Ubuntu
2 years ago
parent
1d1b19dced
commit
7a37d33ff2
@ -0,0 +1,56 @@ |
||||
version: '3' |
||||
services: |
||||
# the default synpase uses a sqlite database; this should be fixed at somepoint |
||||
# matrix-db: |
||||
# image: postgres:13.4-alpine |
||||
# restart: unless-stopped |
||||
# volumes: |
||||
# - ./data/matrix/db:/var/lib/postgresql/data |
||||
# environment: |
||||
# - POSTGRES_DB=synapse |
||||
# - POSTGRES_USER=synapse |
||||
# - POSTGRES_PASSWORD=STRONGPASSWORD |
||||
|
||||
matrix-element: |
||||
image: vectorim/element-web:latest |
||||
restart: unless-stopped |
||||
container_name: matrix-element |
||||
env_file: |
||||
- env.production |
||||
volumes: |
||||
- ./matrix/10-envsubst-config.sh:/docker-entrypoint.d/10-envsubst-config.sh:ro |
||||
- ./matrix/config.sample.json:/app/config.sample.json:ro |
||||
depends_on: |
||||
- matrix-synapse |
||||
# ports: |
||||
# - "5000:80" |
||||
|
||||
matrix-synapse: |
||||
image: matrixdotorg/synapse:latest |
||||
restart: unless-stopped |
||||
container_name: matrix-synapse |
||||
volumes: |
||||
- ./data/matrix/synapse:/data |
||||
- ./matrix/entrypoint-synapse.sh:/entrypoint.sh:ro |
||||
entrypoint: ["/entrypoint.sh"] |
||||
env_file: |
||||
- env.production |
||||
environment: |
||||
- MATRIX_CLIENT_SECRET=${MATRIX_CLIENT_SECRET} |
||||
depends_on: |
||||
- keycloak |
||||
- nginx |
||||
# ports: |
||||
# - "5008:8008" |
||||
|
||||
# add the nginx configuration into the nginx volume |
||||
nginx: |
||||
volumes: |
||||
- ./matrix/nginx.conf:/etc/nginx/templates/matrix.conf.template:ro |
||||
|
||||
# add the client secrets to the keycloak-setup volume |
||||
keycloak-setup: |
||||
env_file: |
||||
- data/matrix/secrets |
||||
volumes: |
||||
- ./matrix/keycloak.sh:/keycloak-setup/matrix.sh:ro |
||||
@ -0,0 +1,5 @@ |
||||
#!/bin/sh |
||||
|
||||
echo >&2 "**** Configuring for $DOMAIN_NAME" |
||||
envsubst < /app/config.sample.json > /app/config.json |
||||
head /app/config.json |
||||
@ -0,0 +1,3 @@ |
||||
# Matrix/Element chat |
||||
|
||||
The sample config for the JSON comes from 8891698745897388db037ea8692937edc199630c on vector-im/element-web |
||||
@ -0,0 +1,53 @@ |
||||
{ |
||||
"default_server_config": { |
||||
"m.homeserver": { |
||||
"base_url": "https://${MATRIX_HOSTNAME}.${DOMAIN_NAME}", |
||||
"server_name": "${DOMAIN_NAME}" |
||||
}, |
||||
"m.identity_server": { |
||||
"base_url": "https://vector.im" |
||||
} |
||||
}, |
||||
"disable_custom_urls": false, |
||||
"disable_guests": false, |
||||
"disable_login_language_selector": false, |
||||
"disable_3pid_login": false, |
||||
"brand": "Element", |
||||
"integrations_ui_url": "https://scalar.vector.im/", |
||||
"integrations_rest_url": "https://scalar.vector.im/api", |
||||
"integrations_widgets_urls": [ |
||||
"https://scalar.vector.im/_matrix/integrations/v1", |
||||
"https://scalar.vector.im/api", |
||||
"https://scalar-staging.vector.im/_matrix/integrations/v1", |
||||
"https://scalar-staging.vector.im/api", |
||||
