From 8825cc3d4a4a501cb5cf8a425689e3d99075c7a6 Mon Sep 17 00:00:00 2001
From: jeremy <jeremydanielhobbs@gmail.com>
Date: Thu, 20 Aug 2026 15:15:57 -0500
Subject: [PATCH] feat: publish MAS at auth.hobbs.farm; route
 login/logout/refresh to MAS

Under MAS, Synapse returns M_UNRECOGNIZED for the login endpoints, so the
mess-auth-compat router (priority 1000) sends /_matrix/client/*/login,
/logout and /refresh to MAS while everything else stays on Synapse.

Cloudflare A record for auth.hobbs.farm already existed (98.160.103.126,
DNS-only). Blackbox probes added for MAS internal health (:8021) and the
public discovery endpoint; all four matrix-related probes UP.

Snapshot of the node's traefik dynamic config committed for reference.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../traefik-dynamic/temp-routes.yml           | 102 ++++++++++++++++++
 1 file changed, 102 insertions(+)
 create mode 100644 compose/hf-pdocker-01/traefik-dynamic/temp-routes.yml

diff --git a/compose/hf-pdocker-01/traefik-dynamic/temp-routes.yml b/compose/hf-pdocker-01/traefik-dynamic/temp-routes.yml
new file mode 100644
index 0000000..173eb2f
--- /dev/null
+++ b/compose/hf-pdocker-01/traefik-dynamic/temp-routes.yml
@@ -0,0 +1,102 @@
+http:
+  routers:
+    auth:
+      rule: "Host(`auth.hobbs.farm`)"
+      service: mas
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    # 2026-08-20: under MAS, Synapse no longer serves the login endpoints
+    # (it returns M_UNRECOGNIZED). These three compat paths must reach MAS or
+    # no client can sign in. Explicit high priority so it wins over `mess`.
+    mess-auth-compat:
+      rule: "Host(`mess.hobbs.farm`) && PathRegexp(`^/_matrix/client/(r0|v3|v1|unstable)/(login|logout|refresh)`)"
+      priority: 1000
+      service: mas
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    yoda:
+      rule: "Host(`yoda.hobbs.farm`)"
+      service: yoda
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers-allow-frames
+      tls:
+        certResolver: letsencrypt
+
+    mess:
+      rule: "Host(`mess.hobbs.farm`)"
+      service: mess
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    mess-federation:
+      rule: "Host(`mess.hobbs.farm`) && PathPrefix(`/_matrix/federation`)"
+      service: mess
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    wellknown:
+      rule: "Host(`hobbs.farm`) && PathPrefix(`/.well-known/matrix`)"
+      service: wellknown
+      entryPoints:
+        - websecure
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
+
+    solo:
+      rule: "Host(`solo.hobbs.farm`)"
+      service: solo
+      entryPoints:
+        - websecure
+      middlewares:
+        - solo-basicauth
+        - security-headers-allow-frames
+      tls:
+        certResolver: letsencrypt
+
+  services:
+    mas:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8020"
+
+    yoda:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8123"
+
+    mess:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8008"
+
+    wellknown:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8010"
+
+    solo:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.192:8199"