Hi everyone, I'll start with saying that I'm sorry for the lengthy post but i want to include as much information as possible.
Let's start by saying that I tried out mozilla's matrix server and I really enjoyed it, as such I wanted to deploy one for my self. This is my deployment
docker testing
version: "3.8" services: db: image: postgres:15-alpine container_name: matrix-db restart: unless-stopped environment: POSTGRES_USER: synapse_user POSTGRES_PASSWORD: ARrakyCbThe777EoqGLooahSGQRN8D # Change this! POSTGRES_DB: synapse POSTGRES_INITDB_ARGS: --encoding=UTF8 --lc-collate=C --lc-ctype=C volumes: - /amaurot/docker-data/matrix/db:/var/lib/postgresql/data healthcheck: test: - CMD-SHELL - pg_isready -U synapse_user -d synapse interval: 10s timeout: 5s retries: 5 synapse: image: matrixdotorg/synapse:latest container_name: matrix-synapse restart: unless-stopped depends_on: db: condition: service_healthy ports: - 5057:8008 # Synapse Client/Server API volumes: - /amaurot/docker-data/matrix/synapse:/data environment: - SYNAPSE_CONFIG_DIR=/data - SYNAPSE_CONFIG_PATH=/data/homeserver.yaml - POSTGRES_PASSWORD= # Must match db password cinny: image: ghcr.io/cinnyapp/cinny:latest container_name: matrix-cinny restart: unless-stopped ports: - 5060:80 # Maps Cinny to port 8080 on your host volumes: - /amaurot/docker-data/matrix/cinny/config.json:/app/config.json auth-service: image: ghcr.io/element-hq/lk-jwt-service:latest container_name: element-call-jwt hostname: auth-server environment: - LIVEKIT_JWT_BIND=:8080 - LIVEKIT_URL=wss://matrixrtc.glowie.icu/livekit/sfu #Change - LIVEKIT_KEY=devkey - LIVEKIT_SECRET= #Change - LIVEKIT_FULL_ACCESS_HOMESERVERS=matrix.glowie.icu #Notes on this below restart: unless-stopped ports: - 8070:8080 #Change 8070 to whichever port you want JWT to be available on locally livekit: image: livekit/livekit-server:latest container_name: element-call-livekit command: --config /etc/livekit.yaml ports: - 7880:7880/tcp - 7881:7881/tcp - 50100-50200:50100-50200/udp restart: unless-stopped volumes: - /amaurot/docker-data/matrix/livekit/config.yaml:/etc/livekit.yaml:ro The networking
opnsense NAT
matrix + cinny 5057 8448 5060 livekit + JWT 8070 7880 7881 50100:50200 With nat reflection on! NPM
# ------------------------------------------------------------ # matrixrtc.glowie.icu # ------------------------------------------------------------ map $scheme $hsts_header { https "max-age=63072000; preload"; } server { set $forward_scheme http; set $server "192.168.0.205"; set $port 7880; listen 80; #listen [::]:80; listen 443 ssl; #listen [::]:443; server_name matrixrtc.glowie.icu; http2 on; # Let's Encrypt SSL include conf.d/include/letsencrypt-acme-challenge.conf; include conf.d/include/ssl-cache.conf; include conf.d/include/ssl-ciphers.conf; ssl_certificate /etc/letsencrypt/live/npm-42/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/npm-42/privkey.pem; # Force SSL include conf.d/include/force-ssl.conf; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; access_log /data/logs/proxy-host-62_access.log proxy; error_log /data/logs/proxy-host-62_error.log warn; # ----------------- CUSTOM CONFIG ---------------------------------- # LiveKit JWT Token Service location /livekit/jwt/ { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://192.168.0.205:8070/; } # LiveKit SFU WebSocket Connections location /livekit/sfu/ { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_send_timeout 120; proxy_read_timeout 120; proxy_buffering off; proxy_set_header Accept-Encoding gzip; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_pass http://192.168.0.205:7880/; } # ----------------- CUSTOM CONFIG ---------------------------------- location / { proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; } # ------------------------------------------------------------ # matrix.glowie.icu # ------------------------------------------------------------ map $scheme $hsts_header { https "max-age=63072000; preload"; } server { set $forward_scheme http; set $server "192.168.0.205"; set $port 5057; listen 80; #listen [::]:80; listen 443 ssl; #listen [::]:443; server_name matrix.glowie.icu; http2 on; # Let's Encrypt SSL include conf.d/include/letsencrypt-acme-challenge.conf; include conf.d/include/ssl-cache.conf; include conf.d/include/ssl-ciphers.conf; ssl_certificate /etc/letsencrypt/live/npm-42/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/npm-42/privkey.pem; # Block Exploits include conf.d/include/block-exploits.conf; # Force SSL include conf.d/include/force-ssl.conf; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; access_log /data/logs/proxy-host-57_access.log proxy; error_log /data/logs/proxy-host-57_error.log warn; location = /.well-known/matrix/server { default_type application/json; add_header Access-Control-Allow-Origin *; return 200 '{ "m.server": "matrix.glowie.icu:443" }\n'; } location = /.well-known/matrix/client { default_type application/json; add_header Access-Control-Allow-Origin *; return 200 '{"m.homeserver": {"base_url": "https://matrix.glowie.icu"}, "org.matrix.msc4143.rtc_foci": [{"type": "livekit", "livekit_service_url": "https://matrixrtc.glowie.icu/livekit/jwt"}]}'; } location / { proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; } # ------------------------------------------------------------ # chat.glowie.icu # ------------------------------------------------------------ map $scheme $hsts_header { https "max-age=63072000; preload"; } server { set $forward_scheme http; set $server "192.168.0.205"; set $port 5060; listen 80; #listen [::]:80; listen 443 ssl; #listen [::]:443; server_name chat.glowie.icu http2 on; # Let's Encrypt SSL include conf.d/include/letsencrypt-acme-challenge.conf; include conf.d/include/ssl-cache.conf; include conf.d/include/ssl-ciphers.conf; ssl_certificate /etc/letsencrypt/live/npm-42/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/npm-42/privkey.pem; # Force SSL include conf.d/include/force-ssl.conf; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; access_log /data/logs/proxy-host-60_access.log proxy; error_log /data/logs/proxy-host-60_error.log warn; root /opt/cinny/dist/; rewrite ^/config.json$ /config.json break; rewrite ^/manifest.json$ /manifest.json break; rewrite ^/sw.js$ /sw.js break; rewrite ^/pdf.worker.min.js$ /pdf.worker.min.js break; rewrite ^/public/(.*)$ /public/$1 break; rewrite ^/assets/(.*)$ /assets/$1 break; rewrite ^(.+)$ /index.html break; location / { proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; } service config
livekit
port: 7880 bind_addresses: - "0.0.0.0" rtc: tcp_port: 7881 port_range_start: 50100 port_range_end: 50200 use_external_ip: true #node_ip: 0.0.0.0 # Optional. Replace with your server's public IP address. # Explicitly sets the public IP LiveKit advertises to clients. # Prevents internal Docker network IPs from being exposed as candidates # and appears to enable ICE/TCP fallback for clients on UDP restricted networks. #use_external_ip: true #stun_servers: #- "stun.l.google.com:19302" #- "stun1.l.google.com:19302" room: auto_create: false logging: level: info turn: enabled: false domain: localhost cert_file: "" key_file: "" tls_port: 5349 udp_port: 443 external_tls: true keys: devkey: "" #Change synapse
# The domain name of your server. This is the part after the @ in user IDs. # E.g. for @alice:yourdomain.com, the server_name is yourdomain.com server_name: "matrix.glowie.icu" # The internal port Synapse will listen on (your reverse proxy will forward traffic here) listeners: - port: 8008 tls: false type: http x_forwarded: true resources: - names: [client, federation] compress: false # PostgreSQL Database Configuration database: name: psycopg2 args: user: synapse_user password: database: synapse host: db cp_min: 5 cp_max: 10 # Where Synapse stores uploaded files and user avatars media_store_path: "/data/media_store" # Where Synapse stores its SQLite database (if used, but we are using Postgres) # We leave it here as fallback paths sqlite3: database: "/data/homeserver.db" # A secret used to encrypt access tokens. # WARNING: If this changes, all users will be logged out! macaroon_secret_key: "" # A secret used for validating registration sessions form_secret: "" # A secret used by scripts (like the Docker CLI) to register users without a password registration_shared_secret: "" # Controls whether users can create their own accounts. # Set to 'true' if you want public signups. enable_registration: false # Security: Allow users to reset their passwords # (Requires setting up an SMTP email server in this config to work properly) allow_guest_access: false # Opt-in to sending anonymized usage stats to Matrix.org report_stats: false experimental_features: # MSC4222: needed for syncv2 state_after. This allows clients to # correctly track the state of the room. msc4222_enabled: true # MSC4143: MatrixRTC. For historical reasons this flag enables the transports # endpoint defined in MSC4519. msc4143_enabled: true # The maximum allowed duration by which sent events can be delayed, as # per MSC4140. max_event_delay_duration: 24h rc_message: # This needs to match at least e2ee key sharing frequency plus a bit of headroom # Note key sharing events are bursty per_second: 0.5 burst_count: 30 # This needs to match at least the heart-beat frequency plus a bit of headroom # Currently the heart-beat is every 5 seconds which translates into a rate of 0.2s rc_delayed_event_mgmt: per_second: 1 burst_count: 20 matrix_rtc: transports: # The transport you specify will be made available to clients over the # /_matrix/client/unstable/org.matrix.msc4143/rtc/transports endpoint as # defined in MSC4519. - type: livekit # Replace this with the actual URL of your MatrixRTC Authorization Service livekit_service_url: https://matrixrtc.glowie.icu/livekit/jwt # LDAP Authentication Module modules: - module: "ldap_auth_provider.LdapAuthProviderModule" config: enabled: true mode: "search" uri: "ldap://ldap.glowie.icu:389" start_tls: false base: "ou=people,dc=glowie,dc=icu" attributes: uid: "uid" mail: "mail" name: "cn" bind_dn: "uid=login,ou=people,dc=glowie,dc=icu" bind_password: "" filter: "(memberOf=cn=matrix,ou=groups,dc=glowie,dc=icu)" # Directory for Synapse to store its running state pid_file: /data/homeserver.pid The issue
when i call my stuff (from my wifi or 4g) everything works fine, no issue whatsoever. When i try to call my self from mozilla's server, the mozilla user starts getting Block Resend
OPTIONS https://matrixrtc.glowie.icu/livekit/jwt/sfu/get Cors failure
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://matrixrtc.glowie.icu/livekit/jwt/get\_token. (Reason: CORS request did not succeed). Status code: (null). 2
Thanks everyone for the time and effort, i love this platform its just a shame that its a bit finicky to make work
Source: r/matrixdotorg · by /u/TMLKyza