"https://scalar-staging.riot.im/scalar/api" |
||||
], |
||||
"bug_report_endpoint_url": "https://element.io/bugreports/submit", |
||||
"uisi_autorageshake_app": "element-auto-uisi", |
||||
"default_country_code": "GB", |
||||
"show_labs_settings": false, |
||||
"features": { }, |
||||
"default_federate": true, |
||||
"default_theme": "light", |
||||
"room_directory": { |
||||
"servers": [ |
||||
"matrix.org" |
||||
] |
||||
}, |
||||
"enable_presence_by_hs_url": { |
||||
"https://matrix.org": false, |
||||
"https://matrix-client.matrix.org": false |
||||
}, |
||||
"setting_defaults": { |
||||
"breadcrumbs": true |
||||
}, |
||||
"jitsi": { |
||||
"preferred_domain": "meet.element.io" |
||||
}, |
||||
"element_call": { |
||||
"url": "https://call.element.io", |
||||
"participant_limit": 8, |
||||
"brand": "Element Call" |
||||
}, |
||||
"map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx" |
||||
} |
||||
@ -1,27 +0,0 @@ |
||||
version: '3' |
||||
services: |
||||
postgres: |
||||
image: postgres:13.4-alpine |
||||
restart: unless-stopped |
||||
volumes: |
||||
- ../data/matrix/postgresdata:/var/lib/postgresql/data |
||||
environment: |
||||
- POSTGRES_DB=synapse |
||||
- POSTGRES_USER=synapse |
||||
- POSTGRES_PASSWORD=STRONGPASSWORD |
||||
|
||||
element: |
||||
image: vectorim/element-web:latest |
||||
restart: unless-stopped |
||||
volumes: |
||||
- ../data/matrix/element-config.json:/app/config.json |
||||
ports: |
||||
- "5000:80" |
||||
|
||||
synapse: |
||||
image: matrixdotorg/synapse:latest |
||||
restart: unless-stopped |
||||
volumes: |
||||
- ../data/matrix/synapse:/data |
||||
ports: |
||||
- "5008:8008" |
||||
@ -1,73 +0,0 @@ |
||||
{ |
||||
"default_server_config": { |
||||
"m.homeserver": { |
||||
"base_url": "https://${MATRIX_HOSTNAME}", |
||||
"server_name": "${DOMAIN_NAME}" |
||||
}, |
||||
"m.identity_server": { |
||||
"base_url": "https://vector.im" |
||||
} |
||||
}, |
||||
"brand": "Element", |
||||
"integrations_ui_url": "https://scalar.vector.im/", |
||||
"integrations_rest_url": "https://scalar.vector.im/api", |
||||
"integrations_widgets_urls": [ |
||||
"https://scalar.vector.im/_matrix/integrations/v1", |
||||
"https://scalar.vector.im/api", |
||||
"https://scalar-staging.vector.im/_matrix/integrations/v1", |
||||
"https://scalar-staging.vector.im/api", |
||||
"https://scalar-staging.riot.im/scalar/api" |
||||
], |
||||
"hosting_signup_link": "https://element.io/matrix-services?utm_source=element-web&utm_medium=web", |
||||
"bug_report_endpoint_url": "https://element.io/bugreports/submit", |
||||
"uisi_autorageshake_app": "element-auto-uisi", |
||||
"showLabsSettings": true, |
||||
"piwik": { |
||||
"url": "https://piwik.riot.im/", |
||||
"siteId": 1, |
||||
"policyUrl": "https://element.io/cookie-policy" |
||||
}, |
||||
"roomDirectory": { |
||||
"servers": [ |
||||
"matrix.org", |
||||
"gitter.im", |
||||
"libera.chat" |
||||
] |
||||
}, |
||||
"enable_presence_by_hs_url": { |
||||
"https://matrix.org": false, |
||||
"https://matrix-client.matrix.org": false |
