Add CORS header to Element's map_style.json for Element Desktop

Element Desktop (Electron) loads the location-sharing map style from a
`vector://vector` origin, so fetching map_style.json from the Element
domain is a cross-origin request. Without an Access-Control-Allow-Origin
header, the request is blocked and maps fail to load with "This homeserver
is not configured correctly to display maps".

Add a dedicated Traefik router for map_style.json that attaches an
Access-Control-Allow-Origin header (configurable via
matrix_client_element_location_sharing_map_style_access_control_allow_origin,
defaulting to `*`). It is only defined when location sharing is enabled.

Fixes #2291

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/custom/matrix-client-element/defaults/main.yml

@@ -346,6 +346,10 @@ matrix_client_element_configuration: "{{ matrix_client_element_configuration_def
 # How to host your own map tile server: https://matrix.org/docs/guides/map-tile-server
 matrix_client_element_location_sharing_enabled: false
 
+# Controls the value of the `Access-Control-Allow-Origin` header attached to responses for `map_style.json`.
+# Element Desktop loads the map style from a `vector://vector` origin, so cross-origin access needs to be allowed.
+matrix_client_element_location_sharing_map_style_access_control_allow_origin: "*"
+
 # Default Element location sharing map style configuration template which covers the generic use case.
 # You can customize it by controlling the various variables inside it.
 #

roles/custom/matrix-client-element/templates/labels.j2

@@ -51,6 +51,23 @@ traefik.http.routers.matrix-client-element.tls={{ matrix_client_element_containe
 traefik.http.routers.matrix-client-element.tls.certResolver={{ matrix_client_element_container_labels_traefik_tls_certResolver }}
 {% endif %}
 
+{% if matrix_client_element_location_sharing_enabled %}
+{#
+	A dedicated router for the map style file, which attaches an Access-Control-Allow-Origin header.
+	Element Desktop loads the map style from a `vector://vector` origin, so it needs to be allowed cross-origin access.
+#}
+traefik.http.middlewares.matrix-client-element-map-style-add-headers.headers.customresponseheaders.Access-Control-Allow-Origin={{ matrix_client_element_location_sharing_map_style_access_control_allow_origin }}
+
+traefik.http.routers.matrix-client-element-map-style.rule={{ matrix_client_element_container_labels_traefik_rule }} && Path(`{{ (matrix_client_element_container_labels_traefik_path_prefix ~ '/map_style.json') | regex_replace('^//', '/') }}`)
+traefik.http.routers.matrix-client-element-map-style.service=matrix-client-element
+traefik.http.routers.matrix-client-element-map-style.middlewares={{ (middlewares + ['matrix-client-element-map-style-add-headers']) | join(',') }}
+traefik.http.routers.matrix-client-element-map-style.entrypoints={{ matrix_client_element_container_labels_traefik_entrypoints }}
+traefik.http.routers.matrix-client-element-map-style.tls={{ matrix_client_element_container_labels_traefik_tls | to_json }}
+{% if matrix_client_element_container_labels_traefik_tls %}
+traefik.http.routers.matrix-client-element-map-style.tls.certResolver={{ matrix_client_element_container_labels_traefik_tls_certResolver }}
+{% endif %}
+{% endif %}
+
 {% endif %}
 
 {{ matrix_client_element_container_labels_additional_labels }}