Matrix Synapse

homeserver.yaml

# This file shows only my changes - please insert / adapt them at the right place at your file!

# SSL
tls_certificate_path: "/etc/matrix-synapse/fullchain.pem"
tls_private_key_path: "/etc/matrix-synapse/privkey.pem"
tls_dh_params_path: "/etc/matrix-synapse/dhparam.pem"
no_tls: false

# Chat
web_client: false
public_baseurl: https://chat.webinx.eu/
listeners:
  -
    port: 8448

    bind_addresses:
      - '0.0.0.0'
    type: http

    tls: true
    
    x_forwarded: false
    
    resources:
      -
        names:
          - client     # The client-server APIs, both v1 and v2
          #- webclient  # The bundled webclient.
          
        compress: false

      - names: [federation]  # Federation APIs
        compress: false

  - port: 8008
    tls: false
    bind_addresses: ['127.0.0.1']
    type: http

    x_forwarded: true

    resources:
      - names: [client]
        compress: false
      - names: [federation]
        compress: false

database:
  name: "psycopg2"
  args:
    user: matrix
    password: your_password
    database: synapse
    host: localhost
    cp_min: 5
    cp_max: 10
    
recaptcha_public_key: "xyz"

recaptcha_private_key: "xyz"

enable_registration_captcha: True

enable_registration: False
registration_shared_secret: generate_a_secret

allow_guest_access: False

letsencrypt matrix renew

#!/bin/bash
# Example Crontab Config
# 14 2 1 * *      root    certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"
# 14 2 2 * *      root    /root/matrix-ssl.sh
#
cp /etc/letsencrypt/live/chat.deinedomain.de/fullchain.pem /etc/matrix-synapse/fullchain.pem
cp /etc/letsencrypt/live/chat.deinedomain.de/privkey.pem /etc/matrix-synapse/privkey.pem
chown matrix-synapse:nogroup /etc/matrix-synapse/fullchain.pem
chown matrix-synapse:nogroup /etc/matrix-synapse/privkey.pem
chmod 600 /etc/matrix-synapse/privkey.pem
service matrix-synapse restart

nginx vhost

server {
        listen      80;
        listen [::]:80;
        server_name chat.deinedomain.de;
        return 301 https://$server_name$request_uri;
}

server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name chat.deinedomain.de;
        ssl_certificate     /etc/letsencrypt/live/chat.deinedomain.de/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/chat.deinedomain.de/privkey.pem;
        root /var/www/html;
        index index.html index.htm index.nginx-debian.html;

        location / {
                proxy_pass http://localhost:8008;
                proxy_set_header X-Forwarded-For $remote_addr;
        }
}