||||
}, |
||||
"terms_and_conditions_links": [ |
||||
{ |
||||
"url": "https://element.io/privacy", |
||||
"text": "Privacy Policy" |
||||
}, |
||||
{ |
||||
"url": "https://element.io/cookie-policy", |
||||
"text": "Cookie Policy" |
||||
} |
||||
], |
||||
"hostSignup": { |
||||
"brand": "Element Home", |
||||
"cookiePolicyUrl": "https://element.io/cookie-policy", |
||||
"domains": [ |
||||
"matrix.org" |
||||
], |
||||
"privacyPolicyUrl": "https://element.io/privacy", |
||||
"termsOfServiceUrl": "https://element.io/terms-of-service", |
||||
"url": "https://ems.element.io/element-home/in-app-loader" |
||||
}, |
||||
"sentry": { |
||||
"dsn": "https://029a0eb289f942508ae0fb17935bd8c5@sentry.matrix.org/6", |
||||
"environment": "develop" |
||||
}, |
||||
"posthog": { |
||||
"projectApiKey": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO", |
||||
"apiHost": "https://posthog.element.io" |
||||
}, |
||||
"features": { |
||||
"feature_spotlight": true |
||||
}, |
||||
"map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx" |
||||
} |
||||
@ -0,0 +1,62 @@ |
||||
#!/bin/bash |
||||
# This is the custom startup script for the synpase server |
||||
|
||||
# fix up the Element client config to have the correct hostname |
||||
# based on the environment variables |
||||
#export DOMAIN_NAME MATRIX_HOSTNAME |
||||
#envsubst < "element-config.json.template" > "$DATA/element-config.json" |
||||
|
||||
HOMESERVER_YAML="/data/homeserver.yaml" |
||||
|
||||
if [ ! -r "$HOMESERVER_YAML" ]; then |
||||
echo >&2 "***** Configuring the home server for $DOMAIN_NAME *****" |
||||
|
||||
export SYNAPSE_SERVER_NAME="$DOMAIN_NAME" |
||||
export SYNAPSE_REPORT_STATS="no" |
||||
|
||||
/start.py generate \ |
||||
|| exit 1 |
||||
|
||||
echo >&2 "***** Adding OIDC provider *****" |
||||
cat <<EOF >> "$HOMESERVER_YAML" |
||||
# |
||||
# added by hackerspace-zone setup scripts |
||||
# |
||||
suppress_key_server_warning: true |
||||
web_client_location: https://${MATRIX_HOSTNAME}.${DOMAIN_NAME} |
||||
public_baseurl: https://${MATRIX_HOSTNAME}.${DOMAIN_NAME} |
||||
oidc_providers: |
||||
- idp_id: keycloak |
||||
idp_name: "Keycloak" |
||||
issuer: "https://${KEYCLOAK_HOSTNAME}.${DOMAIN_NAME}/realms/${REALM}" |
||||
client_id: "matrix" |
||||
client_secret: "${MATRIX_CLIENT_SECRET}" |
||||
scopes: ["openid", "profile"] |
||||
user_mapping_provider: |
||||
config: |
||||
localpart_template: "{{ user.preferred_username }}" |
||||
display_name_template: "{{ user.name }}" |
||||
EOF |
||||
|
||||
fi |
||||
|
||||
if ! grep -q '^ smtp_host:' && [ -n "$SMTP_SERVER" ]; then |
||||
echo >&2 "***** Adding SMTP setup to yaml" |
||||
cat <<EOF >> "$HOMESERVER_YAML" |
||||
# |
||||
# added by hackerspace-zone setup scripts |
||||
# |
||||
email: |
||||
smtp_host: ${SMTP_SERVER} |
||||
smtp_port: ${SMTP_PORT} |
||||
smtp_user: "${SMTP_USER}" |
||||
smtp_pass: "${SMTP_PASSWORD}" |
||||
require_transport_security: true |
||||
notif_from: "%(app)s matrix homeserver <noreply@${DOMAIN_NAME}>" |
||||
