Ubuntu
2 years ago
parent
1d1b19dced
commit
7a37d33ff2
@ -0,0 +1,56 @@ |
|||||||
|
version: '3' |
||||||
|
services: |
||||||
|
# the default synpase uses a sqlite database; this should be fixed at somepoint |
||||||
|
# matrix-db: |
||||||
|
# image: postgres:13.4-alpine |
||||||
|
# restart: unless-stopped |
||||||
|
# volumes: |
||||||
|
# - ./data/matrix/db:/var/lib/postgresql/data |
||||||
|
# environment: |
||||||
|
# - POSTGRES_DB=synapse |
||||||
|
# - POSTGRES_USER=synapse |
||||||
|
# - POSTGRES_PASSWORD=STRONGPASSWORD |
||||||
|
|
||||||
|
matrix-element: |
||||||
|
image: vectorim/element-web:latest |
||||||
|
restart: unless-stopped |
||||||
|
container_name: matrix-element |
||||||
|
env_file: |
||||||
|
- env.production |
||||||
|
volumes: |
||||||
|
- ./matrix/10-envsubst-config.sh:/docker-entrypoint.d/10-envsubst-config.sh:ro |
||||||
|
- ./matrix/config.sample.json:/app/config.sample.json:ro |
||||||
|
depends_on: |
||||||
|
- matrix-synapse |
||||||
|
# ports: |
||||||
|
# - "5000:80" |
||||||
|
|
||||||
|
matrix-synapse: |
||||||
|
image: matrixdotorg/synapse:latest |
||||||
|
restart: unless-stopped |
||||||
|
container_name: matrix-synapse |
||||||
|
volumes: |
||||||
|
- ./data/matrix/synapse:/data |
||||||
|
- ./matrix/entrypoint-synapse.sh:/entrypoint.sh:ro |
||||||
|
entrypoint: ["/entrypoint.sh"] |
||||||
|
env_file: |
||||||
|
- env.production |
||||||
|
environment: |
||||||
|
- MATRIX_CLIENT_SECRET=${MATRIX_CLIENT_SECRET} |
||||||
|
depends_on: |
||||||
|
- keycloak |
||||||
|
- nginx |
||||||
|
# ports: |
||||||
|
# - "5008:8008" |
||||||
|
|
||||||
|
# add the nginx configuration into the nginx volume |
||||||
|
nginx: |
||||||
|
volumes: |
||||||
|
- ./matrix/nginx.conf:/etc/nginx/templates/matrix.conf.template:ro |
||||||
|
|
||||||
|
# add the client secrets to the keycloak-setup volume |
||||||
|
keycloak-setup: |
||||||
|
env_file: |
||||||
|
- data/matrix/secrets |
||||||
|
volumes: |
||||||
|
- ./matrix/keycloak.sh:/keycloak-setup/matrix.sh:ro |
||||||
@ -0,0 +1,5 @@ |
|||||||
|
#!/bin/sh |
||||||
|
|
||||||
|
echo >&2 "**** Configuring for $DOMAIN_NAME" |
||||||
|
envsubst < /app/config.sample.json > /app/config.json |
||||||
|
head /app/config.json |
||||||
@ -0,0 +1,3 @@ |
|||||||
|
# Matrix/Element chat |
||||||
|
|
||||||
|
The sample config for the JSON comes from 8891698745897388db037ea8692937edc199630c on vector-im/element-web |
||||||
@ -0,0 +1,53 @@ |
|||||||
|
{ |
||||||
|
"default_server_config": { |
||||||
|
"m.homeserver": { |
||||||
|
"base_url": "https://${MATRIX_HOSTNAME}.${DOMAIN_NAME}", |
||||||
|
"server_name": "${DOMAIN_NAME}" |
||||||
|
}, |
||||||
|
"m.identity_server": { |
||||||
|
"base_url": "https://vector.im" |
||||||
|
} |
||||||
|
}, |
||||||
|
"disable_custom_urls": false, |
||||||
|
"disable_guests": false, |
||||||
|
"disable_login_language_selector": false, |
||||||
|
"disable_3pid_login": false, |
||||||
|
"brand": "Element", |
||||||
|
"integrations_ui_url": "https://scalar.vector.im/", |
||||||
|
"integrations_rest_url": "https://scalar.vector.im/api", |
||||||
|
"integrations_widgets_urls": [ |
||||||
|
"https://scalar.vector.im/_matrix/integrations/v1", |
||||||
|
"https://scalar.vector.im/api", |
||||||
|
"https://scalar-staging.vector.im/_matrix/integrations/v1", |
||||||
|
"https://scalar-staging.vector.im/api", |
||||||
|
