meta data for this page
Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
digital:server:matrixsynapse [2019/06/03 17:53] natrius [ToDo] |
digital:server:matrixsynapse [2022/01/14 00:15] (current) natrius riot -> element; minor rewrite of Step 9 |
||
---|---|---|---|
Line 1: | Line 1: | ||
# Matrix Synapse | # Matrix Synapse | ||
- | [[https:// | + | [[https:// |
Synapse is a reference homeserver implementation from the core development team at matrix.org, written in Python/ | Synapse is a reference homeserver implementation from the core development team at matrix.org, written in Python/ | ||
Line 9: | Line 9: | ||
This guide explains one way to setup a Synapse server. There are many other correct ways to setup a Matrix server and that is the reason why there are so many guides. Feel free to choose the guide that suits your setup the best. | This guide explains one way to setup a Synapse server. There are many other correct ways to setup a Matrix server and that is the reason why there are so many guides. Feel free to choose the guide that suits your setup the best. | ||
- | ## How to install Synapse on Ubuntu 18.04 LTS | + | ## How to install Synapse on Ubuntu |
### Prerequisites | ### Prerequisites | ||
Line 39: | Line 39: | ||
sudo apt install -y lsb-release wget apt-transport-https | sudo apt install -y lsb-release wget apt-transport-https | ||
sudo wget -O / | sudo wget -O / | ||
- | echo "deb [signed-by=/ | + | echo "deb [signed-by=/ |
- | | + | |
</ | </ | ||
Line 53: | Line 52: | ||
sudo apt install matrix-synapse-py3 | sudo apt install matrix-synapse-py3 | ||
- | During the installation, | + | During the installation, |
**Don' | **Don' | ||
Line 64: | Line 63: | ||
sudo systemctl enable matrix-synapse.service | sudo systemctl enable matrix-synapse.service | ||
- | Synapse is now up and running using the default configuration on port '8008' and '8448'. Check the open ports using netstat command. | + | Synapse is now up and running using the default configuration on port ' |
- | | + | ss -plntu |
- | + | ||
- | #### Set up well.known | + | |
- | + | ||
- | On your webserver a file at '' | + | |
- | + | ||
- | < | + | |
- | { | + | |
- | " | + | |
- | } | + | |
- | </ | + | |
- | + | ||
- | Where ''/'' | + | |
- | + | ||
- | #### Set up SRV | + | |
- | + | ||
- | By setting an SRV record in your DNS provider, it is possible to tell other matrix servers where to connect to the server, pointing them to the correct hostname and port, in this example the default port (8448) is still used: | + | |
- | + | ||
- | < | + | |
- | _matrix._tcp.example.com. 3600 IN SRV 10 5 443 synapse.example.com. | + | |
- | </ | + | |
- | + | ||
- | There is still an A record needed, pointing to the IP-addess of synapse on the subdomain (matrix.example.com). This way others can add your user with '' | + | |
### Step 3 - Configure Synapse | ### Step 3 - Configure Synapse | ||
Line 106: | Line 83: | ||
'' | '' | ||
- | #### Check listener and federation port | + | #### Check ports |
- | Now check the HTTP and HTTPS listener port ' | + | **The best is to leave it default as it comes delivered** (watch here https:// |
< | < | ||
Line 128: | Line 105: | ||
Now restart the Synapse services. | Now restart the Synapse services. | ||
- | sudo systemctl | + | sudo systemctl |
Check the homeserver service with the following command | Check the homeserver service with the following command | ||
- | | + | ss -plntu |
You will get the Synapse service is now on the local IP address. And we have completed the Synapse installation and configuration. | You will get the Synapse service is now on the local IP address. And we have completed the Synapse installation and configuration. | ||
Line 149: | Line 126: | ||
sudo add-apt-repository ppa: | sudo add-apt-repository ppa: | ||
- | sudo apt-get install certbot | + | sudo apt-get install certbot |
- | Generate the SSL certificate files for the matrix domain name '' | + | Generate the SSL certificate files for the matrix domain name '' |
