computing:synapse
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| computing:synapse [2022/11/20 05:34] – created oemb1905 | computing:synapse [2025/04/17 20:38] (current) – oemb1905 | ||
|---|---|---|---|
| Line 3: | Line 3: | ||
| * **Jonathan Haack** | * **Jonathan Haack** | ||
| * **Haack' | * **Haack' | ||
| - | * **webmaster@haacksnetworking.org** | + | * **webmaster@haacksnetworking.org** |
| ------------------------------------------- | ------------------------------------------- | ||
| Line 11: | Line 11: | ||
| ------------------------------------------- | ------------------------------------------- | ||
| - | This tutorial is for users of Debian GNU/Linux who want to create their own [[https:// | + | This tutorial is for users of Debian GNU/Linux who want to create their own synapse/ |
| + | sudo ufw allow 22 | ||
| + | sudo ufw allow 80 | ||
| + | sudo ufw allow 443 | ||
| + | sudo ufw allow 8448 | ||
| + | sudo ufw allow 10000/udp | ||
| + | sudo ufw allow 3478/udp | ||
| + | sudo ufw allow 5349/ | ||
| + | You should also make sure that you have [[https:// | ||
| - | --- //[[jonathan@haacksnetworking.org|oemb1905]] 2022/11/19 22:17// | + | sudo apt install nginx |
| + | cd / | ||
| + | cp default gnulinux.club | ||
| + | cp default matrix.gnulinux.club | ||
| + | cp default element.gnulinux.club | ||
| + | |||
| + | You will notice that I did not create a server block for jitsi becuase it's installer script will take care of this automatically later on. Once these are created, delete everything in the block file except the [[https:// | ||
| + | |||
| + | nano /etc/nginx/ | ||
| + | < | ||
| + | <root / | ||
| + | |||
| + | The matrix.gnulinux.club block needs to have the proxy_pass directive set. To limit confusion, I have just provided the config directly. Also, note that web root is irrelevant for this block because it will not be serving any files directly but is merely sending requests back to matrix/ | ||
| + | |||
| + | nano / | ||
| + | |||
| + | [[https:// | ||
| + | |||
| + | As for the element.gnulinux.club block (adjusted for your domain, of course), make sure to add a directory to the end of the block directory itself. This will help later when upgrades to Element come out, because you can just re-symlink the new update. We will do the symlink later when installing the package, for now: | ||
| + | |||
| + | nano / | ||
| + | < | ||
| + | <root / | ||
| + | systemctl restart nginx | ||
| + | |||
| + | Conduct a url request on gnulinux.club (adjusted for you) to ensure that your domain resolves and nginx is functioning properly. Once that's confirmed, we can now set up Let's Encrypt certs: | ||
| + | |||
| + | sudo apt install python3-certbot-nginx | ||
| + | certbot --nginx -d gnulinux.club -d matrix.gnulinux.club -d element.gnulinux.club | ||
| + | |||
| + | Conduct another url request on gnulinux.club (adjusted for you) to ensure that your domain now has the TLS lock and redirected properly. Once that's setup, it is now time to install the matrix-synapse-py3 server. Always check the official documentation page for this, but as of this installation, | ||
| + | |||
| + | sudo apt install -y lsb-release wget apt-transport-https | ||
| + | sudo wget -O / | ||
| + | echo "deb [signed-by=/ | ||
| + | sudo apt update | ||
| + | sudo apt install matrix-synapse-py3 | ||
| + | <name of the server: gnulinux.club> | ||
| + | <report statistics yes> | ||
| + | |||
| + | Verify that the matrix-synapse server is running with '' | ||
| + | |||
| + | mkdir -p / | ||
| + | cd / | ||
| + | nano server | ||
| + | <{ " | ||
| + | |||
| + | Once that's created, run curl and make sure the output matches what you specified in the server file: | ||
| + | |||
| + | curl -L https:// | ||
| + | { " | ||
| + | |||
| + | As long as that functions, you can now move on to installing Element. That involves making a web root directory of the server block, creating a dedicated user that owns and downloads the latest package (always check official release page), symlinking the current package to the location specified in the server block, and lastly configuring the config.json file for your domain and particular instance. Here goes: | ||
| + | |||
| + | mkdir / | ||
| + | cd / | ||
| + | sudo useradd -m elementweb | ||
| + | < | ||
| + | sudo --user elementweb wget https:// | ||
| + | sudo --user elementweb tar -xvf element-v1.10.12.tar.gz | ||
| + | rm element-v1.10.12.tar.gz | ||
| + | cd / | ||
| + | ln -s element-v1.10.12/ | ||
| + | cd / | ||