"https://scalar-staging.riot.im/scalar/api" |
||||||
|
], |
||||||
|
"bug_report_endpoint_url": "https://element.io/bugreports/submit", |
||||||
|
"uisi_autorageshake_app": "element-auto-uisi", |
||||||
|
"default_country_code": "GB", |
||||||
|
"show_labs_settings": false, |
||||||
|
"features": { }, |
||||||
|
"default_federate": true, |
||||||
|
"default_theme": "light", |
||||||
|
"room_directory": { |
||||||
|
"servers": [ |
||||||
|
"matrix.org" |
||||||
|
] |
||||||
|
}, |
||||||
|
"enable_presence_by_hs_url": { |
||||||
|
"https://matrix.org": false, |
||||||
|
"https://matrix-client.matrix.org": false |
||||||
|
}, |
||||||
|
"setting_defaults": { |
||||||
|
"breadcrumbs": true |
||||||
|
}, |
||||||
|
"jitsi": { |
||||||
|
"preferred_domain": "meet.element.io" |
||||||
|
}, |
||||||
|
"element_call": { |
||||||
|
"url": "https://call.element.io", |
||||||
|
"participant_limit": 8, |
||||||
|
"brand": "Element Call" |
||||||
|
}, |
||||||
|
"map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx" |
||||||
|
} |
||||||
@ -1,27 +0,0 @@ |
|||||||
version: '3' |
|
||||||
services: |
|
||||||
postgres: |
|
||||||
image: postgres:13.4-alpine |
|
||||||
restart: unless-stopped |
|
||||||
volumes: |
|
||||||
- ../data/matrix/postgresdata:/var/lib/postgresql/data |
|
||||||
environment: |
|
||||||
- POSTGRES_DB=synapse |
|
||||||
- POSTGRES_USER=synapse |
|
||||||
- POSTGRES_PASSWORD=STRONGPASSWORD |
|
||||||
|
|
||||||
element: |
|
||||||
image: vectorim/element-web:latest |
|
||||||
restart: unless-stopped |
|
||||||
volumes: |
|
||||||
- ../data/matrix/element-config.json:/app/config.json |
|
||||||
ports: |
|
||||||
- "5000:80" |
|
||||||
|
|
||||||
synapse: |
|
||||||
image: matrixdotorg/synapse:latest |
|
||||||
restart: unless-stopped |
|
||||||
volumes: |
|
||||||
- ../data/matrix/synapse:/data |
|
||||||
ports: |
|
||||||
- "5008:8008" |
|
||||||
@ -1,73 +0,0 @@ |
|||||||
{ |
|
||||||
"default_server_config": { |
|
||||||
"m.homeserver": { |
|
||||||
"base_url": "https://${MATRIX_HOSTNAME}", |
|
||||||
"server_name": "${DOMAIN_NAME}" |
|
||||||
}, |
|
||||||
"m.identity_server": { |
|
||||||
"base_url": "https://vector.im" |
|
||||||
} |
|
||||||
}, |
|
||||||
"brand": "Element", |
|
||||||
"integrations_ui_url": "https://scalar.vector.im/", |
|
||||||
"integrations_rest_url": "https://scalar.vector.im/api", |
|
||||||
"integrations_widgets_urls": [ |
|
||||||
"https://scalar.vector.im/_matrix/integrations/v1", |
|
||||||
"https://scalar.vector.im/api", |
|
||||||
"https://scalar-staging.vector.im/_matrix/integrations/v1", |
|
||||||
"https://scalar-staging.vector.im/api", |
|
||||||
"https://scalar-staging.riot.im/scalar/api" |
|
||||||
], |
|
||||||
"hosting_signup_link": "https://element.io/matrix-services?utm_source=element-web&utm_medium=web", |
|
||||||
"bug_report_endpoint_url": "https://element.io/bugreports/submit", |
|
||||||
"uisi_autorageshake_app": "element-auto-uisi", |
|
||||||
"showLabsSettings": true, |
|
||||||
"piwik": { |
|
||||||
"url": "https://piwik.riot.im/", |
|
||||||
"siteId": 1, |
|
||||||
"policyUrl": "https://element.io/cookie-policy" |
|
||||||
}, |
|
||||||
"roomDirectory": { |
|
||||||
"servers": [ |
|
||||||
"matrix.org", |
|
||||||
"gitter.im", |
|
||||||
"libera.chat" |
|
||||||
] |
|
||||||
}, |
|
||||||
"enable_presence_by_hs_url": { |
|
||||||
"https://matrix.org": false, |
|
||||||
