Установка и настройка сервера Matrix Synapse + PostgreSQL + Admin UI + Element WEB. Ubuntu 20 LTS / Ubuntu 22 LTS

# Configuration file for Synapse.
#
# This is a YAML file: see [1] for a quick introduction. Note in particular
# that *indentation is important*: all the elements of a list or dictionary
# should have the same indentation.
#
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
#
# For more information on how to configure Synapse, including a complete accounting of
# each option, go to docs/usage/configuration/config_documentation.md or
# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html
#
# This is set in /etc/matrix-synapse/conf.d/server_name.yaml for Debian installations.
# server_name: "SERVERNAME"
pid_file: "/var/run/matrix-synapse.pid"
listeners:
  - port: 8008
    tls: false
    type: http
    x_forwarded: true
    bind_addresses: ['::1', '127.0.0.1']
    resources:
      - names: [client, federation]
        compress: false
database:
  name: sqlite3
  args:
    database: /var/lib/matrix-synapse/homeserver.db
log_config: "/etc/matrix-synapse/log.yaml"
media_store_path: /var/lib/matrix-synapse/media
signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"
trusted_key_servers:
  - server_name: "matrix.org"

# Configuration file for Synapse.
#
# This is a YAML file: see [1] for a quick introduction. Note in particular
# that *indentation is important*: all the elements of a list or dictionary
# should have the same indentation.
#
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
#
# For more information on how to configure Synapse, including a complete accounting of
# each option, go to docs/usage/configuration/config_documentation.md or
# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html
#
# This is set in /etc/matrix-synapse/conf.d/server_name.yaml for Debian installations.
# server_name: "SERVERNAME"
pid_file: "/var/run/matrix-synapse.pid"
listeners:
  - port: 8008
    tls: false
    type: http
    x_forwarded: true
    bind_addresses: ['127.0.0.1']
    resources:
      - names: [client]
        compress: false
database:
  name: psycopg2
  txn_limit: 10000
  args:
    user: matrix
    password: YOUR-MATRIX-DB-USER-PASSWORD
    database: matrix
    host: localhost
    port: 5432
    cp_min: 5
    cp_max: 10
log_config: "/etc/matrix-synapse/log.yaml"
media_store_path: /var/lib/matrix-synapse/media
signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"
trusted_key_servers:
  - server_name: "matrix.YOUR-DOMAIN.COM"
suppress_key_server_warning: true
max_upload_size: 100M
enable_registration: false
registration_shared_secret: "Registration-Shared-Secret"
search_all_users: true
prefer_local_users: true
turn_uris: ["turn:matrix.YOUR-DOMAIN.COM?transport=udp","turn:matrix.YOUR-DOMAIN.COM?transport=tcp"]
turn_shared_secret: "Turn-Shared-Secret"
turn_user_lifetime: 86400000
admin_users:
  - "@admin:matrix.YOUR-DOMAIN.COM"

server {
    listen 80;
        listen [::]:80;
    server_name matrix.YOUR-DOMAIN.COM;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrix.YOUR-DOMAIN.COM;

    ssl_certificate /etc/letsencrypt/live/matrix.YOUR-DOMAIN.COM/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.YOUR-DOMAIN.COM/privkey.pem;

    location ~* ^(/|/_matrix|/_synapse/client) {
        proxy_pass http://localhost:8008;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
        client_max_body_size 100M;
    }
}

server {
    listen 8448 ssl http2 default_server;
    listen [::]:8448 ssl http2 default_server;
    server_name matrix.YOUR-DOMAIN.COM;

    ssl_certificate /etc/letsencrypt/live/matrix.YOUR-DOMAIN.COM/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.YOUR-DOMAIN.COM/privkey.pem;
    location / {
        proxy_pass http://localhost:8008;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}

server {
    listen 80;
        listen [::]:80;
    server_name matrix-admin.YOUR-DOMAIN.COM;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrix-admin.YOUR-DOMAIN.COM;

