j2
index 887ecf68b..4eb2ae933 100755
--- a/roles/matrix-dimension/templates/config.yaml.j2
+++ b/roles/matrix-dimension/templates/config.yaml.j2
@@ -12,7 +12,7 @@ homeserver:
 
   # The URL that Dimension, go-neb, and other services provisioned by Dimension should
   # use to access the homeserver with.
-  clientServerUrl: "https://{{ matrix_domain }}"
+  clientServerUrl: "https://{{ matrix_server_fqn_matrix }}"
 
   # The URL that Dimension should use when trying to communicate with federated APIs on
   # the homeserver. If not supplied or left empty Dimension will try to resolve the address
diff --git a/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2
index 04c70d7dc..554713d84 100755
--- a/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2
+++ b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2
@@ -9,9 +9,12 @@ ExecStartPre=-/usr/bin/docker kill matrix-dimension
 ExecStartPre=-/usr/bin/docker rm matrix-dimension
 ExecStart=/usr/bin/docker run --rm --name matrix-dimension \
 			--log-driver=none \
+			--user={{ matrix_dimension_user_uid }}:{{ matrix_dimension_user_gid }} \
 			--cap-drop=ALL \
 			--network={{ matrix_docker_network }} \
+			{% if matrix_dimension_container_expose_port %}
 			-p 127.0.0.1:8184:8184 \
+			{% endif %}
 			-v {{ matrix_dimension_base_path }}:/data:rw \
 			{{ matrix_dimension_docker_image }}
 ExecStop=-/usr/bin/docker kill matrix-dimension

From 3d7dc15a547282b321c313a622f264483ad3db27 Mon Sep 17 00:00:00 2001
From: Edgars Voroboks <edgars.voroboks@gmail.com>
Date: Fri, 8 Mar 2019 15:24:59 +0200
Subject: [PATCH 3/8] Use Dimension if enabled, otherwise fall back to Scalar

---
 group_vars/matrix-servers | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/group_vars/matrix-servers b/group_vars/matrix-servers
index 773150ceb..df631969c 100755
--- a/group_vars/matrix-servers
+++ b/group_vars/matrix-servers
@@ -295,6 +295,12 @@ matrix_riot_web_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}"
 matrix_riot_web_default_hs_url: "{{ matrix_homeserver_url }}"
 matrix_riot_web_default_is_url: "{{ matrix_identity_server_url }}"
 
+# Use Dimension if enabled, otherwise fall back to Scalar
+matrix_riot_web_integrations_ui_url: "{{ matrix_dimension_integrations_ui_url if matrix_dimension_enabled else 'https://scalar.vector.im/' }}"
+matrix_riot_web_integrations_rest_url: "{{ matrix_dimension_integrations_rest_url if matrix_dimension_enabled else 'https://scalar.vector.im/api' }}"
+matrix_riot_web_integrations_widgets_urls: "{{ matrix_dimension_integrations_widgets_urls if matrix_dimension_enabled else ['https://scalar.vector.im/api'] }}"
+matrix_riot_web_integrations_jitsi_widget_url: "{{ matrix_dimension_integrations_jitsi_widget_url if matrix_dimension_enabled else 'https://scalar.vector.im/api/widgets/jitsi.html' }}"
+
 ######################################################################
 #
 # /matrix-riot-web

From 30738d064e740e2a99da8de618c3ba3a539756f8 Mon Sep 17 00:00:00 2001
From: Edgars Voroboks <edgars.voroboks@gmail.com>
Date: Fri, 8 Mar 2019 19:14:15 +0200
Subject: [PATCH 4/8] Fix errors

---
 group_vars/matrix-servers                       | 2 +-
 roles/matrix-dimension/templates/config.yaml.j2 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/group_vars/matrix-servers b/group_vars/matrix-servers
index df631969c..9f06d8fef 100755
--- a/group_vars/matrix-servers
+++ b/group_vars/matrix-servers
@@ -110,7 +110,7 @@ matrix_dimension_enabled: false
 # Normally, matrix-nginx-proxy is enabled and nginx can reach Dimension over the container network.
 # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
 # the Dimension HTTP port to the local host (`127.0.0.1:8184`).
-matrix_dimension_container_expose_port: {{ not matrix_nginx_proxy_enabled }}
+matrix_dimension_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}"
 
