matrix-docker-ansible-deploy/roles/matrix-server/templates/systemd/matrix-nginx-proxy.service.j2

[Unit]
Description=Matrix nginx proxy server
After=docker.service
Requires=docker.service
Wants=matrix-synapse.service
{% if matrix_riot_web_enabled %}
Wants=matrix-riot-web.service
{% endif %}

[Service]
Type=simple
ExecStartPre=-/usr/bin/docker kill matrix-nginx-proxy
ExecStartPre=-/usr/bin/docker rm matrix-nginx-proxy
ExecStart=/usr/bin/docker run --rm --name matrix-nginx-proxy \
			--network {{ matrix_docker_network }} \
			-p 80:80 \
			-p 443:443 \
			-v {{ matrix_nginx_proxy_confd_path }}:/etc/nginx/conf.d:ro \
			-v {{ matrix_ssl_certs_path }}:{{ matrix_ssl_certs_path }}:ro \
			{{ docker_nginx_image }}
ExecStop=-/usr/bin/docker kill matrix-nginx-proxy
ExecStop=-/usr/bin/docker rm matrix-nginx-proxy
ExecReload=/usr/bin/docker exec matrix-nginx-proxy /usr/sbin/nginx -s reload
Restart=always
RestartSec=30

[Install]
WantedBy=multi-user.target
Initial commit 2017-07-31 20:07:30 +00:00			`[Unit]`
			`Description=Matrix nginx proxy server`
			`After=docker.service`
			`Requires=docker.service`
Put all containers in their own isolated Docker network (matrix) Moving away from using the default bridge network to using our own. This isolates our services from other Docker containers running on the default network on the same host. The benefits are that: - isolation is a little better - we no longer share a default bridge network with any other containers that might be running on the host - there are no longer hard dependencies - we do service discovery by DNS name, and not via explicit `--link` usage during container start, so containers can start out of order and fail without bringing down others with them (`matrix-nginx-proxy` can continue running, even if one of the other services dies) In the future, when other services get introduced, the increased resilience and simplicity will help as well. 2018-08-08 05:23:36 +00:00			`Wants=matrix-synapse.service`
Fix matrix-nginx-proxy.service dependency on riot-web, if riot-web disabled 2018-08-07 12:39:57 +00:00			`{% if matrix_riot_web_enabled %}`
Put all containers in their own isolated Docker network (matrix) Moving away from using the default bridge network to using our own. This isolates our services from other Docker containers running on the default network on the same host. The benefits are that: - isolation is a little better - we no longer share a default bridge network with any other containers that might be running on the host - there are no longer hard dependencies - we do service discovery by DNS name, and not via explicit `--link` usage during container start, so containers can start out of order and fail without bringing down others with them (`matrix-nginx-proxy` can continue running, even if one of the other services dies) In the future, when other services get introduced, the increased resilience and simplicity will help as well. 2018-08-08 05:23:36 +00:00			`Wants=matrix-riot-web.service`
Fix matrix-nginx-proxy.service dependency on riot-web, if riot-web disabled 2018-08-07 12:39:57 +00:00			`{% endif %}`
Initial commit 2017-07-31 20:07:30 +00:00
			`[Service]`
			`Type=simple`
			`ExecStartPre=-/usr/bin/docker kill matrix-nginx-proxy`
			`ExecStartPre=-/usr/bin/docker rm matrix-nginx-proxy`
			`ExecStart=/usr/bin/docker run --rm --name matrix-nginx-proxy \`
Put all containers in their own isolated Docker network (matrix) Moving away from using the default bridge network to using our own. This isolates our services from other Docker containers running on the default network on the same host. The benefits are that: - isolation is a little better - we no longer share a default bridge network with any other containers that might be running on the host - there are no longer hard dependencies - we do service discovery by DNS name, and not via explicit `--link` usage during container start, so containers can start out of order and fail without bringing down others with them (`matrix-nginx-proxy` can continue running, even if one of the other services dies) In the future, when other services get introduced, the increased resilience and simplicity will help as well. 2018-08-08 05:23:36 +00:00			`--network {{ matrix_docker_network }} \`
Add http->http redirection for Matrix/Riot Doing this means that matrix-nginx-proxy now starts occupying port 80, which necessitates that SSL renewal happens slightly differently. 2017-08-06 16:10:50 +00:00			`-p 80:80 \`
Initial commit 2017-07-31 20:07:30 +00:00			`-p 443:443 \`
Do not mount certain Docker volumes as read-write unnecessarily 2017-10-01 08:36:30 +00:00			`-v {{ matrix_nginx_proxy_confd_path }}:/etc/nginx/conf.d:ro \`
			`-v {{ matrix_ssl_certs_path }}:{{ matrix_ssl_certs_path }}:ro \`
Initial commit 2017-07-31 20:07:30 +00:00			`{{ docker_nginx_image }}`
			`ExecStop=-/usr/bin/docker kill matrix-nginx-proxy`
			`ExecStop=-/usr/bin/docker rm matrix-nginx-proxy`
Do not use Let's Encrypt certificate for Synapse's federation port As described here ( https://github.com/matrix-org/synapse/issues/2438#issuecomment-327424711 ), using own SSL certificates for the federation port is more fragile, as renewing them could cause federation outages. The recommended setup is to use the self-signed certificates generated by Synapse. On the 443 port (matrix-nginx-proxy) side, we still use the Let's Encrypt certificates, which ensures API consumers work without having to trust "our own CA". Having done this, we also don't need to ever restart Synapse anymore, as no new SSL certificates need to be applied there. It's just matrix-nginx-proxy that needs to be restarted, and it doesn't even need a full restart as an "nginx reload" does the job of swithing to the new SSL certificates. 2017-09-23 12:08:54 +00:00			`ExecReload=/usr/bin/docker exec matrix-nginx-proxy /usr/sbin/nginx -s reload`
Initial commit 2017-07-31 20:07:30 +00:00			`Restart=always`
			`RestartSec=30`

			`[Install]`
			`WantedBy=multi-user.target`