From 533fcdeac1a819a284d8084df9e2941a10bda053 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Fri, 21 Aug 2026 12:00:00 +0000
Subject: [PATCH] netpol: MAS reaches Synapse through haproxy now, and the rule
 did not know it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Until ESS 26.4.0 the auth service pointed straight at matrix-stack-synapse-main,
which allow-ingress-synapse permits, so nothing was needed here. ESS 26.8.0 moves
matrix.endpoint to the haproxy service — and MAS walked into the default-deny.
Login broke with 500 'failed to provision device' on /oauth2/token.

The rule was mine, from #0088 this morning. It named who may reach haproxy, and
the list was complete for the topology of that hour. A chart decided otherwise
six hours later.
---
 apps/production/networkpolicy.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/apps/production/networkpolicy.yaml b/apps/production/networkpolicy.yaml
index 05bfd0f..a4410f8 100644
--- a/apps/production/networkpolicy.yaml
+++ b/apps/production/networkpolicy.yaml
@@ -109,6 +109,23 @@ spec:
           port: haproxy-403
         - protocol: TCP
           port: haproxy-wkd
+    # Matrix Authentication Service ruft Synapse ueber haproxy.
+    #
+    # ⚠️ Bis ESS 26.4.0 zeigte MAS DIREKT auf matrix-stack-synapse-main; dorthin
+    # erlaubt allow-ingress-synapse den Zugriff, hier war nichts noetig. ESS 26.8.0
+    # stellt matrix.endpoint auf den haproxy-Dienst matrix-stack-synapse um - und
+    # damit lief MAS in die default-deny-Regel. Folge: /oauth2/token antwortete mit
+    # 500 'failed to provision device', die Anmeldung brach ab (2026-08-21, #0051).
+    #
+    # Die Lehre steht im AAR: Eine Regel, die auf einen Dienstnamen zeigt, haengt an
+    # einer Entscheidung des Charts, nicht an unserer.
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: matrix-authentication-service
+      ports:
+        - protocol: TCP
+          port: haproxy-synapse
     # Draupnir (Issue #18) calls Synapse's client-server API directly, in-namespace -
     # without this it would be silently blocked by the default-deny policy.
     - from: