Thore Cimbal 533fcdeac1 netpol: MAS reaches Synapse through haproxy now, and the rule did not know it ...

Until ESS 26.4.0 the auth service pointed straight at matrix-stack-synapse-main,
which allow-ingress-synapse permits, so nothing was needed here. ESS 26.8.0 moves
matrix.endpoint to the haproxy service — and MAS walked into the default-deny.
Login broke with 500 'failed to provision device' on /oauth2/token.

The rule was mine, from #0088 this morning. It named who may reach haproxy, and
the list was complete for the topology of that hour. A chart decided otherwise
six hours later.

2026-08-21 12:00:00 +00:00

..

authentik

authentik: arm the automatic rollback again, the jump is done (#0051)

2026-08-21 12:00:00 +00:00

base

cert-manager: step 7 of 7 — v1.20.3 to v1.21.1, the target (#0051)

2026-08-21 12:00:00 +00:00

monitoring

netpol: wave 3 — the two namespaces the issue never mentioned (#0088)

2026-08-21 12:00:00 +00:00

production

netpol: MAS reaches Synapse through haproxy now, and the rule did not know it

2026-08-21 12:00:00 +00:00