feat: publish MAS at auth.hobbs.farm; route login/logout/refresh to MAS

Under MAS, Synapse returns M_UNRECOGNIZED for the login endpoints, so the mess-auth-compat router (priority 1000) sends /_matrix/client/*/login, /logout and /refresh to MAS while everything else stays on Synapse. Cloudflare A record for auth.hobbs.farm already existed (98.160.103.126, DNS-only). Blackbox probes added for MAS internal health (:8021) and the public discovery endpoint; all four matrix-related probes UP. Snapshot of the node's traefik dynamic config committed for reference. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-20 15:15:57 -05:00
parent 9dff3c2d95
commit 8825cc3d4a
1 changed files with 102 additions and 0 deletions
@@ -0,0 +1,102 @@
+http:
+  routers:
+    auth:
+      rule: "Host(`auth.hobbs.farm`)"
+      service: mas
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    # 2026-08-20: under MAS, Synapse no longer serves the login endpoints
+    # (it returns M_UNRECOGNIZED). These three compat paths must reach MAS or
+    # no client can sign in. Explicit high priority so it wins over `mess`.
+    mess-auth-compat:
+      rule: "Host(`mess.hobbs.farm`) && PathRegexp(`^/_matrix/client/(r0|v3|v1|unstable)/(login|logout|refresh)`)"
+      priority: 1000
+      service: mas
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    yoda:
+      rule: "Host(`yoda.hobbs.farm`)"
+      service: yoda
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers-allow-frames
+      tls:
+        certResolver: letsencrypt
+
+    mess:
+      rule: "Host(`mess.hobbs.farm`)"
+      service: mess
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    mess-federation:
+      rule: "Host(`mess.hobbs.farm`) && PathPrefix(`/_matrix/federation`)"
+      service: mess
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    wellknown:
+      rule: "Host(`hobbs.farm`) && PathPrefix(`/.well-known/matrix`)"
+      service: wellknown
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    solo:
+      rule: "Host(`solo.hobbs.farm`)"
+      service: solo
+      entryPoints:
+        - websecure
+      middlewares:
+        - solo-basicauth
+        - security-headers-allow-frames
+      tls:
+        certResolver: letsencrypt
+
+  services:
+    mas:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8020"
+
+    yoda:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8123"
+
+    mess:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8008"
+
+    wellknown:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8010"
+
+    solo:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8199"