feat: use nginx proxy, config for public rooms (fedi)
continuous-integration/drone/push Build is failing
Details
continuous-integration/drone/push Build is failing
Details
See #38.
This commit is contained in:
parent
7683ebd189
commit
08b49c14d9
|
@ -24,6 +24,8 @@ SECRET_REGISTRATION_VERSION=v1
|
||||||
# Set "true" to enable federation endpoint on $DOMAIN/.well-known/matrix/server
|
# Set "true" to enable federation endpoint on $DOMAIN/.well-known/matrix/server
|
||||||
SERVE_SERVER_WELLKNOWN=false
|
SERVE_SERVER_WELLKNOWN=false
|
||||||
|
|
||||||
|
ALLOW_PUBLIC_ROOMS_FEDERATION=false
|
||||||
|
|
||||||
## Registration
|
## Registration
|
||||||
|
|
||||||
ENABLE_REGISTRATION=false
|
ENABLE_REGISTRATION=false
|
||||||
|
|
5
abra.sh
5
abra.sh
|
@ -1,10 +1,13 @@
|
||||||
export DISCORD_BRIDGE_YAML_VERSION=v2
|
export DISCORD_BRIDGE_YAML_VERSION=v2
|
||||||
export ENTRYPOINT_CONF_VERSION=v1
|
export ENTRYPOINT_CONF_VERSION=v1
|
||||||
export HOMESERVER_YAML_VERSION=v23
|
export HOMESERVER_YAML_VERSION=v24
|
||||||
export LOG_CONFIG_VERSION=v2
|
export LOG_CONFIG_VERSION=v2
|
||||||
export SHARED_SECRET_AUTH_VERSION=v1
|
export SHARED_SECRET_AUTH_VERSION=v1
|
||||||
export SIGNAL_BRIDGE_YAML_VERSION=v4
|
export SIGNAL_BRIDGE_YAML_VERSION=v4
|
||||||
export TELEGRAM_BRIDGE_YAML_VERSION=v6
|
export TELEGRAM_BRIDGE_YAML_VERSION=v6
|
||||||
|
export NGINX_CONFIG_VERSION=v4
|
||||||
|
export WK_SERVER_VERSION=v1
|
||||||
|
export WK_CLIENT_VERSION=v1
|
||||||
|
|
||||||
set_admin () {
|
set_admin () {
|
||||||
admin=akadmin
|
admin=akadmin
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
version: "3.8"
|
version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
synapse:
|
||||||
environment:
|
environment:
|
||||||
- APP_SERVICES_ENABLED
|
- APP_SERVICES_ENABLED
|
||||||
- APP_SERVICE_CONFIGS
|
- APP_SERVICE_CONFIGS
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
version: "3.8"
|
version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
synapse:
|
||||||
secrets:
|
secrets:
|
||||||
- db_password
|
- db_password
|
||||||
- form_secret
|
- form_secret
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
version: "3.8"
|
version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
synapse:
|
||||||
secrets:
|
secrets:
|
||||||
- keycloak2_client_secret
|
- keycloak2_client_secret
|
||||||
environment:
|
environment:
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
version: "3.8"
|
version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
synapse:
|
||||||
secrets:
|
secrets:
|
||||||
- keycloak3_client_secret
|
- keycloak3_client_secret
|
||||||
environment:
|
environment:
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
version: "3.8"
|
version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
synapse:
|
||||||
environment:
|
environment:
|
||||||
- SHARED_SECRET_AUTH_ENABLED
|
- SHARED_SECRET_AUTH_ENABLED
|
||||||
secrets:
|
secrets:
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
version: "3.8"
|
version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
synapse:
|
||||||
environment:
|
environment:
|
||||||
- APP_SERVICES_ENABLED
|
- APP_SERVICES_ENABLED
|
||||||
- APP_SERVICE_CONFIGS
|
- APP_SERVICE_CONFIGS
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
version: "3.8"
|
version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
synapse:
|
||||||
secrets:
|
secrets:
|
||||||
- db_password
|
- db_password
|
||||||
- form_secret
|
- form_secret
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
version: "3.8"
|
