home/max
Archived
2
1
Fork 0
Code Issues 9 Pull requests Projects Releases Packages Wiki Activity

WIP: matrix

Browse source
This commit is contained in:
Pim Kunis 2023-02-25 15:06:17 +01:00
parent cb861223ea
commit b638cd7310
21 changed files with 249 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

11
roles/static/templates/docker-compose.yml.j2
View file

@ -12,15 +12,24 @@ services:
- {{ service_dir }}/security.txt:/var/www/blog/security.txt
networks:
- traefik
extra_hosts:
- "host.docker.internal:host-gateway"
labels:
- traefik.enable=true
- traefik.http.routers.blog.entrypoints=websecure
- "traefik.http.routers.blog.rule=(Host(`{{ domain_name_pim }}`) || Path(`/security.txt`, `/.well-known/security.txt`))"
- "traefik.http.routers.blog.rule=(Host(`{{ domain_name_pim }}`) || Path(`/security.txt`, `/.well-known/security.txt`, `/_matrix`, `/.well-known/matrix/`))"
- traefik.http.routers.blog.tls=true
- traefik.http.routers.blog.tls.certresolver=letsencrypt
- traefik.http.routers.blog.service=blog
- traefik.http.services.blog.loadbalancer.server.port=80
- traefik.http.routers.matrix-fed.entrypoints=matrix
- traefik.http.routers.matrix-fed.rule=Host(`matrix.pim.kunis.nl`)
- traefik.http.routers.matrix-fed.tls=true
- traefik.http.routers.matrix-fed.tls.certresolver=letsencrypt
- traefik.http.routers.matrix-fed.service=matrix-fed
- traefik.http.services.matrix-fed.loadbalancer.server.port=8448
networks:
traefik:
external: true

34
roles/static/templates/nginx.conf.j2
View file

@ -2,19 +2,39 @@ server {
listen 80 default_server;
location /security.txt {
return 301 https://$host/.well-known/security.txt;
return 301 https://{{ domain_name_pim }}/.well-known/security.txt;
}
location /.well-known/security.txt {
add_header Content-Type 'text/plain';
add_header Cache-Control 'no-cache, no-store, must-revalidate';
add_header Pragma 'no-cache';
add_header Expires '0';
add_header Vary '*';
return 200 "Contact: mailto:pim@kunis.nl\nExpires: 1970-01-01T00:00:00.000Z\nPreferred-Languages: en,nl\n";
return 301 https://{{ domain_name_pim }}/.well-known/security.txt;
}
}
server {
# For the federation port
listen 8448 http2 default_server;
listen [::]:8448 http2 default_server;
server_name matrix.pim.kunis.nl;
location ~ ^(/_matrix|/_synapse/client) {
# note: do not add a path (even a single /) after the port in `proxy_pass`,
# otherwise nginx will canonicalise the URI and cause signature verification
# errors.
proxy_pass http://host.docker.internal:{{ internal_matrix_port }};
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
# Nginx by default only allows file uploads up to 1M in size
# Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
client_max_body_size 50M;
# Synapse responses may be chunked, which is an HTTP/1.1 feature.
proxy_http_version 1.1;
}
}
server {
listen 80;
server_name {{ domain_name_pim }};