This is a WIP for creating an install howt for Matrix - Synapse messaging server on NethServer 7.
A startingpoint could be: https://www.vultr.com/docs/create-a-chat-server-using-matrix-synapse-and-riot-on-centos-7
and the official install howto on github: synapse/INSTALL.md at master · matrix-org/synapse · GitHub
please feel free to add in this topic steps to install on NethServer.
This is a wikified post.
The goal is to have a Matrix - Synapse module for NethServer with the option to both have access with a local accountprovider (either LDAP or Samba4 AD) as internal messaging server AND the option to have conversations with other Matrix - Synapse servers through federation
ToDo
TEST : - Voice/video chat with TURN server
Element Call
Prerequisites
You need a valid letsencrypt cert to let the clients connect. You may use Matrix Synapse with your default domain but for avoiding virtualhost conflicts I recommend to use a separate (sub)domain like matrix.example.org
I tested with Riot client on Windows and Android. Encryption is working.
Installing needed packages and dev tools
yum -y install libtiff-devel libjpeg-devel libzip-devel freetype-devel lcms2-devel libwebp-devel tcl-devel tk-devel redhat-rpm-config python-virtualenv libffi-devel openssl-devel postgresql-devel
yum -y groupinstall "Development Tools"Install postgres 10.0, create DB and user synapse
You may replace SECRET with a more secure password.
yum -y install rh-postgresql10
scl enable rh-postgresql10 bash
postgresql-setup --initdb --port=55433
exitcat << EOF > /var/opt/rh/rh-postgresql10/lib/pgsql/data/pg_hba.conf# "local" is for Unix domain socket connections only
local all postgres ident
local all all md5
# IPv4 local connections:
host all all 127.0.0.1/32 md5
# IPv6 local connections:
host all all ::1/128 md5
EOF
systemctl enable rh-postgresql10-postgresql --now
su - postgres -c "scl enable rh-postgresql10 -- psql --port=55433"
create user synapse with encrypted password 'SECRET';
CREATE DATABASE synapse
ENCODING 'UTF8'
LC_COLLATE='C'
LC_CTYPE='C'
template=template0
OWNER synapse;
\qAlternative install of postgres92 via nethserver-postgresql
yum -y install nethserver-postgresql postgresql-devel
su - postgres
createuser synapse
psql -c "alter user synapse with encrypted password 'SECRET';"
psql
CREATE DATABASE synapse
ENCODING 'UTF8'
LC_COLLATE='C'
LC_CTYPE='C'
template=template0
OWNER synapse;
\q
exitInstall synapse
yum -y install rh-python36
mkdir -p /opt/synapse
scl enable rh-python36 bash
virtualenv -p python3.6 /opt/synapse
source /opt/synapse/bin/activate
pip install --upgrade pip
pip install --upgrade setuptools
pip install matrix-synapse
pip install Jinja2alternative install with python2.7
mkdir -p /opt/synapse
virtualenv -p python2.7 /opt/synapse
source /opt/synapse/bin/activate
pip install --upgrade pip
pip install --upgrade setuptools
pip install matrix-synapse
pip install Jinja2Install postgres client libs
pip install matrix-synapse[postgres]
Create config file
Replace example.org with the domain you want to use:
cd /opt/synapse
python -m synapse.app.homeserver \
--server-name example.org \
--config-path homeserver.yaml \
--generate-config \
--report-stats=no
Edit homeserver.yaml to use postgresql, search for database:, edit name and add/edit the args as needed:
database:
name: psycopg2
args:
user: synapse
password: SECRET
database: synapse
# specify port because rh-postgresql10 doesn't run on default 5432 port
host: localhost
port: 55433
cp_min: 5
cp_max: 10Configure httpd
We use a reverse proxy to make synapse accessible at https://example.org. As it has some special options it cannot be added via web UI. Don’t forget to replace example.org with the domain you use.
