From 81d6db9e0762637216b5cfb2f1dfd25539b6646d Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Tue, 9 Jun 2026 13:33:34 +0200 Subject: [PATCH] fix(web-app-matrix): correct port forwards for synapse on host network MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI failure 27049736006 showed the probe at http://127.0.0.1:8021 timed out (Connection reset by peer) for the full 15-min budget even though matrix-mdad and its inner synapse were running. Root cause: with matrix_synapse_container_network=host, MDAD's docker run -p flag (rendered from matrix_synapse_container_client_api_host_bind_port) is silently ignored — host networking does not use port mappings. Synapse binds inside matrix-mdad's network namespace on its native container port (8008 client, 8048 federation), not on the externally-advertised host bind port. The outer compose service was forwarding host 127.0.0.1:8021 -> matrix-mdad:8021, where nothing was listening. - services.yml.j2: outer compose port forwards now target the real internal synapse / federation / element ports (8008 / 8048 / 8080). Host ports stay aligned with MATRIX_SYNAPSE_PORT / MATRIX_ELEMENT_PORT / MATRIX_FEDERATION_PORT so the front-proxy targets a single 127.0.0.1 port regardless of flavor. - vars.yml.j2: drop the now-useless matrix_synapse_container_*_host_bind_port and matrix_client_element_container_http_host_bind_port settings — they only render a -p flag MDAD would ignore on --network=host. Tests: 186/186 green. Co-Authored-By: Claude Opus 4.7 --- .../web-app-matrix/templates/flavor/ansible/services.yml.j2 | 6 +++--- roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 | 3 --- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/roles/web-app-matrix/templates/flavor/ansible/services.yml.j2 b/roles/web-app-matrix/templates/flavor/ansible/services.yml.j2 index 40684dadf5..a0504643ab 100644 --- a/roles/web-app-matrix/templates/flavor/ansible/services.yml.j2 +++ b/roles/web-app-matrix/templates/flavor/ansible/services.yml.j2 @@ -33,6 +33,6 @@ - /run/lock - /tmp ports: - - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_SYNAPSE_PORT }}:{{ MATRIX_SYNAPSE_PORT }}" - - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_ELEMENT_PORT }}:{{ MATRIX_ELEMENT_PORT }}" - - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_FEDERATION_PORT }}:{{ MATRIX_FEDERATION_PORT }}" + - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_SYNAPSE_PORT }}:8008" + - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_ELEMENT_PORT }}:8080" + - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_FEDERATION_PORT }}:8048" diff --git a/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 b/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 index 8655b9ce2d..76474e4e6c 100644 --- a/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 +++ b/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 @@ -42,9 +42,6 @@ matrix_synapse_turn_uris: matrix_synapse_turn_shared_secret: "{{ MATRIX_COTURN_AUTH_SECRET }}" {% endif %} -matrix_synapse_container_client_api_host_bind_port: "0.0.0.0:{{ MATRIX_SYNAPSE_PORT }}" -matrix_synapse_container_federation_api_plain_host_bind_port: "0.0.0.0:{{ MATRIX_FEDERATION_PORT }}" -matrix_client_element_container_http_host_bind_port: "0.0.0.0:{{ MATRIX_ELEMENT_PORT }}" valkey_enabled: false