From 0dcce5637261d294ebb31623d31298674fe65490 Mon Sep 17 00:00:00 2001
From: Aine <aine@etke.cc>
Date: Sat, 19 Sep 2026 11:03:03 +0100
Subject: [PATCH] fix maubot plugins proxy

---
 .../matrix-bot-maubot/defaults/main.yml       |  3 +-
 .../molecule/default/verify.yml               | 33 ++++++++++++++++++-
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/roles/custom/matrix-bot-maubot/defaults/main.yml b/roles/custom/matrix-bot-maubot/defaults/main.yml
index ba09915f6..8fabf24dd 100644
--- a/roles/custom/matrix-bot-maubot/defaults/main.yml
+++ b/roles/custom/matrix-bot-maubot/defaults/main.yml
@@ -60,9 +60,10 @@ matrix_bot_maubot_config_path: "{{ matrix_bot_maubot_base_path }}/config"
 matrix_bot_maubot_container_src_files_path: "{{ matrix_bot_maubot_base_path }}/docker-src"
 matrix_bot_maubot_customized_container_src_files_path: "{{ matrix_bot_maubot_base_path }}/customized-docker-src"
 
+# Traefik strips the path prefix before proxying, so maubot sees relative paths internally.
 matrix_bot_maubot_bot_server_public_url: "{{ matrix_bot_maubot_scheme }}://{{ matrix_bot_maubot_hostname }}{{ '' if matrix_bot_maubot_path_prefix == '/' else matrix_bot_maubot_path_prefix }}"
 matrix_bot_maubot_bot_server_ui_base_path: /
-matrix_bot_maubot_bot_server_plugin_base_path: /_matrix/maubot/plugin/
+matrix_bot_maubot_bot_server_plugin_base_path: /plugin/
 
 matrix_bot_maubot_proxy_management_interface: true
 
diff --git a/roles/custom/matrix-bot-maubot/molecule/default/verify.yml b/roles/custom/matrix-bot-maubot/molecule/default/verify.yml
index a5e88bf7a..69f638999 100644
--- a/roles/custom/matrix-bot-maubot/molecule/default/verify.yml
+++ b/roles/custom/matrix-bot-maubot/molecule/default/verify.yml
@@ -66,7 +66,7 @@
           - matrix_bot_maubot_config.server.port == matrix_bot_maubot_server_port
           - matrix_bot_maubot_config.server.public_url == 'https://maubot.molecule.local/molecule-maubot'
           - matrix_bot_maubot_config.server.ui_base_path == '/'
-          - matrix_bot_maubot_config.server.plugin_base_path == '/_matrix/maubot/plugin/'
+          - matrix_bot_maubot_config.server.plugin_base_path == '/plugin/'
           - "'base_path' not in matrix_bot_maubot_config.server"
           - "'appservice_base_path' not in matrix_bot_maubot_config.server"
           - matrix_bot_maubot_config.server.unshared_secret == matrix_bot_maubot_unshared_secret
@@ -214,6 +214,37 @@
           ({{ matrix_bot_maubot_login_http.stdout | default('no output') }})
         success_msg: "Maubot's live management API authenticated the configured admin"
 
+    # Traefik strips the public prefix, so plugin webhooks reach Maubot at the relative
+    # plugin_base_path. Maubot's plugin router answers unknown instances with an empty 404,
+    # while aiohttp's default 404 carries a body, so the empty body proves the router is mounted.
+    - name: Probe Maubot's plugin endpoint router
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --network={{ matrix_bot_maubot_container_network }}
+          - "{{ molecule_shared_image_curl }}"
+          - --silent
+          - --show-error
+          - --write-out
+          - "\nHTTP_STATUS=%{http_code}"
+          - "http://matrix-bot-maubot:{{ matrix_bot_maubot_server_port }}/plugin/molecule-probe"
+      register: matrix_bot_maubot_plugin_http
+      changed_when: false
+      failed_when: false
+
+    - name: Assert Maubot's plugin router handles the configured plugin base path
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_maubot_plugin_http.rc == 0
+          - matrix_bot_maubot_plugin_http.stdout_lines[-1] == 'HTTP_STATUS=404'
+          - matrix_bot_maubot_plugin_http.stdout_lines[:-1] | join('\n') | trim | length == 0
+        fail_msg: >-
+          Maubot's plugin router did not answer on the configured plugin base path
+          ({{ matrix_bot_maubot_plugin_http.stdout | default('no output') }})
+        success_msg: "Maubot's plugin router answers on the configured plugin base path"
+
     # The role's default port must not answer. Otherwise reaching the custom port would not
     # prove that the configured value made it into the running process.
     - name: Probe the role's default Maubot port