 ######################################################################
 #
diff --git a/roles/matrix-dimension/templates/config.yaml.j2 b/roles/matrix-dimension/templates/config.yaml.j2
index 4eb2ae933..c624c4a93 100755
--- a/roles/matrix-dimension/templates/config.yaml.j2
+++ b/roles/matrix-dimension/templates/config.yaml.j2
@@ -31,7 +31,7 @@ homeserver:
 
 # These users can modify the integrations this Dimension supports.
 # To access the admin interface, open Dimension in Riot and click the settings icon.
-admins: {{ matrix_dimension_admin }}
+admins: {{ matrix_dimension_admins }}
 
 # IPs and CIDR ranges listed here will be blocked from being widgets.
 # Note: Widgets may still be embedded with restricted content, although not through Dimension directly.

From b2263f811a83af62abe4c062599f0a1ed29fd44c Mon Sep 17 00:00:00 2001
From: Edgars Voroboks <edgars.voroboks@gmail.com>
Date: Fri, 8 Mar 2019 22:00:05 +0200
Subject: [PATCH 5/8] Disable logging to file. Set console logging to verbose.

---
 roles/matrix-dimension/templates/config.yaml.j2 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/roles/matrix-dimension/templates/config.yaml.j2 b/roles/matrix-dimension/templates/config.yaml.j2
index c624c4a93..3abd3c787 100755
--- a/roles/matrix-dimension/templates/config.yaml.j2
+++ b/roles/matrix-dimension/templates/config.yaml.j2
@@ -71,10 +71,10 @@ telegram:
 
 # Settings for controlling how logging works
 logging:
-  file: logs/dimension.log
+  file: /dev/null
   console: true
-  consoleLevel: info
-  fileLevel: verbose
+  consoleLevel: verbose
+  fileLevel: info
   rotate:
     size: 52428800 # bytes, default is 50mb
     count: 5

From 27772a6420bee52e19c2a4e344d77bb2591e05f5 Mon Sep 17 00:00:00 2001
From: Edgars Voroboks <edgars.voroboks@gmail.com>
Date: Fri, 8 Mar 2019 22:01:11 +0200
Subject: [PATCH 6/8] Point federationUrl to matrix-synapse container

---
 roles/matrix-dimension/templates/config.yaml.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-dimension/templates/config.yaml.j2 b/roles/matrix-dimension/templates/config.yaml.j2
index 3abd3c787..84403d3af 100755
--- a/roles/matrix-dimension/templates/config.yaml.j2
+++ b/roles/matrix-dimension/templates/config.yaml.j2
@@ -17,7 +17,7 @@ homeserver:
   # The URL that Dimension should use when trying to communicate with federated APIs on
   # the homeserver. If not supplied or left empty Dimension will try to resolve the address
   # through the normal federation process.
-  #federationUrl: "https://t2bot.io:8448"
+  federationUrl: "https://matrix-synapse:8448"
 
   # The URL that Dimension will redirect media requests to for downloading media such as
   # stickers. If not supplied or left empty Dimension will use the clientServerUrl.

From bcbfc1e8385570a3aee2804539feb1938d0b386b Mon Sep 17 00:00:00 2001
From: Edgars Voroboks <edgars.voroboks@gmail.com>
Date: Sat, 9 Mar 2019 10:30:31 +0200
Subject: [PATCH 7/8] Make Matrix Federation required and fix internal
 federationUrl

---
 roles/matrix-dimension/tasks/validate_config.yml | 8 ++++++++
 roles/matrix-dimension/templates/config.yaml.j2  | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/roles/matrix-dimension/tasks/validate_config.yml b/roles/matrix-dimension/tasks/validate_config.yml
index f5960142b..69971a9b4 100644
--- a/roles/matrix-dimension/tasks/validate_config.yml
+++ b/roles/matrix-dimension/tasks/validate_config.yml
@@ -5,3 +5,11 @@
   with_items:
     - "matrix_dimension_access_token"
   when: "matrix_dimension_enabled and vars[item] == ''"
+
+- name: Fail if Matrix Federation is disabled
+  fail:
+    msg: >-
+      You need to enable Matrix Federation to use Dimension. Set `{{ item }}` to 'true'.
+  with_items:
+    - "matrix_synapse_federation_enabled"
+  when: "matrix_dimension_enabled and matrix_synapse_federation_enabled == false"
diff --git a/roles/matrix-dimension/templates/config.yaml.j2 b/roles/matrix-dimension/templates/config.yaml.j2
index 84403d3af..f5f29f4f5 100755
--- a/roles/matrix-dimension/templates/config.yaml.j2
+++ b/roles/matrix-dimension/templates/config.yaml.j2
@@ -17,7 +17,7 @@ homeserver:
   # The URL that Dimension should use when trying to communicate with federated APIs on
   # the homeserver. If not supplied or left empty Dimension will try to resolve the address
   # through the normal federation process.
-  federationUrl: "https://matrix-synapse:8448"
+  federationUrl: "http://matrix-synapse:8048"
 
