Skip to content

Expose the ESS version and edition in an API #715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 9, 2025
Merged

Expose the ESS version and edition in an API #715

merged 1 commit into from
Sep 9, 2025

Conversation

benbz
Copy link
Member

@benbz benbz commented Sep 5, 2025 •
edited
Loading

The admin API will want this.

This will cause the HAProxy Pods to restart on every chart version upgrade. The alternative is to accept that the version API could return incorrect results after upgrading or we need a sidecar process (that we don't have yet) to send the appropriate reload signal to HAProxy on the config changing

@benbz benbz requested a review from a team as a code owner September 5, 2025 10:45
@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 5, 2025 •
edited
Loading

dyff of changes in rendered templates of CI manifests

Full contents of manifests and dyffs are available in https://github.com/element-hq/ess-helm/actions/runs/17574649544/artifacts/3961480442

example-default-enabled-components-checkov-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 1b77dca27d13cd7d38b6991a93eda0d84b89428c
+ 95d734e6dec6f1922c6de9c652dcbf6ca2c914b1

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 1b77dca27d13cd7d38b6991a93eda0d84b89428c
+ 95d734e6dec6f1922c6de9c652dcbf6ca2c914b1

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
example-default-enabled-components-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 1b77dca27d13cd7d38b6991a93eda0d84b89428c
+ 95d734e6dec6f1922c6de9c652dcbf6ca2c914b1

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 1b77dca27d13cd7d38b6991a93eda0d84b89428c
+ 95d734e6dec6f1922c6de9c652dcbf6ca2c914b1

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
matrix-authentication-service-synapse-syn2mas-dry-run-secrets-externally-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [157 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [twelve lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
matrix-authentication-service-synapse-syn2mas-dry-run-secrets-in-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [157 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [twelve lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
matrix-authentication-service-synapse-syn2mas-migrate-secrets-externally-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [15 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- f4c197219a825fa1832ea2e4e65d80e48b2cb071
+ adde8bf538fba8aed6593be628b2e146588961b2

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- f4c197219a825fa1832ea2e4e65d80e48b2cb071
+ adde8bf538fba8aed6593be628b2e146588961b2

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
matrix-authentication-service-synapse-syn2mas-migrate-secrets-in-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [15 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- f4c197219a825fa1832ea2e4e65d80e48b2cb071
+ adde8bf538fba8aed6593be628b2e146588961b2

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- f4c197219a825fa1832ea2e4e65d80e48b2cb071
+ adde8bf538fba8aed6593be628b2e146588961b2

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
pytest-matrix-authentication-service-syn2mas-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [157 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [twelve lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
pytest-matrix-authentication-service-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [15 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- f4c197219a825fa1832ea2e4e65d80e48b2cb071
+ adde8bf538fba8aed6593be628b2e146588961b2

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- f4c197219a825fa1832ea2e4e65d80e48b2cb071
+ adde8bf538fba8aed6593be628b2e146588961b2

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
pytest-matrix-rtc-synapse-wellknown-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [157 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [53 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- a8124f48c3a4be48005a8d916bba8671438f6715
+ e378a62823ef9775f7f9fc0d53e0efc8ca85137e

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- a8124f48c3a4be48005a8d916bba8671438f6715
+ e378a62823ef9775f7f9fc0d53e0efc8ca85137e

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
pytest-synapse-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [174 lines unchanged)]
  
    acl has_failover var(req.backend) -m str "sliding-sync"
    acl has_failover var(req.backend) -m str "synchrotron"
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
+ 
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
    use_backend synapse-main-failover if has_failover backend_unavailable
  
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [103 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 17917d8efe5a50907112eaadc47e3369c4f21458
+ 23386b78d191dc35b1ddc512188e32caccaa7c89

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 6bea21ec14e730eb35a6701eb22390bea0bec605
+ 13845bb51525860c470bdefbb86a78e2fee1390e

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 17917d8efe5a50907112eaadc47e3369c4f21458
+ 23386b78d191dc35b1ddc512188e32caccaa7c89

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 6bea21ec14e730eb35a6701eb22390bea0bec605
+ 13845bb51525860c470bdefbb86a78e2fee1390e
quick-setup-certificates-pg-external-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
quick-setup-certificates-pg-with-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
quick-setup-external-cert-pg-external-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
quick-setup-external-cert-pg-with-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
quick-setup-letsencrypt-pg-external-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
quick-setup-letsencrypt-pg-with-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
quick-setup-wildcard-cert-pg-external-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
quick-setup-wildcard-cert-pg-with-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [56 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 87b65fc5fba2b3303177f3caef8fe6410cf713d3
+ 6694841c8b5cfb22da47677bdd99be7333dc2ded