version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
synapse:
|
||||||
environment:
|
environment:
|
||||||
- APP_SERVICES_ENABLED
|
- APP_SERVICES_ENABLED
|
||||||
- APP_SERVICE_CONFIGS
|
- APP_SERVICE_CONFIGS
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
version: "3.8"
|
version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
synapse:
|
||||||
secrets:
|
secrets:
|
||||||
- db_password
|
- db_password
|
||||||
- form_secret
|
- form_secret
|
||||||
|
|
58
compose.yml
58
compose.yml
|
@ -3,11 +3,40 @@ version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
app:
|
||||||
|
image: nginx:1.23.3
|
||||||
|
networks:
|
||||||
|
- proxy
|
||||||
|
- internal
|
||||||
|
environment:
|
||||||
|
- STACK_NAME
|
||||||
|
configs:
|
||||||
|
- source: nginx_config
|
||||||
|
target: /etc/nginx/nginx.conf
|
||||||
|
- source: wk_server
|
||||||
|
target: /var/www/.well-known/matrix/server
|
||||||
|
- source: wk_client
|
||||||
|
target: /var/www/.well-known/matrix/client
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: on-failure
|
||||||
|
labels:
|
||||||
|
- "traefik.enable=true"
|
||||||
|
- "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
|
||||||
|
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
|
||||||
|
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
|
||||||
|
- "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
|
||||||
|
- "coop-cloud.${STACK_NAME}.version=5.0.0+v1.93.0"
|
||||||
|
- "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
|
||||||
|
healthcheck:
|
||||||
|
test: curl -f http://synapse:8008/health || exit 1
|
||||||
|
interval: 5s
|
||||||
|
timeout: 3s
|
||||||
|
retries: 20
|
||||||
|
|
||||||
|
synapse:
|
||||||
image: "matrixdotorg/synapse:v1.93.0"
|
image: "matrixdotorg/synapse:v1.93.0"
|
||||||
volumes:
|
volumes:
|
||||||
- "data:/data"
|
- "data:/data"
|
||||||
depends_on:
|
|
||||||
- db
|
|
||||||
secrets:
|
secrets:
|
||||||
- db_password
|
- db_password
|
||||||
- registration_shared_secret
|
- registration_shared_secret
|
||||||
|
@ -15,6 +44,7 @@ services:
|
||||||
- form_secret
|
- form_secret
|
||||||
environment:
|
environment:
|
||||||
- ALLOWED_LIFETIME_MAX
|
- ALLOWED_LIFETIME_MAX
|
||||||
|
- ALLOW_PUBLIC_ROOMS_FEDERATION
|
||||||
- AUTO_JOIN_ROOM
|
- AUTO_JOIN_ROOM
|
||||||
- AUTO_JOIN_ROOM_ENABLED
|
- AUTO_JOIN_ROOM_ENABLED
|
||||||
- DISABLE_FEDERATION
|
- DISABLE_FEDERATION
|
||||||
|
@ -41,7 +71,6 @@ services:
|
||||||
- VIRTUAL_HOST=${DOMAIN}
|
- VIRTUAL_HOST=${DOMAIN}
|
||||||
- VIRTUAL_PORT=8008
|
- VIRTUAL_PORT=8008
|
||||||
networks:
|
networks:
|
||||||
- proxy
|
|
||||||
- internal
|
- internal
|
||||||
entrypoint: /docker-entrypoint.sh
|
entrypoint: /docker-entrypoint.sh
|
||||||
configs:
|
configs:
|
||||||
|
@ -52,17 +81,6 @@ services:
|
||||||
- source: entrypoint_conf
|
- source: entrypoint_conf
|
||||||
target: /docker-entrypoint.sh
|
target: /docker-entrypoint.sh
|
||||||
mode: 0555
|
mode: 0555
|
||||||
deploy:
|
|
||||||
restart_policy:
|
|
||||||
condition: on-failure
|
|
||||||
labels:
|
|
||||||
- "traefik.enable=true"
|
|
||||||
- "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8008"
|
|
||||||
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
|
|
||||||
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
|
|
||||||
- "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
|
|
||||||
- "coop-cloud.${STACK_NAME}.version=4.0.0+v1.93.0"
|
|
||||||
- "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
|
|
||||||
healthcheck:
|
healthcheck:
|
||||||
test: ["CMD", "curl", "-f", "http://localhost:8008/health"]
|
test: ["CMD", "curl", "-f", "http://localhost:8008/health"]
|
||||||
interval: 30s
|
interval: 30s
|
||||||
|
@ -121,6 +139,18 @@ configs:
|
||||||
name: ${STACK_NAME}_log_config_${LOG_CONFIG_VERSION}
|
name: ${STACK_NAME}_log_config_${LOG_CONFIG_VERSION}
|
||||||
file: log.config.tmpl
|
file: log.config.tmpl
|
||||||
template_driver: golang
|
template_driver: golang
|
||||||
|
nginx_config:
|
||||||
|
name: ${STACK_NAME}_nginx_config_${NGINX_CONFIG_VERSION}
|
||||||
|
file: nginx.conf.tmpl
|
||||||
|
template_driver: golang
|
||||||
|
wk_server:
|
||||||
|
name: ${STACK_NAME}_wk_server_${WK_SERVER_VERSION}
|
||||||
|
file: well_known_server.conf.tmpl
|
||||||
|
template_driver: golang
|
||||||
|
wk_client:
|
||||||
|
name: ${STACK_NAME}_wk_client_${WK_CLIENT_VERSION}
|
||||||
|
file: well_known_client.conf.tmpl
|
||||||
|
template_driver: golang
|
||||||
|
|
||||||
secrets:
|
secrets:
|
||||||
db_password:
|
db_password:
|
||||||
|
|
|
@ -78,7 +78,7 @@ allow_public_rooms_without_auth: false
|
||||||
# If set to 'true', allows any other homeserver to fetch the server's public
|
# If set to 'true', allows any other homeserver to fetch the server's public
|
||||||
# rooms directory via federation. Defaults to 'false'.
|
# rooms directory via federation. Defaults to 'false'.
|
||||||
#
|
#
|
||||||
allow_public_rooms_over_federation: false
|
allow_public_rooms_over_federation: {{ env "ALLOW_PUBLIC_ROOMS_FEDERATION" }}
|
||||||
|
|
||||||
listeners:
|
listeners:
|
||||||
# Unsecure HTTP listener: for when matrix traffic passes through a reverse proxy
|
# Unsecure HTTP listener: for when matrix traffic passes through a reverse proxy
|
||||||
|
|
|
@ -0,0 +1,31 @@
|
||||||
|
user www-data;
|
||||||
|
|
||||||
|
events {
|
||||||
|
worker_connections 768;
|
||||||
|
}
|
||||||
|
|
||||||
|
http {
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
|
||||||
|
access_log off;
|
||||||
|
error_log /dev/null;
|
||||||
|
|
||||||
|
server_name {{ env "DOMAIN" }};
|
||||||
|
|
||||||
|
location ~* ^(\/_matrix|\/_synapse\/client) {
|
||||||
|
proxy_pass http://{{ env "STACK_NAME"}}_synapse:8008;
|
||||||
|
proxy_set_header X-Forwarded-For $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
client_max_body_size 50M;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /.well-known/matrix/ {
|
||||||
|
root /var/www/;
|
||||||
|
default_type application/json;
|
||||||
|
add_header Access-Control-Allow-Origin *;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
|
@ -0,0 +1,17 @@
|
||||||
|
An Nginx proxy has been configured as the entrypoint for Synapse. This is not
|
||||||
|
optional. This is done to counteract IP collection in Synapse itself. See more:
|
||||||
|
|
||||||
|
!!! You MUST undeploy your Synapse install before upgrading to this version !!!
|
||||||
|
|
||||||
|
This is because there have been a service rename in the recipe configuration:
|
||||||
|
|
||||||
|
* `app` -> `synapse`
|
||||||
|
|
||||||
|
This could break stuff in the recipe, so please report issues if you run into
|
||||||
|
anything!
|
||||||
|
|
||||||
|
https://git.coopcloud.tech/coop-cloud/matrix-synapse/issues/38
|
||||||
|
|
||||||
|
Thanks!
|
||||||
|
|
||||||
|
-- d1
|
|
@ -0,0 +1,5 @@
|
||||||
|
{
|
||||||
|
"m.homeserver": {
|
||||||
|
"base_url": "https://{{ env "DOMAIN" }}"
|
||||||
|
}
|
||||||
|
}
|
|
@ -0,0 +1,3 @@
|
||||||
|
{
|
||||||
|
"m.server": "{{ env "DOMAIN" }}:443"
|
||||||
|
}
|
Loading…
Reference in New Issue