sudo certbot --nginx | sudo certbot --nginx | ||
- | The Letsencrypt tool will generate SSL certificate files by running the ' | + | The Letsencrypt tool will generate SSL certificate files by running the ' |
< | < | ||
Line 162: | Line 139: | ||
Obtaining a new certificate | Obtaining a new certificate | ||
Performing the following challenges: | Performing the following challenges: | ||
- | http-01 challenge for example.com | + | http-01 challenge for homeserver.example |
Waiting for verification... | Waiting for verification... | ||
Cleaning up challenges | Cleaning up challenges | ||
Line 168: | Line 145: | ||
IMPORTANT NOTES: | IMPORTANT NOTES: | ||
- Congratulations! Your certificate and chain have been saved at: | - Congratulations! Your certificate and chain have been saved at: | ||
- | / | + | / |
Your key file has been saved at: | Your key file has been saved at: | ||
- | / | + | / |
Your cert will expire on 2019-03-03. To obtain a new or tweaked | Your cert will expire on 2019-03-03. To obtain a new or tweaked | ||
| | ||
Line 201: | Line 178: | ||
sudo systemctl enable nginx.service | sudo systemctl enable nginx.service | ||
- | Next, we will create a new virtual host configuration for the domain name '' | + | Next, we will create a new virtual host configuration for the domain name '' |
< | < | ||
- | Paste the following configuration there, changing the domain '' | + | Paste the following configuration there, changing the domain '' |
< | < | ||
server { | server { | ||
| | ||
- | | + | |
| | ||
} | } | ||
Line 217: | Line 194: | ||
listen 443 ssl; | listen 443 ssl; | ||
listen [::]:443 ssl; | listen [::]:443 ssl; | ||
- | server_name | + | server_name |
- | ssl_certificate / | + | ssl_certificate / |
- | ssl_certificate_key / | + | ssl_certificate_key / |
# If you don't wanna serve a site, comment this out | # If you don't wanna serve a site, comment this out | ||
Line 231: | Line 208: | ||
} | } | ||
location / | location / | ||
- | return 200 ' | + | return 200 ' |
add_header Content-Type application/ | add_header Content-Type application/ | ||
} | } | ||
location / | location / | ||
- | return 200 ' | + | return 200 ' |
add_header Content-Type application/ | add_header Content-Type application/ | ||
add_header " | add_header " | ||
Line 241: | Line 218: | ||
} | } | ||
</ | </ | ||
- | |||
- | FIXME '' | ||
- | |||
- | FIXME Same for '' | ||
Save and exit. | Save and exit. | ||
Line 265: | Line 238: | ||
Nginx installation and configuration as a reverse proxy for the Synapse homeserver has been completed. | Nginx installation and configuration as a reverse proxy for the Synapse homeserver has been completed. | ||
- | ### (Optional) Step 6 - Postgre | + | #### Set up .well-known |
+ | |||
+ | On your webserver a file at '' | ||
+ | |||
+ | < | ||
+ | { | ||
+ | " | ||
+ | } | ||
+ | </ | ||
+ | |||
+ | Where ''/'' | ||
+ | |||
+ | ### (Optional) Step 6 - PostgreSQL | ||
While the step is marked as optional, it is **strongly encouraged** for any server that isn't purely for testing. | While the step is marked as optional, it is **strongly encouraged** for any server that isn't purely for testing. | ||
- | #### Initial | + | #### Initial |
< | < | ||
Line 277: | Line 262: | ||
< | < | ||
- | Where username can be " | + | Where username can be '' |
To end the postgre line just type in '' | To end the postgre line just type in '' | ||
- | #### Set up Postgre | + | #### Set up PostgreSQL |
< | < | ||
Line 302: | Line 287: | ||
* '' | * '' | ||
- | * '' | + | * '' |
* '' | * '' | ||
Line 308: | Line 293: | ||
< | < | ||
- | sudo systemctl | + | sudo systemctl |
</ | </ | ||
### Migrating from SQlite to PostgreSQL | ### Migrating from SQlite to PostgreSQL | ||
- | There is no need for this if you have nothing done yet with synapse, otherwise, please refer to https:// | + | Assuming you already followed step 6, there is no need for a migration. If you already used your Synapse and want to migrate, please refer to https:// |