"https://matrix-client.matrix.org": false |
|
||||||
}, |
|
||||||
"terms_and_conditions_links": [ |
|
||||||
{ |
|
||||||
"url": "https://element.io/privacy", |
|
||||||
"text": "Privacy Policy" |
|
||||||
}, |
|
||||||
{ |
|
||||||
"url": "https://element.io/cookie-policy", |
|
||||||
"text": "Cookie Policy" |
|
||||||
} |
|
||||||
], |
|
||||||
"hostSignup": { |
|
||||||
"brand": "Element Home", |
|
||||||
"cookiePolicyUrl": "https://element.io/cookie-policy", |
|
||||||
"domains": [ |
|
||||||
"matrix.org" |
|
||||||
], |
|
||||||
"privacyPolicyUrl": "https://element.io/privacy", |
|
||||||
"termsOfServiceUrl": "https://element.io/terms-of-service", |
|
||||||
"url": "https://ems.element.io/element-home/in-app-loader" |
|
||||||
}, |
|
||||||
"sentry": { |
|
||||||
"dsn": "https://029a0eb289f942508ae0fb17935bd8c5@sentry.matrix.org/6", |
|
||||||
"environment": "develop" |
|
||||||
}, |
|
||||||
"posthog": { |
|
||||||
"projectApiKey": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO", |
|
||||||
"apiHost": "https://posthog.element.io" |
|
||||||
}, |
|
||||||
"features": { |
|
||||||
"feature_spotlight": true |
|
||||||
}, |
|
||||||
"map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx" |
|
||||||
} |
|
||||||
@ -0,0 +1,62 @@ |
|||||||
|
#!/bin/bash |
||||||
|
# This is the custom startup script for the synpase server |
||||||
|
|
||||||
|
# fix up the Element client config to have the correct hostname |
||||||
|
# based on the environment variables |
||||||
|
#export DOMAIN_NAME MATRIX_HOSTNAME |
||||||
|
#envsubst < "element-config.json.template" > "$DATA/element-config.json" |
||||||
|
|
||||||
|
HOMESERVER_YAML="/data/homeserver.yaml" |
||||||
|
|
||||||
|
if [ ! -r "$HOMESERVER_YAML" ]; then |
||||||
|
echo >&2 "***** Configuring the home server for $DOMAIN_NAME *****" |
||||||
|
|
||||||
|
export SYNAPSE_SERVER_NAME="$DOMAIN_NAME" |
||||||
|
export SYNAPSE_REPORT_STATS="no" |
||||||
|
|
||||||
|
/start.py generate \ |
||||||
|
|| exit 1 |
||||||
|
|
||||||
|
echo >&2 "***** Adding OIDC provider *****" |
||||||
|
cat <<EOF >> "$HOMESERVER_YAML" |
||||||
|
# |
||||||
|
# added by hackerspace-zone setup scripts |
||||||
|
# |
||||||
|
suppress_key_server_warning: true |
||||||
|
web_client_location: https://${MATRIX_HOSTNAME}.${DOMAIN_NAME} |
||||||
|
public_baseurl: https://${MATRIX_HOSTNAME}.${DOMAIN_NAME} |
||||||
|
oidc_providers: |
||||||
|
- idp_id: keycloak |
||||||
|
idp_name: "Keycloak" |
||||||
|
issuer: "https://${KEYCLOAK_HOSTNAME}.${DOMAIN_NAME}/realms/${REALM}" |
||||||
|
client_id: "matrix" |
||||||
|
client_secret: "${MATRIX_CLIENT_SECRET}" |
||||||
|
scopes: ["openid", "profile"] |
||||||
|
user_mapping_provider: |
||||||
|
config: |
||||||
|
localpart_template: "{{ user.preferred_username }}" |
||||||
|
display_name_template: "{{ user.name }}" |
||||||
|
EOF |
||||||
|
|
||||||
|
fi |
||||||
|
|
||||||
|
if ! grep -q '^ smtp_host:' && [ -n "$SMTP_SERVER" ]; then |
||||||
|
echo >&2 "***** Adding SMTP setup to yaml" |
||||||
|
cat <<EOF >> "$HOMESERVER_YAML" |
||||||
|
# |
||||||
|
# added by hackerspace-zone setup scripts |
||||||
|
# |
||||||
|
email: |
||||||
|
smtp_host: ${SMTP_SERVER} |
||||||
|
smtp_port: ${SMTP_PORT} |
||||||
|
smtp_user: "${SMTP_USER}" |
||||||
|
smtp_pass: "${SMTP_PASSWORD}" |
||||||
|
require_transport_security: true |
||||||
|
notif_from: "%(app)s matrix homeserver <noreply@${DOMAIN_NAME}>" |