   # The URL that Dimension will redirect media requests to for downloading media such as
   # stickers. If not supplied or left empty Dimension will use the clientServerUrl.

From 5f13a1e50b6adb5199881c2b66346435ed2dfc9d Mon Sep 17 00:00:00 2001
From: Edgars Voroboks <edgars.voroboks@gmail.com>
Date: Sat, 9 Mar 2019 19:08:00 +0200
Subject: [PATCH 8/8] Generate Dimension config from variable

---
 roles/matrix-dimension/defaults/main.yml      | 103 ++++++++++++++++++
 .../tasks/setup_dimension.yml                 |  14 +--
 .../matrix-dimension/templates/config.yaml.j2 |  80 --------------
 roles/matrix-dimension/vars/main.yml          |   5 +
 4 files changed, 115 insertions(+), 87 deletions(-)
 delete mode 100755 roles/matrix-dimension/templates/config.yaml.j2
 create mode 100755 roles/matrix-dimension/vars/main.yml

diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml
index 6b0bf87fb..20c2f4e85 100755
--- a/roles/matrix-dimension/defaults/main.yml
+++ b/roles/matrix-dimension/defaults/main.yml
@@ -21,3 +21,106 @@ matrix_dimension_integrations_ui_url: "https://{{ matrix_server_fqn_dimension }}
 matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension }}/api/v1/scalar"
 matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"]
 matrix_dimension_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi"
+
+# Default Dimension configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_dimension_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_dimension_configuration_yaml: |
+  # The web settings for the service (API and UI).
+  # It is best to have this run on localhost and use a reverse proxy to access Dimension.
+  web:
+    port: 8184
+    address: '0.0.0.0'
+
+  # Homeserver configuration
+  homeserver:
+    # The domain name of the homeserver. This is used in many places, such as with go-neb
+    # setups, to identify the homeserver.
+    name: "{{ matrix_server_fqn_matrix }}"
+
+    # The URL that Dimension, go-neb, and other services provisioned by Dimension should
+    # use to access the homeserver with.
+    clientServerUrl: "https://{{ matrix_server_fqn_matrix }}"
+
+    # The URL that Dimension should use when trying to communicate with federated APIs on
+    # the homeserver. If not supplied or left empty Dimension will try to resolve the address
+    # through the normal federation process.
+    federationUrl: "http://matrix-synapse:8048"
+
+    # The URL that Dimension will redirect media requests to for downloading media such as
+    # stickers. If not supplied or left empty Dimension will use the clientServerUrl.
+    #mediaUrl: "https://t2bot.io"
+
+    # The access token Dimension should use for miscellaneous access to the homeserver. This
+    # should be for a user on the configured homeserver: any user will do, however it is
+    # recommended to use a dedicated user (such as @dimension:t2bot.io). For information on
+    # how to acquire an access token, visit https://t2bot.io/docs/access_tokens
+    accessToken: "{{ matrix_dimension_access_token }}"
+
+  # These users can modify the integrations this Dimension supports.
+  # To access the admin interface, open Dimension in Riot and click the settings icon.
+  admins: {{ matrix_dimension_admins }}
+
+  # IPs and CIDR ranges listed here will be blocked from being widgets.
+  # Note: Widgets may still be embedded with restricted content, although not through Dimension directly.
+  widgetBlacklist:
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+    - 127.0.0.0/8
+
+  # Where the database for Dimension is
+  database:
+    file: "dimension.db"
+
+  # Display settings that apply to self-hosted go-neb instances
+  goneb:
+    # The avatars to set for each bot. Usually these don't need to be changed, however if your homeserver
+    # is not able to reach t2bot.io then you should specify your own here. To not use an avatar for a bot,
+    # make the bot's avatar an empty string.
+    avatars:
+      giphy: "mxc://t2bot.io/c5eaab3ef0133c1a61d3c849026deb27"
+      imgur: "mxc://t2bot.io/6749eaf2b302bb2188ae931b2eeb1513"
+      github: "mxc://t2bot.io/905b64b3cd8e2347f91a60c5eb0832e1"
+      wikipedia: "mxc://t2bot.io/7edfb54e9ad9e13fec0df22636feedf1"
+      travisci: "mxc://t2bot.io/7f4703126906fab8bb27df34a17707a8"
+      rss: "mxc://t2bot.io/aace4fcbd045f30afc1b4e5f0928f2f3"
+      google: "mxc://t2bot.io/636ad10742b66c4729bf89881a505142"
+      guggy: "mxc://t2bot.io/e7ef0ed0ba651aaf907655704f9a7526"
+      echo: "mxc://t2bot.io/3407ff2db96b4e954fcbf2c6c0415a13"
+      circleci: "mxc://t2bot.io/cf7d875845a82a6b21f5f66de78f6bee"
+      jira: "mxc://t2bot.io/f4a38ebcc4280ba5b950163ca3e7c329"
+
+  # Settings for controlling how logging works
+  logging:
+    file: /dev/null
+    console: true
+    consoleLevel: verbose
+    fileLevel: info
+    rotate:
+      size: 52428800 # bytes, default is 50mb
+      count: 5  
+
+
+matrix_dimension_configuration_extension_yaml: |
+  # Your custom YAML configuration for Dimension goes here.
+  # This configuration extends the default starting configuration (`matrix_dimension_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_dimension_configuration_yaml`.
+  #
+  # Example configuration extension follows:
+  # telegram:
+  #   botToken: "YourTokenHere"
+  #
+  
+
+# Holds the final Dimension configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_dimension_configuration_yaml`.
+matrix_dimension_configuration: "{{ matrix_dimension_configuration_yaml|from_yaml|combine(matrix_dimension_configuration_extension, recursive=True) }}"
+
+
diff --git a/roles/matrix-dimension/tasks/setup_dimension.yml b/roles/matrix-dimension/tasks/setup_dimension.yml
index 30ed5a838..e8dea9eae 100755
--- a/roles/matrix-dimension/tasks/setup_dimension.yml
+++ b/roles/matrix-dimension/tasks/setup_dimension.yml
@@ -4,7 +4,7 @@
 # Tasks related to setting up the dimension
 #
 
