pgk-proxy/dynamic.yml at main · cloudflightio/pgk-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
http:
  routers:
    # ===================== Primary server (matrix.traefik.me) =====================
    # Client traffic (443) - only the app's FHIR-backed user directory search goes to pgk-proxy;
    # everything else (including federation invite via 443) goes to Synapse. Invitations are
    # enforced exclusively at the federation boundary, so createRoom / rooms/{id}/invite are NOT
    # intercepted: same-domain invites are always allowed. The legacy v1 invite endpoint is
    # disabled by the proxy (403) and never reaches Synapse.
    matrix-proxy:
      rule: "Host(`matrix.traefik.me`) && (PathPrefix(`/_matrix/client/v3/user_directory/search`) || PathPrefix(`/_matrix/federation/v1/invite`) || PathPrefix(`/_matrix/federation/v2/invite`))"
      entrypoints: [websecure]
      tls: true
      service: matrix-proxy
    matrix-synapse:
      rule: "Host(`matrix.traefik.me`)"
      entrypoints: [websecure]
      tls: true
      service: matrix-synapse

    # ===================== Partner server (partner.traefik.me) =====================
    # Client traffic (443) for the federation partner - goes directly to the partner Synapse.
    matrix-partner-synapse:
      rule: "Host(`partner.traefik.me`)"
      entrypoints: [websecure]
      tls: true
      service: matrix-partner-synapse

    # ===================== Federation traffic (8448) =====================
    # Federation invites are a single-hop policy check: the proxy evaluates the invitation and
    # forwards the accepted invite directly to the in-cluster Synapse (pgk.federation.forward-base-url),
    # so no header-based passthrough routing is needed here anymore.
    fed-matrix-proxy:
      rule: "Host(`matrix.traefik.me`) && (PathPrefix(`/_matrix/federation/v1/invite`) || PathPrefix(`/_matrix/federation/v2/invite`))"
      entrypoints: [federation]
      tls: true
      service: matrix-proxy
    fed-matrix-synapse:
      rule: "Host(`matrix.traefik.me`)"
      entrypoints: [federation]
      tls: true
      service: egress-proxy
    # Federation to partner.traefik.me - the first hop goes to the proxy for the policy check,
    # forwarded copies go straight to the partner Synapse (directly, not through Traefik). The
    # legacy v1 invite endpoint is disabled by the proxy (403) and never reaches Synapse.
    fed-partner-proxy:
      rule: "Host(`partner.traefik.me`) && (PathPrefix(`/_matrix/federation/v1/invite`) || PathPrefix(`/_matrix/federation/v2/invite`))"
      entrypoints: [federation]
      tls: true
      service: matrix-proxy
    fed-partner-synapse:
      rule: "Host(`partner.traefik.me`)"
      entrypoints: [federation]
      tls: true
      service: matrix-partner-synapse

  services:
    matrix-proxy:
      loadBalancer:
        servers:
          - url: "http://host.docker.internal:8080"
    matrix-synapse:
      loadBalancer:
        servers:
          - url: "http://matrix:8008"
    matrix-partner-synapse:
      loadBalancer:
        servers:
          - url: "http://matrix-partner:8008"
    egress-proxy:
      loadBalancer:
        passHostHeader: true
        servers:
          - url: "http://egress-proxy:3129"

tls:
  certificates:
    - certFile: /certs/app.traefik.me.crt
      keyFile: /certs/app.traefik.me.key