    ssl_certificate /etc/letsencrypt/live/matrix-admin.YOUR-DOMAIN.COM/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix-admin.YOUR-DOMAIN.COM/privkey.pem;

    location / {
        allow 1.1.1.1; #Allowed IP
        allow 8.8.8.8/24; #Allowed Subnet
        deny all;
        proxy_pass http://localhost:8088/;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}

server {
    listen 80;
        listen [::]:80;
    server_name element.YOUR-DOMAIN.COM;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name element.YOUR-DOMAIN.COM;

    ssl_certificate /etc/letsencrypt/live/element.YOUR-DOMAIN.COM/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/element.YOUR-DOMAIN.COM/privkey.pem;

    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Content-Security-Policy "frame-ancestors 'self'";

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}

listening-port=3478
fingerprint
use-auth-secret
static-auth-secret=Turn-Shared-Secret #Мы еге генерировали ранее во время настройки Matrix Synapse
realm=matrix.YOUR-DOMAIN.COM
# consider whether you want to limit the quota of relayed streams per user (or total) to avoid risk of DoS.
user-quota=100 # 4 streams per video call, so 100 streams = 25 simultaneous relayed calls per user.
total-quota=1200
no-tcp-relay # VoIP traffic is all UDP. There is no reason to let users connect to arbitrary TCP endpoints via the relay.
syslog
no-multicast-peers

{
    "default_server_config": {
        "m.homeserver": {
            "base_url": "https://matrix.YOUR-DOMAIN.COM",
            "server_name": "matrix.YOUR-DOMAIN.COM"
        },
        "m.identity_server": {
            "base_url": "https://vector.im"
        }
    },
    "disable_custom_urls": true,
    "disable_guests": true,
    "disable_login_language_selector": false,
    "disable_3pid_login": true,
    "brand": "Element",
    "integrations_ui_url": "https://scalar.vector.im/",
    "integrations_rest_url": "https://scalar.vector.im/api",
    "integrations_widgets_urls": [
        "https://scalar.vector.im/_matrix/integrations/v1",
        "https://scalar.vector.im/api",
        "https://scalar-staging.vector.im/_matrix/integrations/v1",
        "https://scalar-staging.vector.im/api",
        "https://scalar-staging.riot.im/scalar/api"
    ],
    "bug_report_endpoint_url": "https://element.io/bugreports/submit",
    "uisi_autorageshake_app": "element-auto-uisi",
    "default_country_code": "GB",
    "show_labs_settings": false,
    "features": {},
    "default_federate": false,
    "default_theme": "light",
    "room_directory": {
        "servers": ["YOUR-DOMAIN.COM"]
    },
    "enable_presence_by_hs_url": {
        "https://matrix.YOUR-DOMAIN.COM": true
    },
    "terms_and_conditions_links": [
        {
            "url": "https://element.io/privacy",
            "text": "Privacy Policy"
        },
        {
            "url": "https://element.io/cookie-policy",
            "text": "Cookie Policy"
        }
    ],
    "privacy_policy_url": "https://element.io/cookie-policy"
}

version: "3"

services:
  synapse-admin:
    container_name: synapse-admin
    hostname: synapse-admin
    #image: awesometechnologies/synapse-admin:latest
    build:
     context: .

    # to use the docker-compose as standalone without a local repo clone,
    # replace the context definition with this:
    # context: https://github.com/Awesome-Technologies/synapse-admin.git

     args:
    # if you're building on an architecture other than amd64, make sure
    # to define a maximum ram for node. otherwise the build will fail.
    #   - NODE_OPTIONS="--max_old_space_size=1024"
    # default is .
    #   - PUBLIC_URL=/synapse-admin
    # You can use a fixed homeserver, so that the user can no longer
    # define it himself
       - REACT_APP_SERVER=https://matrix.YOUR-DOMAIN.COM
    ports:
      - "127.0.0.1:8088:80"
    restart: unless-stopped