app_name: ${DOMAIN_NAME} |
||||
EOF |
||||
fi |
||||
|
||||
# hack to let keycloak startup |
||||
sleep 5 |
||||
exec /start.py |
||||
@ -1 +0,0 @@ |
||||
# variables |
||||
@ -0,0 +1,4 @@ |
||||
#!/bin/bash -x |
||||
# Setup the OAuth client connection |
||||
|
||||
client-create matrix "$MATRIX_HOSTNAME.$DOMAIN_NAME" "$MATRIX_CLIENT_SECRET" </dev/null |
||||
@ -0,0 +1,71 @@ |
||||
map $http_upgrade $connection_upgrade { |
||||
default upgrade; |
||||
'' close; |
||||
} |
||||
|
||||
server { |
||||
server_name ${MATRIX_HOSTNAME} ${MATRIX_HOSTNAME}.${DOMAIN_NAME}; |
||||
client_max_body_size 128m; |
||||
|
||||
sendfile on; |
||||
tcp_nopush on; |
||||
tcp_nodelay on; |
||||
keepalive_timeout 65; |
||||
types_hash_max_size 2048; |
||||
#include /etc/nginx/mime.types; |
||||
#default_type application/octet-stream; |
||||
|
||||
gzip on; |
||||
gzip_disable "msie6"; |
||||
|
||||
proxy_read_timeout 1800s; |
||||
|
||||
# required to avoid HTTP 411: see Issue #1486 (https://github.com/dotcloud/docker/issues/1486) |
||||
chunked_transfer_encoding on; |
||||
|
||||
location / { |
||||
proxy_pass http://matrix-element:80; |
||||
proxy_set_header Host $host; |
||||
proxy_set_header X-Real-IP $remote_addr; |
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
||||
proxy_set_header X-Forwarded-Proto $scheme; |
||||
} |
||||
|
||||
location ~ ^(/_matrix|/_synapse/client) { |
||||
# note: do not add a path (even a single /) after the port in `proxy_pass`, |
||||
# otherwise nginx will canonicalise the URI and cause signature verification |
||||
# errors. |
||||
proxy_pass http://matrix-synapse:8008; |
||||
proxy_set_header X-Forwarded-For $remote_addr; |
||||
proxy_set_header X-Forwarded-Proto $scheme; |
||||
proxy_set_header Host $host; |
||||
|
||||
# Nginx by default only allows file uploads up to 1M in size |
||||
# Increase client_max_body_size to match max_upload_size defined in homeserver.yaml |
||||
client_max_body_size 50M; |
||||
} |
||||
|
||||
# serve the static content for the well known files |
||||
location /.well-known/matrix/server { |
||||
default_type application/json; |
||||
return 200 '{"m.server": "${MATRIX_HOSTNAME}.${DOMAIN_NAME}:443"}'; |
||||
} |
||||
|
||||
location /.well-known/matrix/client { |
||||
default_type application/json; |
||||
return 200 '{"m.homeserver":{"base_url": "https://${MATRIX_HOSTNAME}.${DOMAIN_NAME}"}}'; |
||||
} |
||||
|
||||
# The federation port is also enabled, although it can also go through 443 |
||||
listen 8448 ssl http2 default_server; |
||||
#listen [::]:8448 ssl http2 default_server; |
||||
|
||||
# For the user connection |
||||
listen 443 ssl http2; |
||||
|
||||
ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem; |
||||
ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem; |
||||
include /etc/nginx/includes/options-ssl-nginx.conf; |
||||
include /etc/nginx/includes/challenge.conf; |
||||
ssl_dhparam /etc/nginx/includes/ssl-dhparams.pem; |
||||
} |
||||
@ -1,88 +0,0 @@ |
||||
#!/bin/bash |
||||
