feat(mas): add matrix-authentication-service

docker-compose.yml

@@ -1,16 +1,17 @@
 services:
+
   synapse:
     image: docker.io/matrixdotorg/synapse:v1.126.0@sha256:206de8e8d72b09dc6158086410332a91ec3cb09976c3f71b805a091c01b65b3f
     restart: unless-stopped
     environment:
       - SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
     volumes:
-      - data:/data
+      - synapse_data:/data
       - uploads:/data/uploads
       - media:/data/media
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.matrix.rule=Host(`${DC_MATRIX_HOSTNAME:?}`)"
+      - "traefik.http.routers.matrix.rule=Host(`${DC_MATRIX_SYNAPSE_HOSTNAME:?}`)"
       - "traefik.http.routers.matrix.entrypoints=websecure"
     depends_on:
       - db
@@ -18,6 +19,25 @@ services:
       - traefik
       - matrix
 
+  mas:
+    image: ghcr.io/element-hq/matrix-authentication-service:latest
+    restart: unless-stopped
+    volumes:
+      - mas_data:/data
+    environment:
+      - MAS_CONFIG=/data/config.yaml
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.mas.entrypoints=websecure"
+      - "traefik.http.routers.mas.priority=200"
+      - "traefik.http.routers.mas.rule=Host(`${DC_MATRIX_MAS_HOSTNAME:?}`) || (Host(`${DC_MATRIX_SYNAPSE_HOSTNAME:?}`) && PathRegexp(`/_matrix/client/.*/(login|logout|refresh)`))"
+      - "traefik.http.services.mas.loadbalancer.server.port=8080"
+    networks:
+      - traefik
+      - matrix
+    depends_on:
+      - db
+
   db:
     image: postgres:17.4@sha256:7f29c02ba9eeff4de9a9f414d803faa0e6fe5e8d15ebe217e3e418c82e652b35
     restart: unless-stopped
@@ -70,7 +90,8 @@ services:
   #     - synapse
 
 volumes:
-  data:
+  mas_data:
+  synapse_data:
   uploads:
   media:
   schemas: