From b89bbbcdf69a6032459144021dee20bdff1f90cd Mon Sep 17 00:00:00 2001 From: Trammell Hudson Date: Wed, 4 May 2022 09:31:03 +0000 Subject: [PATCH] matrix: delegated home server setup with oicd login --- env.production | 2 ++ matrix/docker-compose.yaml | 27 ++++++++++++++ matrix/element-config.json | 73 ++++++++++++++++++++++++++++++++++++++ matrix/env.production | 1 + matrix/setup | 60 +++++++++++++++++++++++++++++++ nginx/certbot-renew | 2 +- 6 files changed, 164 insertions(+), 1 deletion(-) create mode 100644 matrix/docker-compose.yaml create mode 100644 matrix/element-config.json create mode 100644 matrix/env.production create mode 100755 matrix/setup diff --git a/env.production b/env.production index 64adb12..69e6b8a 100644 --- a/env.production +++ b/env.production @@ -6,3 +6,5 @@ HEDGEDOC_HOSTNAME=docs.hackerspace.zone MASTODON_HOSTNAME=social.hackerspace.zone NEXTCLOUD_HOSTNAME=cloud.hackerspace.zone GRAFANA_HOSTNAME=dashboard.hackerspace.zone +GITLAB_HOSTNAME=git.hackerspace.zone +MATRIX_HOSTNAME=matrix.hackerspace.zone diff --git a/matrix/docker-compose.yaml b/matrix/docker-compose.yaml new file mode 100644 index 0000000..e9038cc --- /dev/null +++ b/matrix/docker-compose.yaml @@ -0,0 +1,27 @@ +version: '3' +services: + postgres: + image: postgres:13.4-alpine + restart: unless-stopped + volumes: + - ./data/postgresdata:/var/lib/postgresql/data + environment: + - POSTGRES_DB=synapse + - POSTGRES_USER=synapse + - POSTGRES_PASSWORD=STRONGPASSWORD + + element: + image: vectorim/element-web:latest + restart: unless-stopped + volumes: + - ./element-config.json:/app/config.json + ports: + - "5000:80" + + synapse: + image: matrixdotorg/synapse:latest + restart: unless-stopped + volumes: + - ./data/synapse:/data + ports: + - "5008:8008" diff --git a/matrix/element-config.json b/matrix/element-config.json new file mode 100644 index 0000000..f1d9335 --- /dev/null +++ b/matrix/element-config.json @@ -0,0 +1,73 @@ +{ + "default_server_config": { + "m.homeserver": { + "base_url": "https://matrix.hackerspace.zone", + "server_name": "hackerspace.zone" + }, + "m.identity_server": { + "base_url": "https://vector.im" + } + }, + "brand": "Element", + "integrations_ui_url": "https://scalar.vector.im/", + "integrations_rest_url": "https://scalar.vector.im/api", + "integrations_widgets_urls": [ + "https://scalar.vector.im/_matrix/integrations/v1", + "https://scalar.vector.im/api", + "https://scalar-staging.vector.im/_matrix/integrations/v1", + "https://scalar-staging.vector.im/api", + "https://scalar-staging.riot.im/scalar/api" + ], + "hosting_signup_link": "https://element.io/matrix-services?utm_source=element-web&utm_medium=web", + "bug_report_endpoint_url": "https://element.io/bugreports/submit", + "uisi_autorageshake_app": "element-auto-uisi", + "showLabsSettings": true, + "piwik": { + "url": "https://piwik.riot.im/", + "siteId": 1, + "policyUrl": "https://element.io/cookie-policy" + }, + "roomDirectory": { + "servers": [ + "matrix.org", + "gitter.im", + "libera.chat" + ] + }, + "enable_presence_by_hs_url": { + "https://matrix.org": false, + "https://matrix-client.matrix.org": false + }, + "terms_and_conditions_links": [ + { + "url": "https://element.io/privacy", + "text": "Privacy Policy" + }, + { + "url": "https://element.io/cookie-policy", + "text": "Cookie Policy" + } + ], + "hostSignup": { + "brand": "Element