feat: proxying support

Part of #1.

abra.sh

@@ -1,2 +1,3 @@
 export ENTRYPOINT_CONF_VERSION=v1
 export TURNSERVER_CONF_VERSION=v1
+export NGINX_CONFIG_VERSION=v1

compose.yml

@@ -2,6 +2,28 @@
 version: "3.8"
 
 services:
+  web:
+    image: nginx:1.20.0
+    networks:
+      - proxy
+      - internal
+    environment:
+      - DOMAIN
+      - STACK_NAME
+    configs:
+      - source: nginx_config
+        target: /etc/nginx/nginx.conf
+    deploy:
+      restart_policy:
+        condition: on-failure
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
+        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
+        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "coop-cloud.${STACK_NAME}.version=0.1.0+v1.48.0"
+
   app:
     image: "matrixdotorg/synapse:v1.48.0"
     volumes:
@@ -16,7 +38,7 @@ services:
       - VIRTUAL_HOST=${DOMAIN}
       - VIRTUAL_PORT=8008
     networks:
-      - proxy
+      - internal
     entrypoint: /docker-entrypoint.sh
     configs:
       - source: homeserver_yaml
@@ -25,13 +47,6 @@ services:
         target: /docker-entrypoint.sh
         mode: 0555
     deploy:
-      labels:
-        - "traefik.enable=true"
-        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8008"
-        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
-        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
-        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=0.1.0+v1.48.0"
       restart_policy:
         condition: on-failure
         delay: "60s"
@@ -73,6 +88,10 @@ configs:
     name: ${STACK_NAME}_homserver_yaml_${HOMESERVER_YAML_VERSION}
     file: homeserver.yaml.tmpl
     template_driver: golang
+  nginx_config:
+    name: ${STACK_NAME}_nginx_config_${NGINX_CONFIG_VERSION}
+    file: nginx.conf.tmpl
+    template_driver: golang
 
 secrets:
   db_password:

homeserver.yaml.tmpl

@@ -917,7 +917,7 @@ media_store_path: "/data/media_store"
 # your reverse proxy's config. Notably Nginx has a small max body size by default.
 # See https://matrix-org.github.io/synapse/latest/reverse_proxy.html.
 #
-#max_upload_size: 50M
+max_upload_size: 50M
 
 # Maximum number of pixels that will be thumbnailed
 #

nginx.conf.tmpl

@@ -0,0 +1,26 @@
+user www-data;
+
+events {
+  worker_connections 768;
+}
+
+http {
+  upstream backend {
+    server {{ env "STACK_NAME" }}_app:8008;
+  }
+
+  include /etc/nginx/mime.types;
+
+  server {
+    listen 80;
+    server_name {{ env "DOMAIN" }};
+
+    location ~* ^(\/_matrix|\/_synapse\/client) {
+      proxy_pass http://backend;
+      proxy_set_header X-Forwarded-For $remote_addr;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header Host $host;
+      client_max_body_size 50M;
+    }
+  }
+}