diff --git a/compose/hf-pdocker-01/traefik-dynamic/temp-routes.yml b/compose/hf-pdocker-01/traefik-dynamic/temp-routes.yml
new file mode 100644
index 0000000..173eb2f
--- /dev/null
+++ b/compose/hf-pdocker-01/traefik-dynamic/temp-routes.yml
@@ -0,0 +1,102 @@
+http:
+  routers:
+    auth:
+      rule: "Host(`auth.hobbs.farm`)"
+      service: mas
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    # 2026-08-20: under MAS, Synapse no longer serves the login endpoints
+    # (it returns M_UNRECOGNIZED). These three compat paths must reach MAS or
+    # no client can sign in. Explicit high priority so it wins over `mess`.
+    mess-auth-compat:
+      rule: "Host(`mess.hobbs.farm`) && PathRegexp(`^/_matrix/client/(r0|v3|v1|unstable)/(login|logout|refresh)`)"
+      priority: 1000
+      service: mas
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    yoda:
+      rule: "Host(`yoda.hobbs.farm`)"
+      service: yoda
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers-allow-frames
+      tls:
+        certResolver: letsencrypt
+
+    mess:
+      rule: "Host(`mess.hobbs.farm`)"
+      service: mess
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    mess-federation:
+      rule: "Host(`mess.hobbs.farm`) && PathPrefix(`/_matrix/federation`)"
+      service: mess
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    wellknown:
+      rule: "Host(`hobbs.farm`) && PathPrefix(`/.well-known/matrix`)"
+      service: wellknown
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    solo:
+      rule: "Host(`solo.hobbs.farm`)"
+      service: solo
+      entryPoints:
+        - websecure
+      middlewares:
+        - solo-basicauth
+        - security-headers-allow-frames
+      tls:
+        certResolver: letsencrypt
+
+  services:
+    mas:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8020"
+
+    yoda:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8123"
+
+    mess:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8008"
+
+    wellknown:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8010"
+
+    solo:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8199"