From 2be8d772b4dc13b2105a933a8debbe84e308e39c Mon Sep 17 00:00:00 2001 From: Matthew Hodgson Date: Tue, 5 Nov 2024 00:13:02 +0000 Subject: [PATCH] make syn+mas+EW work --- README.md | 39 +++++++++++- compose.yml | 12 +++- data-template/mas/config.yaml | 6 +- data-template/nginx/conf.d/app.conf | 62 +++++++++++++++++-- .../nginx/www/.well-known/matrix/client | 4 ++ 5 files changed, 111 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index f26ec67..eaccb12 100644 --- a/README.md +++ b/README.md @@ -11,17 +11,50 @@ into their ESS counterparts, and rehoming the postgres). ## To run ``` +# pick a domain name: +DOMAIN=shadowfax.local + +# grab a TLS certificate for the server: +brew install mkcert || apt-get install mkcert +mkcert -install +mkcert $DOMAIN '*.'$DOMAIN +mkdir -p data/nginx/ssl +mv ${DOMAIN}+1.pem data/nginx/ssl/cert.pem +mv ${DOMAIN}+1-key.pem data/nginx/ssl/key.pem +cp "$(mkcert -CAROOT)"/rootCA.pem data/nginx/ssl + +# make an .env to configure your environment cp .env-sample .env -# edit the .env to configure your environment +sed -ie s/example.com/$DOMAIN/ .env + docker compose up ``` ![Screenshot 2024-11-04 at 03 05 28](https://github.com/user-attachments/assets/c3127f3c-ae0c-43cb-bfe9-88f4be56e0af) +## To admin + +``` +# To register a user +docker compose exec mas mas-cli -c /data/config.yaml manage register-user +``` + +``` +# if you change the OIDC clients in MAS: +docker compose exec mas mas-cli -c /data/config.yaml config sync --prune +``` + +## Diagnostics + +``` +# check that OIDC is working - useful for debugging TLS problems +docker compose exec mas mas-cli -c /data/config.yaml doctor +```` + ## Todo - * [ ] sort out the networking - * [ ] make nginx do something useful when running on a local workstation + * [x] sort out the networking + * [x] make nginx do something useful when running on a local workstation * [ ] hook up letsencrypt to nginx properly * [ ] hook up livekit properly * [ ] make it work diff --git a/compose.yml b/compose.yml index 708e16e..bf18b7b 100644 --- a/compose.yml +++ b/compose.yml @@ -68,7 +68,13 @@ services: # - ${VOLUME_PATH}/data/certbot/www:/var/www/certbot command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'" networks: - - backend + backend: + aliases: # so our containers can resolve the LB + - $DOMAIN + - $HOMESERVER_FQDN + - $ELEMENT_WEB_FQDN + - $ELEMENT_CALL_FQDN + - $MAS_FQDN depends_on: init: condition: service_completed_successfully @@ -131,6 +137,7 @@ services: restart: unless-stopped volumes: - ${VOLUME_PATH}/data/synapse:/data:rw + - ${VOLUME_PATH}/data/nginx/ssl/rootCA.pem:/etc/ssl/certs/ca-certificates.crt # ports: # - 8008:8008 networks: @@ -159,6 +166,7 @@ services: - backend volumes: - ${VOLUME_PATH}/data/synapse:/data:rw + - ${VOLUME_PATH}/data/nginx/ssl/rootCA.pem:/etc/ssl/certs/ca-certificates.crt environment: SYNAPSE_WORKER: synapse.app.generic_worker # Expose port if required so your reverse proxy can send requests to this worker @@ -180,6 +188,7 @@ services: - backend volumes: - ${VOLUME_PATH}/data/synapse:/data:rw # Replace VOLUME_PATH with the path to your Synapse volume + - ${VOLUME_PATH}/data/nginx/ssl/rootCA.pem:/etc/ssl/certs/ca-certificates.crt environment: SYNAPSE_WORKER: synapse.app.federation_sender # ports: @@ -196,6 +205,7 @@ services: # - 8083:8080 volumes: - ${VOLUME_PATH}/data/mas:/data:rw + - ${VOLUME_PATH}/data/nginx/ssl/rootCA.pem:/etc/ssl/certs/ca-certificates.crt networks: - backend # FIXME: do we also need to sync the db? diff --git a/data-template/mas/config.yaml b/data-template/mas/config.yaml index 5440946..9d683f6 100644 --- a/data-template/mas/config.yaml +++ b/data-template/mas/config.yaml @@ -28,7 +28,7 @@ http: - fd00::/8 - ::1/128 public_base: https://${MAS_FQDN}/ - issuer: https://${MAS_FQDN}/ + issuer: https://${DOMAIN}/ database: host: postgres database: mas @@ -54,9 +54,9 @@ passwords: algorithm: argon2id minimum_complexity: 3 matrix: - homeserver: localhost:8008 + homeserver: ${DOMAIN} secret: '${SECRETS_MAS_MATRIX_SECRET}' - endpoint: http://localhost:8008/ + endpoint: http://synapse:8008/ # please keep config above this point as close as possible to the original generated config # so that upstream generated config changes can be detected diff --git a/data-template/nginx/conf.d/app.conf b/data-template/nginx/conf.d/app.conf index c12cba7..f853c51 100644 --- a/data-template/nginx/conf.d/app.conf +++ b/data-template/nginx/conf.d/app.conf @@ -13,11 +13,40 @@ server { # root /var/www/certbot; # } + location /.well-known/matrix/ { + root /var/www; + } + + # XXX: is this right? or should auth.$DOMAIN be the issuer? + location /.well-known/openid-configuration { + proxy_pass http://mas:8080; + proxy_http_version 1.1; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; + } + location / { return 301 https://${DOLLAR}host${DOLLAR}request_uri; } } +server { + server_name ${DOMAIN}; + server_tokens off; + + include /etc/nginx/conf.d/include/ssl.conf; + + location /.well-known/matrix/ { + root /var/www; + } + + # XXX: is this right? or should auth.$DOMAIN be the issuer? + location /.well-known/openid-configuration { + proxy_pass http://mas:8080; + proxy_http_version 1.1; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; + } +} + server { server_name ${ELEMENT_WEB_FQDN}; server_tokens off; @@ -26,6 +55,7 @@ server { location / { proxy_pass http://element-web; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; } } @@ -37,6 +67,7 @@ server { location / { proxy_pass http://element-call; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; } } @@ -48,6 +79,8 @@ server { location / { proxy_pass http://mas:8080; + proxy_http_version 1.1; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; } } @@ -62,14 +95,33 @@ server { listen [::]:8448 ssl default_server; # pass auth to MAS - location ~ ^/_matrix/client/(.*)/(login|logout|refresh) { proxy_pass http://mas:8080; } + location ~ ^/_matrix/client/(.*)/(login|logout|refresh) { + proxy_pass http://mas:8080; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; + } # use the generic worker as a synchrotron: # taken from https://element-hq.github.io/synapse/latest/workers.html#synapseappgeneric_worker - location ~ ^/_matrix/client/(r0|v3)/sync${DOLLAR} { proxy_pass http://synapse-generic-worker-1:8081; } - location ~ ^/_matrix/client/(api/v1|r0|v3)/events${DOLLAR} { proxy_pass http://synapse-generic-worker-1:8081; } - location ~ ^/_matrix/client/(api/v1|r0|v3)/initialSync${DOLLAR} { proxy_pass http://synapse-generic-worker-1:8081; } - location ~ ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync${DOLLAR} { proxy_pass http://synapse-generic-worker-1:8081; } + + location ~ ^/_matrix/client/(r0|v3)/sync${DOLLAR} { + proxy_pass http://synapse-generic-worker-1:8081; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; + } + + location ~ ^/_matrix/client/(api/v1|r0|v3)/events${DOLLAR} { + proxy_pass http://synapse-generic-worker-1:8081; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; + } + + location ~ ^/_matrix/client/(api/v1|r0|v3)/initialSync${DOLLAR} { + proxy_pass http://synapse-generic-worker-1:8081; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; + } + + location ~ ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync${DOLLAR} { + proxy_pass http://synapse-generic-worker-1:8081; + proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr; + } location / { proxy_pass http://synapse:8008; diff --git a/data-template/nginx/www/.well-known/matrix/client b/data-template/nginx/www/.well-known/matrix/client index 82d13fc..88a5b04 100644 --- a/data-template/nginx/www/.well-known/matrix/client +++ b/data-template/nginx/www/.well-known/matrix/client @@ -5,6 +5,10 @@ "m.identity_server": { "base_url": "${IDENTITY_SERVER_URL}" }, + "org.matrix.msc2965.authentication": { + "issuer": "https://${DOMAIN}/", + "account": "https://${MAS_FQDN}/account" + }, "org.matrix.msc4143.rtc_foci": [ { "type": "livekit",