Home", + "cookiePolicyUrl": "https://element.io/cookie-policy", + "domains": [ + "matrix.org" + ], + "privacyPolicyUrl": "https://element.io/privacy", + "termsOfServiceUrl": "https://element.io/terms-of-service", + "url": "https://ems.element.io/element-home/in-app-loader" + }, + "sentry": { + "dsn": "https://029a0eb289f942508ae0fb17935bd8c5@sentry.matrix.org/6", + "environment": "develop" + }, + "posthog": { + "projectApiKey": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO", + "apiHost": "https://posthog.element.io" + }, + "features": { + "feature_spotlight": true + }, + "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx" +} diff --git a/matrix/env.production b/matrix/env.production new file mode 100644 index 0000000..85b953c --- /dev/null +++ b/matrix/env.production @@ -0,0 +1 @@ +# variables diff --git a/matrix/setup b/matrix/setup new file mode 100755 index 0000000..d1aab6a --- /dev/null +++ b/matrix/setup @@ -0,0 +1,60 @@ +#!/bin/bash +die() { echo >&2 "$@" ; exit 1 ; } + +DIRNAME="$(dirname $0)" +cd "$DIRNAME" +source ../env.production || die "no top levle env?" +source env.production || die "no local env?" + +docker-compose down + +HOMESERVER_YAML="data/synapse/homeserver.yaml" +if [ -r "$HOMESERVER_YAML" ]; then + echo "home server already configured? delete data directory to force reconfig" + exit 0 +fi + +# This will create a *delegated* matrix server, +# where the "servername" is just the top level domain, +# but it is hosted on "matrix.DOMAIN_NAME". +# the syntax here is confusing and it is not clear in +# the docs *which* have to be updated. +docker run -it --rm \ + -v "`pwd`/data/synapse:/data" \ + -e "SYNAPSE_SERVER_NAME=$DOMAIN_NAME" \ + -e SYNAPSE_REPORT_STATS=yes \ + matrixdotorg/synapse:latest generate \ +|| die "unable to generate synapse config" + +MATRIX_CLIENT_SECRET="$(openssl rand -hex 20)" +#MATRIX_CLIENT_SECRET="abcdef1234" + +cat <> "$HOMESERVER_YAML" +web_client_location: https://${MATRIX_HOSTNAME}/ +public_baseurl: https://${MATRIX_HOSTNAME}/ +oidc_providers: + - idp_id: keycloak + idp_name: "KeyCloak" + issuer: "https://${KEYCLOAK_HOSTNAME}/realms/${REALM}" + client_id: "synapse" + client_secret: "${MATRIX_CLIENT_SECRET}" + scopes: ["openid", "profile"] + user_mapping_provider: + config: + localpart_template: "{{ user.preferred_username }}" + display_name_template: "{{ user.name }}" +EOF + +../keycloak/client-delete 'synapse' || echo "client did not exist?" + +../keycloak/client-create << EOF || die "unable to create client id" +{ + "clientId": "synapse", + "rootUrl": "https://$MATRIX_HOSTNAME/", + "adminUrl": "https://$MATRIX_HOSTNAME/", + "redirectUris": [ "https://$MATRIX_HOSTNAME/*" ], + "webOrigins": [ "https://$MATRIX_HOSTNAME" ], + "clientAuthenticatorType": "client-secret", + "secret": "$MATRIX_CLIENT_SECRET" +} +EOF diff --git a/nginx/certbot-renew b/nginx/certbot-renew index aaa73d8..dc575bd 100755 --- a/nginx/certbot-renew +++ b/nginx/certbot-renew @@ -7,7 +7,7 @@ cd "$DIRNAME" source ../env.production source ./env.production -domain_args="-d $DOMAIN_NAME,$KEYCLOAK_HOSTNAME,$HEDGEDOC_HOSTNAME,$MASTODON_HOSTNAME,$NEXTCLOUD_HOSTNAME,$GRAFANA_HOSTNAME" +domain_args="-d $DOMAIN_NAME,$KEYCLOAK_HOSTNAME,$HEDGEDOC_HOSTNAME,$MASTODON_HOSTNAME,$NEXTCLOUD_HOSTNAME,$GRAFANA_HOSTNAME,$MATRIX_HOSTNAME" rsa_key_size=2048 set -x