### Step 7 - Setup UFW Firewall | ### Step 7 - Setup UFW Firewall | ||
- | Open the needed ports for our services. We will only allow SSH, HTTP, HTTPS and 8448 (for federation) | + | Open the needed ports for our services. We will only allow SSH, HTTP, and HTTPS connection on the UFW firewall configuration. To add them to the UFW firewall configuration, |
sudo ufw allow ssh | sudo ufw allow ssh | ||
sudo ufw allow http | sudo ufw allow http | ||
sudo ufw allow https | sudo ufw allow https | ||
- | sudo ufw allow 8448 | ||
Now enable the UFW firewall service and then check the status. | Now enable the UFW firewall service and then check the status. | ||
Line 337: | Line 321: | ||
Now you need to input the user name, password, and decide whether the user will have the admin privileges or not. And we have created a new matrix user with admin privilege. | Now you need to input the user name, password, and decide whether the user will have the admin privileges or not. And we have created a new matrix user with admin privilege. | ||
- | ### Step 9 - Federation | + | ### Step 9 - Testing |
- | You can test if federation | + | If you have used Element with the desktop application before you may not want to log out, so it is better to go to [[https://element.io/ |
- | * https://fed.mau.dev/ | + | The Synapse homeserver is up and running under the Nginx reverse proxy HTTPS connection, and the user is now logged in to the Synapse homeserver using the Element application. |
- | ### Step 10 - Testing | + | If you need two instances of Element instead, you can start it with argument, refer to [[digital: |
- | If you have used Riot with the desktop application before you may not want to log out, so it is better to go to [[https://riot.im/app/]] and press " | + | For another way to test it, go to '' |
- | + | ||
- | The Synapse | + | |
- | + | ||
- | If you need two instances of riot instead, you can start it with argument, refer to [[digital: | + | |
- | + | ||
- | For another way to test it, go to '' | + | |
<code xml> | <code xml> | ||
Line 362: | Line 340: | ||
3 " | 3 " | ||
</ | </ | ||
+ | |||
+ | ### Step 10 - Federation | ||
+ | |||
+ | You can test if federation is working using https:// | ||
+ | |||
+ | * https:// | ||
## Explanations | ## Explanations | ||
Line 367: | Line 351: | ||
### Presence | ### Presence | ||
- | Unfortunately presence is right now broken and generates a high load. It is possible to deactivate it, but the user avatars will be grey afterwards on the homeserver. To deactivate, open '' | + | Unfortunately presence is right now broken and generates a high load. Until this issue https:// |
< | < | ||
+ | |||
+ | and add | ||
'' | '' | ||
Line 375: | Line 361: | ||
### Do i need a TURN-Server (ex. COTURN) | ### Do i need a TURN-Server (ex. COTURN) | ||
- | It's only necessary when both parties are behind NAT. Otherwise 1-on-1 communication should work fine. Group-Calls via Riot will be handled with jitsi.riot.im and are not handled by the homeserver. | + | It's only necessary when both parties are behind NAT. Otherwise 1-on-1 communication should work fine. Group-Calls via Element |
### Port 8008 and 8448 | ### Port 8008 and 8448 | ||
Line 421: | Line 407: | ||
If your need help, get as much information as possible ([[# | If your need help, get as much information as possible ([[# | ||
+ | |||
+ | ### Problems with sending pictures | ||
+ | |||
+ | Open the '' | ||
+ | |||
+ | |||
+ | < | ||
+ | http{ | ||
+ | ... | ||
+ | | ||
+ | ... | ||
+ | } | ||
+ | </ | ||
+ | |||
### Whats my version | ### Whats my version | ||
- | * https://example.com/ | + | * https://homeserver.example/ |
### Location of logs | ### Location of logs | ||
Line 476: | Line 476: | ||
For feedback about this guide or tips on how to improve it visit https:// | For feedback about this guide or tips on how to improve it visit https:// | ||
- |