||||||
|
app_name: ${DOMAIN_NAME} |
||||||
|
EOF |
||||||
|
fi |
||||||
|
|
||||||
|
# hack to let keycloak startup |
||||||
|
sleep 5 |
||||||
|
exec /start.py |
||||||
@ -1 +0,0 @@ |
|||||||
# variables |
|
||||||
@ -0,0 +1,4 @@ |
|||||||
|
#!/bin/bash -x |
||||||
|
# Setup the OAuth client connection |
||||||
|
|
||||||
|
client-create matrix "$MATRIX_HOSTNAME.$DOMAIN_NAME" "$MATRIX_CLIENT_SECRET" </dev/null |
||||||
@ -0,0 +1,71 @@ |
|||||||
|
map $http_upgrade $connection_upgrade { |
||||||
|
default upgrade; |
||||||
|
'' close; |
||||||
|
} |
||||||
|
|
||||||
|
server { |
||||||
|
server_name ${MATRIX_HOSTNAME} ${MATRIX_HOSTNAME}.${DOMAIN_NAME}; |
||||||
|
client_max_body_size 128m; |
||||||
|
|
||||||
|
sendfile on; |
||||||
|
tcp_nopush on; |
||||||
|
tcp_nodelay on; |
||||||
|
keepalive_timeout 65; |
||||||
|
types_hash_max_size 2048; |
||||||
|
#include /etc/nginx/mime.types; |
||||||
|
#default_type application/octet-stream; |
||||||
|
|
||||||
|
gzip on; |
||||||
|
gzip_disable "msie6"; |
||||||
|
|
||||||
|
proxy_read_timeout 1800s; |
||||||
|
|
||||||
|
# required to avoid HTTP 411: see Issue #1486 (https://github.com/dotcloud/docker/issues/1486) |
||||||
|
chunked_transfer_encoding on; |
||||||
|
|
||||||
|
location / { |
||||||
|
proxy_pass http://matrix-element:80; |
||||||
|
proxy_set_header Host $host; |
||||||
|
proxy_set_header X-Real-IP $remote_addr; |
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
||||||
|
proxy_set_header X-Forwarded-Proto $scheme; |
||||||
|
} |
||||||
|
|
||||||
|
location ~ ^(/_matrix|/_synapse/client) { |
||||||
|
# note: do not add a path (even a single /) after the port in `proxy_pass`, |
||||||
|
# otherwise nginx will canonicalise the URI and cause signature verification |
||||||
|
# errors. |
||||||
|
proxy_pass http://matrix-synapse:8008; |
||||||
|
proxy_set_header X-Forwarded-For $remote_addr; |
||||||
|
proxy_set_header X-Forwarded-Proto $scheme; |
||||||
|
proxy_set_header Host $host; |
||||||
|
|
||||||
|
# Nginx by default only allows file uploads up to 1M in size |
||||||
|
# Increase client_max_body_size to match max_upload_size defined in homeserver.yaml |
||||||
|
client_max_body_size 50M; |
||||||
|
} |
||||||
|
|
||||||
|
# serve the static content for the well known files |
||||||
|
location /.well-known/matrix/server { |
||||||
|
default_type application/json; |
||||||
|
return 200 '{"m.server": "${MATRIX_HOSTNAME}.${DOMAIN_NAME}:443"}'; |
||||||
|
} |
||||||
|
|
||||||
|
location /.well-known/matrix/client { |
||||||
|
default_type application/json; |
||||||
|
return 200 '{"m.homeserver":{"base_url": "https://${MATRIX_HOSTNAME}.${DOMAIN_NAME}"}}'; |
||||||
|
} |
||||||
|
|
||||||
|
# The federation port is also enabled, although it can also go through 443 |
||||||
|
listen 8448 ssl http2 default_server; |
||||||
|
#listen [::]:8448 ssl http2 default_server; |
||||||
|
|
||||||
|
# For the user connection |
||||||
|
listen 443 ssl http2; |
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem; |
||||||
|
ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem; |
||||||
|
include /etc/nginx/includes/options-ssl-nginx.conf; |
||||||
|
include /etc/nginx/includes/challenge.conf; |
||||||
|
ssl_dhparam /etc/nginx/includes/ssl-dhparams.pem; |
||||||
|
} |
||||||
@ -1,88 +0,0 @@ |
|||||||
#!/bin/bash |
|
||||||
