spantaleev/matrix-docker-ansible-deploy
1
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2026-07-22 19:01:22 +10:00
Code Issues Packages Projects Releases Wiki Activity

matrix-tuwunel: add labels to expose the /_tuwunel API path

Browse Source 
The /_tuwunel namespace carries Tuwunel's ad-hoc routes (server_version,
local_user_count) and its native OpenID Connect provider endpoints
(/_tuwunel/oidc/...), which a reverse proxy must route for OIDC login
to work. Add public (enabled by default, like the client API) and
internal Traefik label groups.
This commit is contained in:
Jason Volk
2026-07-19 01:57:56 +00:00
committed by Slavi Pantaleev
parent 1febc275f2
commit e1d40fd831
5 changed files with 96 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuring-playbook-tuwunel.md
+11
View File
@@ -180,6 +180,17 @@ When enabled, rooms with a valid `m.room.policy` state event have outgoing event
The role sets `default_room_version: '12'`, so newly created rooms default to Matrix [room version 12](https://github.com/matrix-org/matrix-spec-proposals/pull/4289) ("Hydra"). Override `matrix_tuwunel_config_default_room_version` if you need an earlier version for client compatibility.
### The `/_tuwunel` API path
Besides `/_matrix`, Tuwunel serves its own first-party routes under `/_tuwunel`. This namespace carries ad-hoc endpoints such as `/_tuwunel/server_version` and `/_tuwunel/local_user_count`, and the [native OpenID Connect provider](https://matrix-construct.github.io/tuwunel/authentication/oidc-server.html) endpoints (`/_tuwunel/oidc/...`) that clients use when Tuwunel handles OIDC login itself, rather than delegating to an upstream provider as described above. The role routes `/_tuwunel` on the public entrypoint by default so these features work out of the box.
To keep this namespace off the public entrypoint and expose it only on the internal one, set:
```yaml
matrix_tuwunel_container_labels_public_tuwunel_api_enabled: false
matrix_tuwunel_container_labels_internal_tuwunel_api_enabled: true
```
### Exposing the Administration API
Tuwunel serves a Synapse-compatible Administration API under the `/_synapse/admin` path, so administration dashboards (such as synapse-admin and ketesa) and moderation bots (such as Draupnir and Meowlnir) work against it. The served endpoints are listed on the [Tuwunel Synapse Admin API page](https://matrix-construct.github.io/tuwunel/development/compliance/synapse-admin.html).