jowj/matrix-docker-ansible-deploy
1
0
Fork 0
forked from mirrors/matrix-docker-ansible-deploy
Code Issues Pull Requests Releases Wiki Activity
eb8e162ac2
matrix-docker-ansible-deploy/examples/apache/matrix-synapse.conf

123 lines
4.3 KiB
Plaintext
Raw Normal View History

Add example Apache configuration for Dimension Discussed in #121 (Github Issue).
2019-03-18 19:17:37 +00:00
# This is a sample file demonstrating how to set up reverse-proxy for matrix.DOMAIN
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
<VirtualHost *:80>
ServerName matrix.DOMAIN
Fix syntax problems in example Apache configuration Related to #121 (Github Issue)
2019-03-18 18:45:17 +00:00
ProxyVia On
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
# Map /.well-known/acme-challenge to the certbot server
# If you manage SSL certificates by yourself, this will differ.
<Location /.well-known/acme-challenge>
ProxyPreserveHost On
Remove some more references to localhost Continuation of 1f0cc92b330b42. As an explanation for the problem: when saying `localhost` on the host, it sometimes gets resolved to `::1` and sometimes to `127.0.0.1`. On the unfortunate occassions that it gets resolved to `::1`, the container won't be able to serve the request, because Docker containers don't have IPv6 enabled by default. To avoid this problem, we simply prevent any lookups from happening and explicitly use `127.0.0.1`.
2019-02-05 09:11:28 +00:00
ProxyPass http://127.0.0.1:2402/.well-known/acme-challenge
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
</Location>
Redirect permanent / https://matrix.DOMAIN/
</VirtualHost>
Add Server-Server API proxying to Apache example configuration Contributed by @ralfi.
2019-08-16 07:06:53 +00:00
# Client-Server API
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
<VirtualHost *:443>
ServerName matrix.DOMAIN
SSLEngine On
# If you manage SSL certificates by yourself, these paths will differ.
SSLCertificateFile /matrix/ssl/config/live/matrix.DOMAIN/fullchain.pem
SSLCertificateKeyFile /matrix/ssl/config/live/matrix.DOMAIN/privkey.pem
SSLProxyEngine on
Disable TLSv1.1 by default
2020-01-30 10:56:20 +00:00
SSLProxyProtocol +TLSv1.2 +TLSv1.3
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
ProxyPreserveHost On
ProxyRequests Off
ProxyVia On
# Keep some URIs free for different proxy/location
ProxyPassMatch ^/.well-known/matrix/client !
missing Map /.well-known/matrix/server for server discovery
2019-08-13 18:40:04 +00:00
ProxyPassMatch ^/.well-known/matrix/server !
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
ProxyPassMatch ^/_matrix/identity !
ProxyPassMatch ^/_matrix/client/r0/user_directory/search !
# Proxy all remaining traffic to Synapse
Improve Synapse reverse-proxying Apache examples Thanks to @ralfi!
2019-08-17 07:13:39 +00:00
AllowEncodedSlashes NoDecode
ProxyPass /_matrix http://127.0.0.1:8008/_matrix retry=0 nocanon
ProxyPassReverse /_matrix http://127.0.0.1:8008/_matrix
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
# Map /.well-known/matrix/client for client discovery
Alias /.well-known/matrix/client /matrix/static-files/.well-known/matrix/client
<Files "/matrix/static-files/.well-known/matrix/client">
Require all granted
</Files>
quotes, simplify
2019-08-14 06:49:06 +00:00
<Location "/.well-known/matrix/client">
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
Header always set Content-Type "application/json"
Header always set Access-Control-Allow-Origin "*"
</Location>
missing Map /.well-known/matrix/server for server discovery
2019-08-13 18:40:04 +00:00
# Map /.well-known/matrix/server for server discovery
Alias /.well-known/matrix/server /matrix/static-files/.well-known/matrix/server
<Files "/matrix/static-files/.well-known/matrix/server">
Require all granted
</Files>
Serve /.well-known/matrix/server with proper Content-Type
2019-08-16 07:00:26 +00:00
<Location "/.well-known/matrix/server">
Header always set Content-Type "application/json"
</Location>
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
<Directory /matrix/static-files/.well-known/matrix/>
AllowOverride All
# Apache 2.4:
Require all granted
# Or for Apache 2.2:
#order allow,deny
</Directory>
# Map /_matrix/identity to the identity server
<Location /_matrix/identity>
More Apache ProxyPass directives need 'nocanon' Invitations weren't working for me until I added 'nocanon' to these additional places. Until then, invitations failed with "Invalid signature for server ..." errors, as in https://github.com/matrix-org/synapse/issues/3294 . I didn't check whether the user_directory/search proxy line also needs it, I just assumed it should have it too. The other two proxy lines in this example also include a 'retry=0' parameter. That's a separate issue; I haven't touched it here.