cat << EOF > /etc/httpd/conf.d/a_synapse.conf
<VirtualHost *:443>
SSLEngine on
ServerName example.org
AllowEncodedSlashes NoDecode
ProxyPass /_matrix http://127.0.0.1:8008/_matrix nocanon
ProxyPassReverse /_matrix http://127.0.0.1:8008/_matrix
</VirtualHost>
Listen 8448
<VirtualHost *:8448>
SSLEngine on
AllowEncodedSlashes NoDecode
ProxyPass /_matrix http://127.0.0.1:8008/_matrix nocanon
ProxyPassReverse /_matrix http://127.0.0.1:8008/_matrix
</VirtualHost>
EOFRestart httpd to apply the new config:
systemctl restart httpd
Open port for synapse federation
config set synapse service status enabled TCPPort 8448 access red,green
signal-event firewall-adjust
Create, enable and start systemd service
cat << EOF > /etc/systemd/system/matrix-synapse.service
[Unit]
Description=Matrix Synapse service
After=network.target
[Service]
Type=forking
WorkingDirectory=/opt/synapse/
ExecStart=/opt/synapse/bin/synctl start
ExecStop=/opt/synapse/bin/synctl stop
ExecReload=/opt/synapse/bin/synctl restart
Restart=always
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=synapse
[Install]
WantedBy=multi-user.target
EOF
systemctl enable matrix-synapse --nowTest synapse
Browse to https://example.org/_matrix/key/v2/server/auto and you should get JSON output like
{"old_verify_keys":{},"server_name":"example.org"...Register local synapse users
To register a new (admin) user:
register_new_matrix_user -c homeserver.yaml http://localhost:8008
Now you are ready to connect to the server with a matrix synapse client like the Riot web app.
Element web app
wget https://github.com/vector-im/element-web/releases/download/v1.10.11/element-v1.10.11.tar.gz
tar -xzf element-v1.10.11.tar.gz
mv element-v1.10.11 /var/www/html/element
cp /var/www/html/element/config.sample.json /var/www/html/element/config.json
rm -f element-v1.10.11.tar.gzEdit /var/www/html/element/config.json to match your domain:
"default_server_config": {
"m.homeserver": {
"base_url": "https://example.org",
"server_name": "example.org"
},
"m.identity_server": {
"base_url": "https://matrix.org"Browse to https://example.org/element and login to your web chat app.
Federation test
If you’re able to connect to room #synapse:matrix.org, federation should work.
You may test with federation tester too: https://federationtester.matrix.org/
TurnServer
If you have epel disabled:
yum --enablerepo=epel install coturn
yum install nano coturn
openssl rand -hex 32
nano /etc/coturn/turnserver.conf
listening-port=3478
fingerprint
use-auth-secret
static-auth-secret=<yourChosen/GeneratedSecret>
realm=server.domain.tld
bps-capacity=0
stale-nonce=600
no-multicast-peers
config set coturn service status enabled TCPPort 3478 UDPPort 3478 access public
signal-event firewall-adjust
systemctl enable --now coturn
systemctl restart coturn
Coturn Synapse setup
Your homeserver configuration file needs the following extra keys:
- "
turn_uris": This needs to be a yaml list of public-facing URIs for your TURN server to be given out to your clients. Add separate entries for each transport your TURN server supports. - "
turn_shared_secret": This is the secret shared between your homeserver and your TURN server, so you should set it to the same string you used in turnserver.conf. - "
turn_user_lifetime": This is the amount of time credentials generated by your homeserver are valid for (in milliseconds). Shorter times offer less potential for abuse at the expense of increased traffic between web clients and your homeserver to refresh credentials. The TURN REST API specification recommends one day (86400000). - "
turn_allow_guests": Whether to allow guest users to use the TURN server. This is enabled by default, as otherwise VoIP will not work reliably for guests. However, it does introduce a security risk as it lets guests connect to arbitrary endpoints without having gone through a CAPTCHA or similar to register a real account.
As an example, here is the relevant section of the config file for matrix.org . The turn_uris are appropriate for TURN servers listening on the default ports, with no TLS.
turn_uris: [ "turn:turn.matrix.org?transport=udp", "turn:turn.matrix.org?transport=tcp" ]
turn_shared_secret: "n0t4ctuAllymatr1Xd0TorgSshar3d5ecret4obvIousreAsons"
turn_user_lifetime: 86400000
turn_allow_guests: True
After updating the homeserver configuration, you must restart synapse:
systemctl restart matrix-synapse
Reference: synapse/turn-howto.md at develop · matrix-org/synapse (github.com)
LDAP/AD
You may use LDAP/AD as userbase. This way both, local synapse users and LDAP/AD users, are possible.
For remote AD/LDAP you need to use LDAPS and port 636 and for AD maybe a cert, I didn’t test remote AD/LDAP…
Install the ldap module:
pip install matrix-synapse-ldap3
Uncomment the password providers settings in /opt/synapse/homeserver.yaml (search for password_providers:) and edit to your needs.
Replace BINDPASSWORD with your AD/LDAP bind user password.
