add option to enable qr code login

.env.sample

@@ -90,6 +90,14 @@ ENABLE_REGISTRATION=false
 #MAS_UPSTREAM_SYNAPSE_IDP_ID=
 #SECRET_MAS_UPSTREAM_CLIENT_SECRET_VERSION=v1
 
+#### Sign in with QR (Element / Element X) — requires MAS (MSC4108; optional MSC4388)
+
+# Enables Synapse experimental Sign in with QR when used with MAS. See README and
+# https://github.com/element-hq/synapse/issues/19434
+#QR_LOGIN_ENABLED=1
+# Optional: 2025 rendezvous channel (experimental). Valid values: off, public, authenticated (omit or "off" for MSC4108-only).
+#MSC4388_MODE=off
+
 ### Shared secret auth (bridges / automation)
 
 #COMPOSE_FILE="$COMPOSE_FILE:compose.shared_secret_auth.yml"

README.md

@@ -59,6 +59,8 @@ You'll need to deploy something like [this](https://git.autonomic.zone/ruangrupa
 
 **If you plan to migrate an existing homeserver with `syn2mas`:** deploy and configure MAS as above, but **leave `MAS_ENABLED=1` commented** until migration and cutover are done, so Synapse keeps using your current login path until you intentionally switch. You cannot use Synapse legacy OIDC/Keycloak SSO alongside MAS; plan IdP apps and envs accordingly.
 
+**Sign in with QR (experimental):** With `MAS_ENABLED=1`, set `QR_LOGIN_ENABLED=1` in `.env` and redeploy. Synapse then enables experimental [MSC4108](https://github.com/element-hq/synapse/issues/19434) Sign in with QR and `login_via_existing_session`. Optionally set `MSC4388_MODE` to `public` or `authenticated` for the newer rendezvous path ([MSC4388](https://github.com/element-hq/synapse/issues/19433)); omit it or use `off` for MSC4108-only. Client support and proxy caveats (CORS, ETag) are described in those issues.
+
 <details>
 <summary><strong>Migrating an existing server (<code>syn2mas</code>)</strong></summary>
 

abra.sh

@@ -1,6 +1,6 @@
 export DISCORD_BRIDGE_YAML_VERSION=v2
 export ENTRYPOINT_CONF_VERSION=v3
-export HOMESERVER_YAML_VERSION=v36
+export HOMESERVER_YAML_VERSION=v37
 export LOG_CONFIG_VERSION=v2
 export SHARED_SECRET_AUTH_VERSION=v2
 export SIGNAL_BRIDGE_YAML_VERSION=v6

compose.mas.yml

@@ -21,6 +21,23 @@ services:
       - mas_encryption
       - mas_synapse_shared
       - mas_signing_rsa
+    # Official image is distroless (no curl/wget); upstream suggests `mas-cli config check` for probes.
+    # See https://github.com/element-hq/matrix-authentication-service/issues/3741 — validates config, not HTTP.
+    # GET /health is still served (resource `health` in mas.config.yaml.tmpl) for probes from other images.
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "/usr/local/bin/mas-cli",
+          "--config",
+          "/etc/mas/config.yaml",
+          "config",
+          "check",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
     deploy:
       restart_policy:
         condition: on-failure

compose.yml

@@ -48,6 +48,8 @@ services:
       - form_secret
     environment:
       - MAS_ENABLED
+      - QR_LOGIN_ENABLED
+      - MSC4388_MODE
       - ALLOWED_LIFETIME_MAX
       - ALLOW_PUBLIC_ROOMS_FEDERATION
       - AUTO_JOIN_ROOM

homeserver.yaml.tmpl

@@ -309,6 +309,21 @@ matrix_authentication_service:
   secret_path: /run/secrets/mas_synapse_shared
 {{ end }}
 
+{{ if and (eq (env "QR_LOGIN_ENABLED") "1") (eq (env "MAS_ENABLED") "1") }}
+# Sign in with QR (MSC4108 / optional MSC4388). Requires matrix_authentication_service.
+# https://github.com/element-hq/synapse/issues/19434 — https://github.com/element-hq/synapse/issues/19433
+experimental_features:
+  msc4108_enabled: true
+{{ if and (env "MSC4388_MODE") (ne (env "MSC4388_MODE") "off") }}
+  msc4388_mode: {{ env "MSC4388_MODE" }}
+{{ end }}
+# # https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#login_via_existing_session
+# login_via_existing_session:
+#   enabled: true
+#   require_ui_auth: false
+#   token_timeout: 5m
+{{ end }}
+
 # https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#email
 {{ if eq (env "SMTP_ENABLED") "1" }}
 email:

mas.config.yaml.tmpl

@@ -19,6 +19,8 @@ http:
         - name: graphql
           playground: false
         - name: assets
+        # https://element-hq.github.io/matrix-authentication-service/reference/configuration.html#httplisteners
+        - name: health
       binds:
         - address: "[::]:8080"