Digitalboard/digitalboard.core
6
2
Fork 0
Code Pull requests 3 Releases Packages Activity Actions

fix(ess-pro/compose): align with matrix-stack 26.6.1 and fix routing/security gaps

Browse source 
Verified the role against the real matrix-stack Helm chart (pulled 26.6.1)
and fixed divergences found during review.

Bugs:
- Add MAS OIDC discovery router: /.well-known/openid-configuration must hit
  the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login
- Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound
  federation/identity requests; previously only url-preview blacklist present)
- Make federation_client_minimum_tls_version unconditional (chart sets it in
  shared-underrides; role only set it when federation was enabled)
- Restart only rendered fed-reader replicas in the handler instead of the
  whole compose project (missing services: filter)

Chart alignment (26.5.1 -> 26.6.1):
- Bump chart version and all image tags (mas -> matrix-authentication-service
  -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.)
- redis maxmemory 256mb -> chart default 40mb (configurable)
- Add element-web map_style_url (configurable)

Hardening / hygiene:
- Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep)
- Read admin password from the in-container secret file instead of passing it
  on the host process list during mas-cli register-user
- apt cache_valid_time, postgres first-boot-only comment, haproxy failover note
- Add meta/argument_specs.yml documenting all public variables
- README: chart version, service count, OIDC discovery verification step

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
This commit is contained in:
Simon Bärlocher 2026-06-15 16:34:03 +02:00
parent 32eca6b923
commit ba220d6cd6
No known key found for this signature in database
GPG key ID: 63DE20495932047A
13 changed files with 331 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

19
roles/ess_pro_compose/templates/compose.yml.j2
View file

@ -134,17 +134,28 @@ services:
labels:
- "traefik.enable=true"
- "traefik.docker.network={{ ess_compose_traefik_network }}"
# Default router: everything on the MAS host hits the web listener (8080).
- "traefik.http.routers.ess-mas.rule=Host(`{{ ess_hostnames.mas }}`)"
- "traefik.http.routers.ess-mas.entrypoints={{ ess_compose_traefik_entrypoint }}"
- "traefik.http.routers.ess-mas.tls=true"
{% if ess_compose_traefik_certresolver | length > 0 %}
- "traefik.http.routers.ess-mas.tls.certresolver={{ ess_compose_traefik_certresolver }}"
{% endif %}
- "traefik.http.routers.ess-mas.service=ess-mas"
- "traefik.http.services.ess-mas.loadbalancer.server.port=8080"
# MAS root listener (port 8082) is mounted as a separate Traefik router so
# /.well-known/openid-configuration on the apex of the mas host is reachable.
# We attach a second router on the same service via a path rule.
# OIDC discovery router: the chart's ingress routes
# /.well-known/openid-configuration to the MAS *root* listener (8082),
# NOT the web listener (8080) — the web listener does not serve the
# `discovery` resource. Without this, OIDC clients 404 on discovery.
- "traefik.http.routers.ess-mas-discovery.rule=Host(`{{ ess_hostnames.mas }}`) && Path(`/.well-known/openid-configuration`)"
- "traefik.http.routers.ess-mas-discovery.entrypoints={{ ess_compose_traefik_entrypoint }}"
- "traefik.http.routers.ess-mas-discovery.tls=true"
- "traefik.http.routers.ess-mas-discovery.priority=200"
{% if ess_compose_traefik_certresolver | length > 0 %}
- "traefik.http.routers.ess-mas-discovery.tls.certresolver={{ ess_compose_traefik_certresolver }}"
{% endif %}
- "traefik.http.routers.ess-mas-discovery.service=ess-mas-discovery"
- "traefik.http.services.ess-mas-discovery.loadbalancer.server.port=8082"
# ===========================================================================
# HAProxy — fronts all Synapse + well-known traffic