Local LDAP
password_providers:
- module: "ldap_auth_provider.LdapAuthProvider"
config:
enabled: true
uri: "ldap://localhost:389"
start_tls: true
base: "ou=People,dc=directory,dc=nh"
attributes:
uid: "uid"
mail: "email"
name: "sn"
bind_dn: "cn=ldapservice,dc=directory,dc=nh"
bind_password: BINDPASSWORDLocal AD
password_providers:
- module: "ldap_auth_provider.LdapAuthProvider"
config:
enabled: true
uri: "ldap://nsdc-testserver.ad.domain.local"
start_tls: true
base: "dc=ad,dc=domain,dc=local"
attributes:
uid: "cn"
mail: "email"
name: "samaccountname"
bind_dn: "ldapservice@ad.domain.local"
bind_password: BINDPASSWORDApply config:
systemctl restart matrix-synapse
Bridges
matrix-appservice-discord - work in progress
Get nodejs 10 and matrix and compile:
cd ~
yum install rh-nodejs10
git clone https://github.com/Half-Shot/matrix-appservice-discord.git
cd matrix-appservice-discord
scl enable rh-nodejs10 bash
npm install
npm run build
cp config/config.sample.yaml ./config.yaml
Edit config.yaml to set your domain:
bridge:
domain: "example.com"
homeserverUrl: "https://example.com"
Generate discord-registration.yaml and copy to right place:
node build/src/discordas.js -r -u "http://localhost:9005" -c config.yaml
cp discord-registration.yaml /opt/synapse/
Apply discord bridge to synapse config:
Edit /opt/synapse/homeserver.yaml and add the
app_service_config_files:
- "discord-registration.yaml"
Now I’m stuck at the docker run.
docker run -v /root/matrix-appservice-discord:/data halfshot/matrix-appservice-discord
I get following error. It seems the container does not get an IP address.
Mar-20 21:34:40.721 [ClientFactory] error: Could not login as the bot user. This is bad! Error: getaddrinfo EAI_AGAIN discordapp.com
at GetAddrInfoReqWrap.onlookup [as oncomplete] (dns.js:64:26)
mautrix-telegram - work in progress
This is an example for a simple matrix bridge.
yum -y install http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm
yum -y install ffmpeg
su - postgres -c "scl enable rh-postgresql10 -- psql --port=55433"
create user mautrixtelegram with encrypted password 'SECRET';
CREATE DATABASE mautrixtelegram
ENCODING 'UTF8'
LC_COLLATE='C'
LC_CTYPE='C'
template=template0
OWNER mautrixtelegram;
\q
mkdir /opt/mautrix-telegram
cd /opt/mautrix-telegram
scl enable rh-python36 bash
virtualenv .
source ./bin/activate
pip install --upgrade mautrix-telegram[all]
cp example-config.yaml config.yaml
Create a telegram bot at Bots: An introduction for developers to get api id and hash.
Open config.yaml and configure homeserver settings, api_id/api_hash, look for example.org and replace with your domain.
Add postgres settings:
database: postgres://mautrixtelegram:SECRET@localhost:55433/mautrixtelegram
Create registration file with following command:
python -m mautrix_telegram -g
Edit ../synapse/homeserver.yaml (The matrix homeserver config):
app_service_config_files:
- "discord-registration.yaml"
- "/opt/mautrix-telegram/registration.yaml"
Create the database with alembic upgrade head . If you have a custom config path, use alembic -x config=/path/to/config.yaml upgrade head
Restart matrix-synapse and start mautrix_telegram
systemctl restart matrix-synapse
python -m mautrix_telegram
Go to your Telegram and talk to your bot and check the output on the screen.
Clean routine
Delete Matrix Synapse to make reinstall possible if something failed badly:
systemctl stop matrix-synapse
rm -Rf /opt/synapse
su - postgres -c "scl enable rh-postgresql10 -- psql --port=55433"
drop database synapse;
drop role synapse;
\qUpdating Element Web
v1.10.11
rm -rf /var/www/html/element/config.bkp.json
cp /var/www/html/element/config.json /var/www/html/element/config.bkp.json
wget https://github.com/vector-im/element-web/releases/download/v1.10.11/element-v1.10.11.tar.gz
tar -xzf element-v1.10.11.tar.gz
mv element-v1.10.11.tar.gz /var/www/html/element
cp /var/www/html/element/config.bkp.json /var/www/html/element/config.json
rm -f element-v1.10.11.tar.gz