die() { echo >&2 "matrix: ERROR $@" ; exit 1 ; } |
|
||||||
info() { echo >&2 "matrix: $@" ; } |
|
||||||
|
|
||||||
DIRNAME="$(dirname $0)" |
|
||||||
cd "$DIRNAME" |
|
||||||
source ../env.production || die "no top levle env?" |
|
||||||
source ../env.smtp 2>/dev/null |
|
||||||
source env.production || die "no local env?" |
|
||||||
|
|
||||||
DATA="../data/matrix" |
|
||||||
SYNAPSE_DIR="$DATA/synapse" |
|
||||||
HOMESERVER_YAML="$SYNAPSE_DIR/homeserver.yaml" |
|
||||||
if [ -r "$HOMESERVER_YAML" ]; then |
|
||||||
docker-compose up -d || die "matrix: unable to restart" |
|
||||||
exit 0 |
|
||||||
fi |
|
||||||
|
|
||||||
docker-compose down 2>/dev/null |
|
||||||
mkdir -p "$DATA" |
|
||||||
|
|
||||||
# fix up the Element client config to have the correct hostname |
|
||||||
# based on the environment variables |
|
||||||
export DOMAIN_NAME MATRIX_HOSTNAME |
|
||||||
envsubst < "element-config.json.template" > "$DATA/element-config.json" |
|
||||||
|
|
||||||
|
|
||||||
# This will create a *delegated* matrix server, |
|
||||||
# where the "servername" is just the top level domain, |
|
||||||
# but it is hosted on "matrix.DOMAIN_NAME". |
|
||||||
# the syntax here is confusing and it is not clear in |
|
||||||
# the docs *which* have to be updated. |
|
||||||
docker-compose run \ |
|
||||||
--rm \ |
|
||||||
-e SYNAPSE_SERVER_NAME="$DOMAIN_NAME" \ |
|
||||||
-e SYNAPSE_REPORT_STATS="no" \ |
|
||||||
synapse generate \ |
|
||||||
|| die "unable to generate synapse config" |
|
||||||
|
|
||||||
MATRIX_CLIENT_SECRET="$(openssl rand -hex 20)" |
|
||||||
|
|
||||||
cat <<EOF >> "$HOMESERVER_YAML" |
|
||||||
web_client_location: https://${MATRIX_HOSTNAME}/ |
|
||||||
public_baseurl: https://${MATRIX_HOSTNAME}/ |
|
||||||
oidc_providers: |
|
||||||
- idp_id: keycloak |
|
||||||
idp_name: "KeyCloak" |
|
||||||
issuer: "https://${KEYCLOAK_HOSTNAME}/realms/${REALM}" |
|
||||||
client_id: "synapse" |
|
||||||
client_secret: "${MATRIX_CLIENT_SECRET}" |
|
||||||
scopes: ["openid", "profile"] |
|
||||||
user_mapping_provider: |
|
||||||
config: |
|
||||||
localpart_template: "{{ user.preferred_username }}" |
|
||||||
display_name_template: "{{ user.name }}" |
|
||||||
EOF |
|
||||||
|
|
||||||
if [ -n "$SMTP_SERVER" ]; then |
|
||||||
info "configuring email" |
|
||||||
cat <<EOF >> "$HOMESERVER_YAML" |
|
||||||
email: |
|
||||||
smtp_host: ${SMTP_SERVER} |
|
||||||
smtp_port: ${SMTP_PORT} |
|
||||||
smtp_user: "${SMTP_USER}" |
|
||||||
smtp_pass: "${SMTP_PASSWORD}" |
|
||||||
require_transport_security: true |
|
||||||
notif_from: "%(app)s matrix homeserver <noreply@${DOMAIN_NAME}>" |
|
||||||
app_name: ${DOMAIN_NAME} |
|
||||||
EOF |
|
||||||
fi |
|
||||||
|
|
||||||
|
|
||||||
../keycloak/client-delete 'synapse' 2>/dev/null |
|
||||||
|
|
||||||
../keycloak/client-create << EOF || die "unable to create client id" |
|
||||||
{ |
|
||||||
"clientId": "synapse", |
|
||||||
"rootUrl": "https://$MATRIX_HOSTNAME/", |
|
||||||
"adminUrl": "https://$MATRIX_HOSTNAME/", |
|
||||||
"redirectUris": [ "https://$MATRIX_HOSTNAME/*" ], |
|
||||||
"webOrigins": [ "https://$MATRIX_HOSTNAME" ], |
|
||||||
"clientAuthenticatorType": "client-secret", |
|
||||||
"secret": "$MATRIX_CLIENT_SECRET" |
|
||||||
} |
|
||||||
EOF |
|
||||||
|
|
||||||
|
|
||||||
docker-compose up -d || die "matrix: unable to start container" |
|
||||||
Loading…
Reference in new issue