-- name: Ensure dimension base path exists
+- name: Ensure Dimension base path exists
   file:
     path: "{{ matrix_dimension_base_path }}"
     state: directory
@@ -13,16 +13,16 @@
     group: "{{ matrix_dimension_user_gid }}"
   when: matrix_dimension_enabled
 
-- name: Ensure dimension environment variables file created
-  template:
-    src: "{{ role_path }}/templates/config.yaml.j2"
+- name: Ensure Dimension config installed
+  copy:
+    content: "{{ matrix_dimension_configuration|to_nice_yaml }}"
     dest: "{{ matrix_dimension_base_path }}/config.yaml"
     mode: 0640
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_dimension_user_gid }}"
   when: matrix_dimension_enabled
 
-- name: Ensure dimension image is pulled
+- name: Ensure Dimension image is pulled
   docker_image:
     name: "{{ matrix_dimension_docker_image }}"
   when: matrix_dimension_enabled
@@ -69,13 +69,13 @@
     daemon_reload: yes
   when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists"
 
-- name: Ensure Matrix dimension environment variables path doesn't exist
+- name: Ensure Dimension environment variables path doesn't exist
   file:
     path: "{{ matrix_dimension_base_path }}"
     state: absent
   when: "not matrix_dimension_enabled"
 
