Running synapse without nginx #47

New Issue

2025-05-23T16:45:32Z

Ghost commented

2025-05-23 16:45:32 +00:00

Hello, I'm new to the coop-cloud ecosystem but was surprised to see this recipe includes an nginx container by default.

Looking at nginx.conf.tmpl, it seems like the nginx container does the following:

Sets client_max_body_size=50M
Serves the files .well-known/matrix/server and .well-known/matrix/client which are used for delegation

Number 1 can be implemented with traefik.http.middlewares.limit.buffering.maxRequestBodyBytes=50000000: https://doc.traefik.io/traefik/middlewares/http/buffering/

And number 2 only seems to be required in some edge cases. Sounds like you only need to serve those .well-known files if 1) synapse is hosted on a subdomain, 2) your coop-cloud server is hosted on the root domain, and 3) you want usernames to reference the root domain and not the subdomain. EDIT: Using a different server_name hasn't been supported since the .well-known files nginx serves are never served from a different domain.

If any of those three things are untrue, then it seems like the nginx container wouldn't be necessary. Is that common enough to be the default rather than in a separate compose.delegation.yaml file?

Or if we don't want to change the defaults, should we add a compose.no-nginx.yaml file which uses !reset to remove the nginx service and sets the required labels to send traffic directly to synapse?

Interested in your thoughts!

Hello, I'm new to the coop-cloud ecosystem but was surprised to see this recipe includes an nginx container by default. Looking at [`nginx.conf.tmpl`](https://git.coopcloud.tech/coop-cloud/matrix-synapse/src/branch/main/nginx.conf.tmpl), it seems like the nginx container does the following: 1. Sets `client_max_body_size=50M` 2. Serves the files `.well-known/matrix/server` and `.well-known/matrix/client` which are used for [delegation](https://element-hq.github.io/synapse/latest/delegate.html) Number 1 can be implemented with `traefik.http.middlewares.limit.buffering.maxRequestBodyBytes=50000000`: https://doc.traefik.io/traefik/middlewares/http/buffering/ ~~And number 2 only seems to be required in some edge cases. Sounds like you only need to serve those `.well-known` files if 1) synapse is hosted on a subdomain, 2) your coop-cloud server is hosted on the root domain, and 3) you want usernames to reference the root domain and not the subdomain.~~ EDIT: Using a different server_name hasn't been supported since the .well-known files nginx serves are never served from a different domain. If any of those three things are untrue, then it seems like the nginx container wouldn't be necessary. Is that common enough to be the default rather than in a separate `compose.delegation.yaml` file? Or if we don't want to change the defaults, should we add a `compose.no-nginx.yaml` file which uses [`!reset`](https://docs.docker.com/reference/compose-file/merge/#reset-value) to remove the nginx service and sets the required labels to send traffic directly to synapse? Interested in your thoughts!

decentral1se commented

2025-05-23 17:17:43 +00:00

hey @mac-chaffee, you're most welcome and thanks for opening this issue! I originally implemented this without nginx but ended up including it because "privacy" #38 I would totally support the no-nginx version config (let's see if it complicates things tho) but it would be nice to have this warning about the IP tracking.

hey @mac-chaffee, you're most welcome and thanks for opening this issue! I originally implemented this without nginx but ended up including it because "privacy" https://git.coopcloud.tech/coop-cloud/matrix-synapse/issues/38 I would totally support the no-nginx version config (let's see if it complicates things tho) but it would be nice to have this warning about the IP tracking.

Ghost commented

2025-05-23 17:37:20 +00:00

Hmm I did see that issue and was confused. All coop-cloud instances use traefik, right? Traefik indeed seems to send the x-forwarded-for header to backends by default, so if you can't make synapse stop saving those IPs, then that would be a problem. But I think we can tell traefik to stop setting that header like this:

- "traefik.http.middlewares.remove-xff.headers.customrequestheaders.X-Forwarded-For="
- "traefik.http.routers.${STACK_NAME}.middlewares=remove-xff"

There was some confusion online about whether this was possible, but seems like it should work as of traefik v2.10: https://github.com/traefik/traefik/pull/10132

Hmm I did see that issue and was confused. All coop-cloud instances use traefik, right? Traefik indeed seems to send the x-forwarded-for header to backends by default, so if you can't make synapse stop saving those IPs, then that would be a problem. But I think we can tell traefik to stop setting that header like this: ``` - "traefik.http.middlewares.remove-xff.headers.customrequestheaders.X-Forwarded-For=" - "traefik.http.routers.${STACK_NAME}.middlewares=remove-xff" ``` There was some confusion online about whether this was possible, but seems like it should work as of traefik v2.10: https://github.com/traefik/traefik/pull/10132

Ghost commented

2025-05-23 17:40:19 +00:00

Checking the dates on #38 and that v2.10 PR, I see that the feature was super new, maybe not even released yet. So I guess only now do we possibly have the powers to remove nginx, but we didn't back then!

decentral1se commented

2025-05-24 19:26:38 +00:00

@mac-chaffee nice detective work! If you wanna brave effort which can maintain functionality without nginx, be my guest! I imagine it might even be backwards compatible with existing deployments if you manage to do it well? You'd need to test it quite a bit tho. I don't maintain a synapse install anymore but I imagine other maintainers might have something to say here or could lend a hand. I'm not sure who that is atm but maybe the git log will show you and you can ping them.

@mac-chaffee nice detective work! If you wanna brave effort which can maintain functionality without nginx, be my guest! I imagine it might even be backwards compatible with existing deployments if you manage to do it well? You'd need to test it quite a bit tho. I don't maintain a synapse install anymore but I imagine other maintainers might have something to say here or could lend a hand. I'm not sure who that is atm but maybe the `git log` will show you and you can ping them.

Ghost referenced this issue from toolshed/abra

2025-05-25 18:02:32 +00:00

`abra app deploy` throws R011 when removing a service #562

Ghost referenced a pull request that will close this issue

2025-05-25 18:03:00 +00:00

WIP: Remove dependency on nginx #48

decentral1se commented

2026-03-17 20:17:15 +00:00

Feel free to re-open if work is proceeding.

decentral1se closed this issue

2026-03-17 20:17:15 +00:00

Sign in to join this conversation.