2019-08-30 11:22:08 +00:00
ProxyPass http://127.0.0.1:8090/_matrix/identity nocanon
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
</Location>
# Map /_matrix/client/r0/user_directory/search to the identity server
<Location /_matrix/client/r0/user_directory/search>
More Apache ProxyPass directives need 'nocanon' Invitations weren't working for me until I added 'nocanon' to these additional places. Until then, invitations failed with "Invalid signature for server ..." errors, as in https://github.com/matrix-org/synapse/issues/3294 . I didn't check whether the user_directory/search proxy line also needs it, I just assumed it should have it too. The other two proxy lines in this example also include a 'retry=0' parameter. That's a separate issue; I haven't touched it here.
2019-08-30 11:22:08 +00:00
ProxyPass http://127.0.0.1:8090/_matrix/client/r0/user_directory/search nocanon
Update own-webserver guide and add sample Apache configuration This supersedes #59 (Github Pull Request), which was greatly beneficial in creating our sample Apache configuration.
2019-02-01 14:51:18 +00:00
</Location>
ErrorLog ${APACHE_LOG_DIR}/matrix.DOMAIN-error.log
CustomLog ${APACHE_LOG_DIR}/matrix.DOMAIN-access.log combined
</VirtualHost>
Add Server-Server API proxying to Apache example configuration Contributed by @ralfi.
2019-08-16 07:06:53 +00:00
# Server-Server (federation) API
# Use this apache reverse proxy template to enable matrix server-to-server federation traffic
# Be sure that network traffic on port 8448 is possible
#
# You can check your federation config at https://federationtester.matrix.org/
# Enter there your base DOMAIN address, NOT your matrix.DOMAIN address, ex. https://DOMAIN
#
# In this example we use all services on the same machine (127.0.0.1) but you can do this with different machines.
# If you do so be sure to reach the destinated IPADRESS and the correspondending port. Check this with netstat, nmap or your favourite tool.
Listen 8448 required for apache Listen 8448 directive makes apache listen on that port, without it federation does not work.
2019-10-23 13:12:31 +00:00
Listen 8448
Add Server-Server API proxying to Apache example configuration Contributed by @ralfi.
2019-08-16 07:06:53 +00:00
<VirtualHost *:8448>
ServerName matrix.DOMAIN
SSLEngine On
# If you manage SSL certificates by yourself, these paths will differ.
SSLCertificateFile /matrix/ssl/config/live/matrix.DOMAIN/fullchain.pem
SSLCertificateKeyFile /matrix/ssl/config/live/matrix.DOMAIN/privkey.pem
SSLProxyEngine on
Disable TLSv1.1 by default
2020-01-30 10:56:20 +00:00
SSLProxyProtocol +TLSv1.2 +TLSv1.3
Add Server-Server API proxying to Apache example configuration Contributed by @ralfi.
2019-08-16 07:06:53 +00:00
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
ProxyPreserveHost On
ProxyRequests Off
ProxyVia On
# Proxy all remaining traffic to the Synapse port
# Beware: In this example the local traffic goes to the local synapse server at 127.0.0.1
# Of course you can use another IPADRESS in case of using other synapse servers in your network
Improve Synapse reverse-proxying Apache examples Thanks to @ralfi!
2019-08-17 07:13:39 +00:00
AllowEncodedSlashes NoDecode
Add missing options to ProxyPass
2019-08-17 07:14:40 +00:00
ProxyPass /_matrix http://127.0.0.1:8048/_matrix retry=0 nocanon
Improve Synapse reverse-proxying Apache examples Thanks to @ralfi!
2019-08-17 07:13:39 +00:00
ProxyPassReverse /_matrix http://127.0.0.1:8048/_matrix
Add Server-Server API proxying to Apache example configuration Contributed by @ralfi.
2019-08-16 07:06:53 +00:00
ErrorLog ${APACHE_LOG_DIR}/matrix.DOMAIN-error.log
CustomLog ${APACHE_LOG_DIR}/matrix.DOMAIN-access.log combined
</VirtualHost>
Reference in New Issue Copy Permalink