-- name: Ensure dimension Docker image doesn't exist
+- name: Ensure Dimension Docker image doesn't exist
   docker_image:
     name: "{{ matrix_dimension_docker_image }}"
     state: absent
diff --git a/roles/matrix-dimension/templates/config.yaml.j2 b/roles/matrix-dimension/templates/config.yaml.j2
deleted file mode 100755
index f5f29f4f5..000000000
--- a/roles/matrix-dimension/templates/config.yaml.j2
+++ /dev/null
@@ -1,80 +0,0 @@
-# The web settings for the service (API and UI).
-# It is best to have this run on localhost and use a reverse proxy to access Dimension.
-web:
-  port: 8184
-  address: '0.0.0.0'
-
-# Homeserver configuration
-homeserver:
-  # The domain name of the homeserver. This is used in many places, such as with go-neb
-  # setups, to identify the homeserver.
-  name: "{{ matrix_domain }}"
-
-  # The URL that Dimension, go-neb, and other services provisioned by Dimension should
-  # use to access the homeserver with.
-  clientServerUrl: "https://{{ matrix_server_fqn_matrix }}"
-
-  # The URL that Dimension should use when trying to communicate with federated APIs on
-  # the homeserver. If not supplied or left empty Dimension will try to resolve the address
-  # through the normal federation process.
-  federationUrl: "http://matrix-synapse:8048"
-
-  # The URL that Dimension will redirect media requests to for downloading media such as
-  # stickers. If not supplied or left empty Dimension will use the clientServerUrl.
-  #mediaUrl: "https://t2bot.io"
-
-  # The access token Dimension should use for miscellaneous access to the homeserver. This
-  # should be for a user on the configured homeserver: any user will do, however it is
-  # recommended to use a dedicated user (such as @dimension:t2bot.io). For information on
-  # how to acquire an access token, visit https://t2bot.io/docs/access_tokens
-  accessToken: "{{ matrix_dimension_access_token }}"
-
-# These users can modify the integrations this Dimension supports.
-# To access the admin interface, open Dimension in Riot and click the settings icon.
-admins: {{ matrix_dimension_admins }}
-
-# IPs and CIDR ranges listed here will be blocked from being widgets.
-# Note: Widgets may still be embedded with restricted content, although not through Dimension directly.
-widgetBlacklist:
-  - 10.0.0.0/8
-  - 172.16.0.0/12
-  - 192.168.0.0/16
-  - 127.0.0.0/8
-
-# Where the database for Dimension is
-database:
-  file: "dimension.db"
-
-# Display settings that apply to self-hosted go-neb instances
-goneb:
-  # The avatars to set for each bot. Usually these don't need to be changed, however if your homeserver
-  # is not able to reach t2bot.io then you should specify your own here. To not use an avatar for a bot,
-  # make the bot's avatar an empty string.
-  avatars:
-    giphy: "mxc://t2bot.io/c5eaab3ef0133c1a61d3c849026deb27"
-    imgur: "mxc://t2bot.io/6749eaf2b302bb2188ae931b2eeb1513"
-    github: "mxc://t2bot.io/905b64b3cd8e2347f91a60c5eb0832e1"
-    wikipedia: "mxc://t2bot.io/7edfb54e9ad9e13fec0df22636feedf1"
-    travisci: "mxc://t2bot.io/7f4703126906fab8bb27df34a17707a8"
-    rss: "mxc://t2bot.io/aace4fcbd045f30afc1b4e5f0928f2f3"
-    google: "mxc://t2bot.io/636ad10742b66c4729bf89881a505142"
-    guggy: "mxc://t2bot.io/e7ef0ed0ba651aaf907655704f9a7526"
-    echo: "mxc://t2bot.io/3407ff2db96b4e954fcbf2c6c0415a13"
-    circleci: "mxc://t2bot.io/cf7d875845a82a6b21f5f66de78f6bee"
-    jira: "mxc://t2bot.io/f4a38ebcc4280ba5b950163ca3e7c329"
-
-# Settings for interacting with Telegram. Currently only applies for importing
-# sticker packs from Telegram.
-telegram:
-  # Talk to @BotFather on Telegram to get a token
-  botToken: "YourTokenHere"
-
-# Settings for controlling how logging works
-logging:
-  file: /dev/null
-  console: true
-  consoleLevel: verbose
-  fileLevel: info
-  rotate:
-    size: 52428800 # bytes, default is 50mb
-    count: 5
diff --git a/roles/matrix-dimension/vars/main.yml b/roles/matrix-dimension/vars/main.yml
new file mode 100755
index 000000000..107bb4fa8
--- /dev/null
+++ b/roles/matrix-dimension/vars/main.yml
@@ -0,0 +1,5 @@
+---
+
+# Doing `|from_yaml` when the extension contains nothing yields an empty string ("").
+# We need to ensure it's a dictionary or `|combine` (when building `matrix_dimension_configuration`) will fail later.
+matrix_dimension_configuration_extension: "{{ matrix_dimension_configuration_extension_yaml|from_yaml if matrix_dimension_configuration_extension_yaml|from_yaml else {} }}"
\ No newline at end of file