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
synapse-checkov-with-workers-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [160 lines unchanged)]
  
    acl has_failover var(req.backend) -m str "event-persister"
    acl has_failover var(req.backend) -m str "federation-reader"
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
+ 
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
    use_backend synapse-main-failover if has_failover backend_unavailable
  
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [41 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 8293c8179c059927b5588f5c4fc91c726425e632
+ a54784ba4cee6fe62a8b3b0b46931bc6f1361d17

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 48cf7c55f6d269c458ff0b5d240804892bc9db8e
+ ebecaf6426a66d3d0afddd9c92252f9894022cd7

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 8293c8179c059927b5588f5c4fc91c726425e632
+ a54784ba4cee6fe62a8b3b0b46931bc6f1361d17

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 48cf7c55f6d269c458ff0b5d240804892bc9db8e
+ ebecaf6426a66d3d0afddd9c92252f9894022cd7
synapse-ingress-additional-paths-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [159 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [14 lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- c0a462f3332330aba681ba2a893d10fc83b6ea1b
+ 7926cee71af5dd69e0dfcbd5e16081e593940711

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- c0a462f3332330aba681ba2a893d10fc83b6ea1b
+ 7926cee71af5dd69e0dfcbd5e16081e593940711

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
synapse-minimal-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [157 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [twelve lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
synapse-postgres-secrets-externally-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [157 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [twelve lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
synapse-postgres-secrets-in-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [157 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [twelve lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
synapse-secrets-externally-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [157 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [twelve lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
synapse-secrets-in-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [157 lines unchanged)]
  
  
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
  
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
+ 
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after-response set-header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+   http-after-response set-header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
+ 
+   http-request return status 200 content-type "application/json" file /synapse/ess-version.json
  
  backend synapse-main
    default-server maxconn 250
  
  
  [twelve lines unchanged)]
  
  # a fake backend which fonxes every request with a 500. Useful for
  # handling overloads etc.
  backend return_500
    http-request deny deny_status 500



@@ ConfigMap/ess-ci/release-name-synapse-haproxy - data @@
+   ess-version.json: "{\"version\": \"25.8.4-dev\", \"edition\": \"community\"}"



@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/shared-haproxy-config-hash @@
- 66867c8b1fdf2396ae832477bad5098c1c376ae0
+ 1cdfd996eb2529d925938b56ccb548ff7a4eace5

@@ Deployment/ess-ci/release-name-haproxy - spec.template.metadata.labels.k8s.element.io/synapse-haproxy-config-hash @@
- 92abbfe6537d8fd95f97e90d5696a6f744f9e47d
+ e4df1bf373115891205b4d50de1d7dbf39c829ef
synapse-worker-example-values.yaml 
@@ ConfigMap/ess-ci/release-name-haproxy - data.haproxy.cfg @@
  global
    maxconn 40000
    log stdout format raw local0 info
  
  
  [191 lines unchanged)]
  
    acl has_failover var(req.backend) -m str "typing-persister"
    acl has_failover var(req.backend) -m str "user-dir"
  
    acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
+ 
+   acl ess_version path /_synapse/ess/version
+   use_backend ess-version-static if ess_version
    use_backend synapse-main-failover if has_failover backend_unavailable
  
    use_backend synapse-%[var(req.backend)]
+ 
+ backend ess-version-static
+   mode http
+ 
+   # Set all the same headers as the well-knowns
+   http-after-response set-header X-Frame-Options SAMEORIGIN
+   http-after-response set-header X-Content-Type-Options nosniff
+   http-after-response set-header X-XSS-Protection "1; mode=block"
+   http-after-response set-header Content-Security-Policy "frame-ancestors 'self'"
+   http-after-response set-header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex"
+ 
+   http-after-response set-header Access-Control-Allow-Origin *
+   http-after...*[Comment body truncated]*

@benbz benbz force-pushed the bbz/ess-version-edition-api branch 4 times, most recently from ebf60b0 to 34139b4 Compare September 8, 2025 10:42
@benbz benbz force-pushed the bbz/ess-version-edition-api branch from 34139b4 to 7f56dd4 Compare September 9, 2025 07:06
@benbz benbz merged commit 2db667c into main Sep 9, 2025
68 checks passed
@benbz benbz deleted the bbz/ess-version-edition-api branch September 9, 2025 07:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gaelgatelement gaelgatelement gaelgatelement approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@benbz @gaelgatelement