| + | cp config-sample.json config.json | ||
| + | nano config.json | ||
| + | <" | ||
| + | <" | ||
| + | |||
| + | Once Element is installed, you need to enable registration. Matrix no longer allows unchallenged / non-tokened registration without an explicit override, so after seeing how involved token auth was, I added a [[https:// | ||
| + | |||
| + | sudo nano / | ||
| + | enable_registration: | ||
| + | enable_registration_captcha: | ||
| + | recaptcha_public_key: | ||
| + | recaptcha_private_key: | ||
| + | registration_shared_secret: | ||
| + | federation_client_minimum_tls_version: | ||
| + | |||
| + | At this stage, you could theoretically add a user through the web GUI, however the instance is still using sqlite3 and I preferred something more robust. For that reason, I waited and first created a proper database and dedicated database user, both for scaling and hardening purposes: | ||
| + | |||
| + | sudo apt install postgresql | ||
| + | sudo -u postgres bash | ||
| + | createuser --pwprompt synapseusr | ||
| + | createdb --encoding=UTF8 --locale=C --template=template0 --owner=synapseusr synapsedb | ||
| + | exit | ||
| + | |||
| + | After recording the password you specified, make sure to configure '' | ||
| + | |||
| + | sudo nano / | ||
| + | < | ||
| + | <name: psycopg2> | ||
| + | < | ||
| + | < | ||
| + | <user: synapseusr> | ||
| + | < | ||
| + | < | ||
| + | <host: localhost> | ||
| + | <port: 5432> | ||
| + | <cp_min: 5> | ||
| + | <cp_max: 10> | ||
| + | |||
| + | After creating the database, inform synapse of how to reach it in the '' | ||
| + | |||
| + | nano / | ||
| + | < | ||
| + | sudo systemctl reload postgresql | ||
| + | |||
| + | Check that the configuration you established is functioning by restarting the service with '' | ||
| + | |||
| + | sudo -u postgres bash | ||
| + | register_new_matrix_user -c / | ||
| + | |||
| + | Record the password you chose in a safe location, and then uncomment the user registration on ''/ | ||
| + | |||
| + | sudo nano / | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | |||
| + | Again, note that there is no need to set up an incoming email server nor tolerate spam on the server you are sending to. In my case, my smtp server / MTA is a relay/MTA (only) with domains that are allowed to send through it explicitly white listed. Now that email is up, let's tweak the upload settings so that people can upload images that are larger than a megabyte and have reasonable purge directives: | ||
| + | |||
| + | sudo nano / | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | |||
| + | After this, your config should look something like this [[https:// | ||
| + | |||
| + | < | ||
| + | |||
| + | Alright, so now it's time to carry on with setting up jitsi. Again, as with element and matrix, always check the [[https:// | ||
| + | |||
| + | curl https:// | ||
| + | echo 'deb [signed-by=/ | ||
| + | sudo apt update | ||
| + | sudo apt install jitsi-meet | ||
| + | <enter domain jitsi.gnulinux.club> | ||
| + | < | ||
| + | |||
| + | Once the install finishes, let's create let's encrypt using the official script from Jitsi, which will automatically configure a turn server and create a server block in nginx for us: | ||
| + | |||
| + | / | ||
| + | |||
| + | We now need to configure Element to use jitsi, which we do as follows: | ||
| + | |||
| + | nano / | ||
| + | <" | ||
| + | systemctl restart matrix-synapse | ||
| + | |||
| + | You can verify that jitsi is working by '' | ||
| + | |||
| + | https:// | ||
| + | wget https:// | ||
| + | tar -xvf element-v1.11.55.tar.gz | ||
| + | cd / | ||
| + | cp -ar config.json ../ | ||
| + | ln -s element-v1.10.12/ | ||
| + | |||
| + | Make sure to have .well-knowns established for client and support as well: | ||
| + | |||
| + | sudo touch / | ||
| + | |||
| + | With the following: | ||
| + | |||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | |||
| + | Also identify support: | ||
| + | |||
| + | sudo touch / | ||
| + | |||
| + | With the following: | ||
| + | |||
| + | {" | ||
| + | |||
| + | Finally, make sure that browsers don't download these by adding a location to your TLD block: | ||
| + | |||
| + | location / | ||
| + | allow all; | ||
| + | add_header access-control-allow-origin *; | ||
| + | add_header content-type application/ | ||
| + | } | ||
| + | |||
| + | More updates below when they come. | ||
| + | |||
| + | --- // | ||
computing/synapse.1668922458.txt.gz · Last modified: 2022/11/20 05:34 by oemb1905
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
