make syn+mas+EW work

README.md

@@ -11,17 +11,50 @@ into their ESS counterparts, and rehoming the postgres).
 ## To run
 
 ```
+# pick a domain name:
+DOMAIN=shadowfax.local
+
+# grab a TLS certificate for the server:
+brew install mkcert || apt-get install mkcert
+mkcert -install
+mkcert $DOMAIN '*.'$DOMAIN
+mkdir -p data/nginx/ssl
+mv ${DOMAIN}+1.pem data/nginx/ssl/cert.pem
+mv ${DOMAIN}+1-key.pem data/nginx/ssl/key.pem
+cp "$(mkcert -CAROOT)"/rootCA.pem data/nginx/ssl
+
+# make an .env to configure your environment
 cp .env-sample .env
-# edit the .env to configure your environment
+sed -ie s/example.com/$DOMAIN/ .env
+
 docker compose up
 ```
 
 ![Screenshot 2024-11-04 at 03 05 28](https://github.com/user-attachments/assets/c3127f3c-ae0c-43cb-bfe9-88f4be56e0af)
 
+## To admin
+
+```
+# To register a user
+docker compose exec mas mas-cli -c /data/config.yaml manage register-user
+```
+
+```
+# if you change the OIDC clients in MAS:
+docker compose exec mas mas-cli -c /data/config.yaml config sync --prune
+```
+
+## Diagnostics
+
+```
+# check that OIDC is working - useful for debugging TLS problems
+docker compose exec mas mas-cli -c /data/config.yaml doctor
+````
+
 ## Todo
 
- * [ ] sort out the networking
+ * [x] sort out the networking
- * [ ] make nginx do something useful when running on a local workstation
+ * [x] make nginx do something useful when running on a local workstation
  * [ ] hook up letsencrypt to nginx properly
  * [ ] hook up livekit properly
  * [ ] make it work

compose.yml

@@ -68,7 +68,13 @@ services:
       # - ${VOLUME_PATH}/data/certbot/www:/var/www/certbot
     command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
     networks:
-      - backend
+      backend:
+        aliases: # so our containers can resolve the LB
+          - $DOMAIN
+          - $HOMESERVER_FQDN
+          - $ELEMENT_WEB_FQDN
+          - $ELEMENT_CALL_FQDN
+          - $MAS_FQDN
     depends_on:
       init:
         condition: service_completed_successfully
@@ -131,6 +137,7 @@ services:
     restart: unless-stopped
     volumes:
       - ${VOLUME_PATH}/data/synapse:/data:rw
+      - ${VOLUME_PATH}/data/nginx/ssl/rootCA.pem:/etc/ssl/certs/ca-certificates.crt
     # ports:
     #   - 8008:8008
     networks:
@@ -159,6 +166,7 @@ services:
       - backend
     volumes:
       - ${VOLUME_PATH}/data/synapse:/data:rw
+      - ${VOLUME_PATH}/data/nginx/ssl/rootCA.pem:/etc/ssl/certs/ca-certificates.crt
     environment:
       SYNAPSE_WORKER: synapse.app.generic_worker
     # Expose port if required so your reverse proxy can send requests to this worker
@@ -180,6 +188,7 @@ services:
       - backend
     volumes:
       - ${VOLUME_PATH}/data/synapse:/data:rw # Replace VOLUME_PATH with the path to your Synapse volume
+      - ${VOLUME_PATH}/data/nginx/ssl/rootCA.pem:/etc/ssl/certs/ca-certificates.crt
     environment:
       SYNAPSE_WORKER: synapse.app.federation_sender
     # ports:
@@ -196,6 +205,7 @@ services:
     #   - 8083:8080
     volumes:
       - ${VOLUME_PATH}/data/mas:/data:rw
+      - ${VOLUME_PATH}/data/nginx/ssl/rootCA.pem:/etc/ssl/certs/ca-certificates.crt
     networks:
       - backend
     # FIXME: do we also need to sync the db?

data-template/mas/config.yaml

@@ -28,7 +28,7 @@ http:
   - fd00::/8
   - ::1/128
   public_base: https://${MAS_FQDN}/
-  issuer: https://${MAS_FQDN}/
+  issuer: https://${DOMAIN}/
 database:
   host: postgres
   database: mas
@@ -54,9 +54,9 @@ passwords:
     algorithm: argon2id
   minimum_complexity: 3
 matrix:
-  homeserver: localhost:8008
+  homeserver: ${DOMAIN}
   secret: '${SECRETS_MAS_MATRIX_SECRET}'
-  endpoint: http://localhost:8008/
+  endpoint: http://synapse:8008/
 