die() { echo >&2 "matrix: ERROR $@" ; exit 1 ; } |
||||
info() { echo >&2 "matrix: $@" ; } |
||||
|
||||
DIRNAME="$(dirname $0)" |
||||
cd "$DIRNAME" |
||||
source ../env.production || die "no top levle env?" |
||||
source ../env.smtp 2>/dev/null |
||||
source env.production || die "no local env?" |
||||
|
||||
DATA="../data/matrix" |
||||
SYNAPSE_DIR="$DATA/synapse" |
||||
HOMESERVER_YAML="$SYNAPSE_DIR/homeserver.yaml" |
||||
if [ -r "$HOMESERVER_YAML" ]; then |
||||
docker-compose up -d || die "matrix: unable to restart" |
||||
exit 0 |
||||
fi |
||||
|
||||
docker-compose down 2>/dev/null |
||||
mkdir -p "$DATA" |
||||
|
||||
# fix up the Element client config to have the correct hostname |
||||
# based on the environment variables |
||||
export DOMAIN_NAME MATRIX_HOSTNAME |
||||
envsubst < "element-config.json.template" > "$DATA/element-config.json" |
||||
|
||||
|
||||
# This will create a *delegated* matrix server, |
||||
# where the "servername" is just the top level domain, |
||||
# but it is hosted on "matrix.DOMAIN_NAME". |
||||
# the syntax here is confusing and it is not clear in |
||||
# the docs *which* have to be updated. |
||||
docker-compose run \ |
||||
--rm \ |
||||
-e SYNAPSE_SERVER_NAME="$DOMAIN_NAME" \ |
||||
-e SYNAPSE_REPORT_STATS="no" \ |
||||
synapse generate \ |
||||
|| die "unable to generate synapse config" |
||||
|
||||
MATRIX_CLIENT_SECRET="$(openssl rand -hex 20)" |
||||
|
||||
cat <<EOF >> "$HOMESERVER_YAML" |
||||
web_client_location: https://${MATRIX_HOSTNAME}/ |
||||
public_baseurl: https://${MATRIX_HOSTNAME}/ |
||||
oidc_providers: |
||||
- idp_id: keycloak |
||||
idp_name: "KeyCloak" |
||||
issuer: "https://${KEYCLOAK_HOSTNAME}/realms/${REALM}" |
||||
client_id: "synapse" |
||||
client_secret: "${MATRIX_CLIENT_SECRET}" |
||||
scopes: ["openid", "profile"] |
||||
user_mapping_provider: |
||||
config: |
||||
localpart_template: "{{ user.preferred_username }}" |
||||
display_name_template: "{{ user.name }}" |
||||
EOF |
||||
|
||||
if [ -n "$SMTP_SERVER" ]; then |
||||
info "configuring email" |
||||
cat <<EOF >> "$HOMESERVER_YAML" |
||||
email: |
||||
smtp_host: ${SMTP_SERVER} |
||||
smtp_port: ${SMTP_PORT} |
||||
smtp_user: "${SMTP_USER}" |
||||
smtp_pass: "${SMTP_PASSWORD}" |
||||
require_transport_security: true |
||||
notif_from: "%(app)s matrix homeserver <noreply@${DOMAIN_NAME}>" |
||||
app_name: ${DOMAIN_NAME} |
||||
EOF |
||||
fi |
||||
|
||||
|
||||
../keycloak/client-delete 'synapse' 2>/dev/null |
||||
|
||||
../keycloak/client-create << EOF || die "unable to create client id" |
||||
{ |
||||
"clientId": "synapse", |
||||
"rootUrl": "https://$MATRIX_HOSTNAME/", |
||||
"adminUrl": "https://$MATRIX_HOSTNAME/", |
||||
"redirectUris": [ "https://$MATRIX_HOSTNAME/*" ], |
||||
"webOrigins": [ "https://$MATRIX_HOSTNAME" ], |
||||
"clientAuthenticatorType": "client-secret", |
||||
"secret": "$MATRIX_CLIENT_SECRET" |
||||
} |
||||
EOF |
||||
|
||||
|
||||
docker-compose up -d || die "matrix: unable to start container" |
||||
Loading…
Reference in new issue