fix(ess-pro/compose): align with matrix-stack 26.6.1 and fix routing/security gaps

Verified the role against the real matrix-stack Helm chart (pulled 26.6.1)
and fixed divergences found during review.

Bugs:
- Add MAS OIDC discovery router: /.well-known/openid-configuration must hit
  the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login
- Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound
  federation/identity requests; previously only url-preview blacklist present)
- Make federation_client_minimum_tls_version unconditional (chart sets it in
  shared-underrides; role only set it when federation was enabled)
- Restart only rendered fed-reader replicas in the handler instead of the
  whole compose project (missing services: filter)

Chart alignment (26.5.1 -> 26.6.1):
- Bump chart version and all image tags (mas -> matrix-authentication-service
  -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.)
- redis maxmemory 256mb -> chart default 40mb (configurable)
- Add element-web map_style_url (configurable)

Hardening / hygiene:
- Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep)
- Read admin password from the in-container secret file instead of passing it
  on the host process list during mas-cli register-user
- apt cache_valid_time, postgres first-boot-only comment, haproxy failover note
- Add meta/argument_specs.yml documenting all public variables
- README: chart version, service count, OIDC discovery verification step

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>

roles/ess_pro_compose/templates/compose.yml.j2

@@ -134,17 +134,28 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network={{ ess_compose_traefik_network }}"
+      # Default router: everything on the MAS host hits the web listener (8080).
       - "traefik.http.routers.ess-mas.rule=Host(`{{ ess_hostnames.mas }}`)"
       - "traefik.http.routers.ess-mas.entrypoints={{ ess_compose_traefik_entrypoint }}"
       - "traefik.http.routers.ess-mas.tls=true"
 {% if ess_compose_traefik_certresolver | length > 0 %}
       - "traefik.http.routers.ess-mas.tls.certresolver={{ ess_compose_traefik_certresolver }}"
 {% endif %}
+      - "traefik.http.routers.ess-mas.service=ess-mas"
       - "traefik.http.services.ess-mas.loadbalancer.server.port=8080"
-
-  # MAS root listener (port 8082) is mounted as a separate Traefik router so
-  # /.well-known/openid-configuration on the apex of the mas host is reachable.
-  # We attach a second router on the same service via a path rule.
+      # OIDC discovery router: the chart's ingress routes
+      # /.well-known/openid-configuration to the MAS *root* listener (8082),
+      # NOT the web listener (8080) — the web listener does not serve the
+      # `discovery` resource. Without this, OIDC clients 404 on discovery.
+      - "traefik.http.routers.ess-mas-discovery.rule=Host(`{{ ess_hostnames.mas }}`) && Path(`/.well-known/openid-configuration`)"
+      - "traefik.http.routers.ess-mas-discovery.entrypoints={{ ess_compose_traefik_entrypoint }}"
+      - "traefik.http.routers.ess-mas-discovery.tls=true"
+      - "traefik.http.routers.ess-mas-discovery.priority=200"
+{% if ess_compose_traefik_certresolver | length > 0 %}
+      - "traefik.http.routers.ess-mas-discovery.tls.certresolver={{ ess_compose_traefik_certresolver }}"
+{% endif %}
+      - "traefik.http.routers.ess-mas-discovery.service=ess-mas-discovery"
+      - "traefik.http.services.ess-mas-discovery.loadbalancer.server.port=8082"
 
   # ===========================================================================
   # HAProxy — fronts all Synapse + well-known traffic

roles/ess_pro_compose/templates/element-web/config.json.j2

@@ -12,6 +12,7 @@
   "embedded_pages": {
     "login_for_welcome": true
   },
+  "map_style_url": "{{ ess_element_web_map_style_url }}",
   "features": {
     "feature_element_call_video_rooms": true,
     "feature_group_calls": true,

roles/ess_pro_compose/templates/haproxy/haproxy.cfg.j2

@@ -98,7 +98,9 @@ frontend synapse-http-in
   use_backend return_204_rendezvous if { method OPTIONS } rendezvous
   use_backend return_204_synapse if { method OPTIONS }
 
-  # Failover from pro-fed-reader to main if the worker is unavailable
+  # Failover from pro-fed-reader to main if the worker is unavailable.
+  # The chart cascades pro-worker -> FOSS federation worker -> main; we deploy
+  # no FOSS federation worker, so we fail straight over to synapse-main.
   acl has_failover var(req.backend) -m str "pro-federation-api-requests"
   acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
   use_backend synapse-main-failover if has_failover backend_unavailable

roles/ess_pro_compose/templates/redis/redis.conf.j2

@@ -19,7 +19,7 @@ save ''
 # Disable persistence — Synapse uses Redis only for pub/sub between workers.
 appendonly no
 
-maxmemory 256mb
+maxmemory {{ ess_redis_maxmemory }}
 maxmemory-policy allkeys-lru
 
 hz 1

roles/ess_pro_compose/templates/synapse/homeserver.yaml.j2

@@ -18,6 +18,33 @@ log_config: "/conf/log_config.yaml"
 enable_metrics: true
 report_stats: false
 
+# Minimum TLS for outbound federation (chart: shared-underrides, always on).
+federation_client_minimum_tls_version: '1.2'
+
+# SSRF protection for ALL outbound requests (federation, identity, etc.).
+# Distinct from url_preview_ip_range_blacklist below. Verbatim from chart
+# synapse-04-homeserver-overrides.
+ip_range_blacklist:
+  - '127.0.0.0/8'
+  - '10.0.0.0/8'
+  - '172.16.0.0/12'
+  - '192.168.0.0/16'
+  - '100.64.0.0/10'
+  - '192.0.0.0/24'
+  - '169.254.0.0/16'
+  - '192.88.99.0/24'
+  - '198.18.0.0/15'
+  - '192.0.2.0/24'
+  - '198.51.100.0/24'
+  - '203.0.113.0/24'
+  - '224.0.0.0/4'
+  - '::1/128'
+  - 'fe80::/10'
+  - 'fc00::/7'
+  - '2001:db8::/32'
+  - 'ff00::/8'
+  - 'fec0::/10'
+
 # ---- Listeners (from 05-main.yaml) ----------------------------------------
 listeners:
   - port: 8008
@@ -130,7 +157,6 @@ url_preview_ip_range_blacklist:
 # ---- Federation -----------------------------------------------------------
 {% if ess_enable_federation %}
 send_federation: true
-federation_client_minimum_tls_version: '1.2'
 {% else %}
 send_federation: false
 federation_domain_whitelist: []