 # please keep config above this point as close as possible to the original generated config
 # so that upstream generated config changes can be detected

data-template/nginx/conf.d/app.conf

@@ -13,11 +13,40 @@ server {
     #    root /var/www/certbot;
     # }
 
+    location /.well-known/matrix/ {
+        root /var/www;
+    }
+
+    # XXX: is this right? or should auth.$DOMAIN be the issuer?
+    location /.well-known/openid-configuration {
+        proxy_pass http://mas:8080;
+        proxy_http_version 1.1;
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
+    }
+
     location / {
         return 301 https://${DOLLAR}host${DOLLAR}request_uri;
     }
 }
 
+server {
+    server_name ${DOMAIN};
+    server_tokens off;
+
+    include /etc/nginx/conf.d/include/ssl.conf;
+
+    location /.well-known/matrix/ {
+        root /var/www;
+    }
+
+    # XXX: is this right? or should auth.$DOMAIN be the issuer?
+    location /.well-known/openid-configuration {
+        proxy_pass http://mas:8080;
+        proxy_http_version 1.1;
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
+    }
+}
+
 server {
     server_name ${ELEMENT_WEB_FQDN};
     server_tokens off;
@@ -26,6 +55,7 @@ server {
 
     location / {
         proxy_pass http://element-web;
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
     }
 }
 
@@ -37,6 +67,7 @@ server {
 
     location / {
         proxy_pass http://element-call;
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
     }
 }
 
@@ -48,6 +79,8 @@ server {
 
     location / {
         proxy_pass http://mas:8080;
+        proxy_http_version 1.1;
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
     }
 }
 
@@ -62,14 +95,33 @@ server {
     listen [::]:8448 ssl default_server;
 
     # pass auth to MAS
-    location ~ ^/_matrix/client/(.*)/(login|logout|refresh)             { proxy_pass http://mas:8080; }
+    location ~ ^/_matrix/client/(.*)/(login|logout|refresh) {
+        proxy_pass http://mas:8080;
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
+    }
 
     # use the generic worker as a synchrotron:
     # taken from https://element-hq.github.io/synapse/latest/workers.html#synapseappgeneric_worker
-    location ~ ^/_matrix/client/(r0|v3)/sync${DOLLAR}                           { proxy_pass http://synapse-generic-worker-1:8081; }
+
-    location ~ ^/_matrix/client/(api/v1|r0|v3)/events${DOLLAR}                  { proxy_pass http://synapse-generic-worker-1:8081; }
+    location ~ ^/_matrix/client/(r0|v3)/sync${DOLLAR} {
-    location ~ ^/_matrix/client/(api/v1|r0|v3)/initialSync${DOLLAR}             { proxy_pass http://synapse-generic-worker-1:8081; }
+        proxy_pass http://synapse-generic-worker-1:8081;
-    location ~ ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync${DOLLAR} { proxy_pass http://synapse-generic-worker-1:8081; }
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
+    }
+
+    location ~ ^/_matrix/client/(api/v1|r0|v3)/events${DOLLAR} {
+        proxy_pass http://synapse-generic-worker-1:8081;
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
+    }
+
+    location ~ ^/_matrix/client/(api/v1|r0|v3)/initialSync${DOLLAR} {
+        proxy_pass http://synapse-generic-worker-1:8081;
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
+    }
+
+    location ~ ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync${DOLLAR} {
+        proxy_pass http://synapse-generic-worker-1:8081;
+        proxy_set_header X-Forwarded-For ${DOLLAR}remote_addr;
+    }
 
     location / {
         proxy_pass http://synapse:8008;

data-template/nginx/www/.well-known/matrix/client

@@ -5,6 +5,10 @@
     "m.identity_server": {
         "base_url": "${IDENTITY_SERVER_URL}"
     },
+    "org.matrix.msc2965.authentication": {
+        "issuer": "https://${DOMAIN}/",
+        "account": "https://${MAS_FQDN}/account"
+    },
     "org.matrix.msc4143.rtc_foci": [
         {
             "type": "livekit",