finallycoffee/matrix-docker-ansible-deploy
finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity
5156c63a76
matrix-docker-ansible-deploy/docs/configuring-playbook-nginx.md

65 lines
2.9 KiB
Markdown
Raw Normal View History

Fix spelling ngnix -> nginx
2019-10-04 08:07:37 +00:00
# Configure Nginx (optional, advanced)
add ngnix-status to config add doc
2019-04-17 11:42:09 +00:00
By default, this playbook installs its own nginx webserver (in a Docker container) which listens on ports 80 and 443.
If that's alright, you can skip this.
Fix spelling ngnix -> nginx
2019-10-04 08:07:37 +00:00
## Using Nginx status
add ngnix-status to config add doc
2019-04-17 11:42:09 +00:00
This will serve a statuspage to the hosting machine only. Useful for monitoring software like [longview](https://www.linode.com/docs/platform/longview/longview-app-for-nginx/)
```yaml
serve status page for matrix.DOMAIN only
2019-08-07 08:54:14 +00:00
matrix_nginx_proxy_proxy_matrix_nginx_status_enabled: true
add ngnix-status to config add doc
2019-04-17 11:42:09 +00:00
```
add suggested change; correct indent
2019-04-23 07:44:02 +00:00
Serve nginx status page over HTTPS as well Continuation of #234 (Github Pull Request). I had unintentionally updated the documentation for the feature, saying the page is available at `https://matrix.DOMAIN/nginx_status`. Looks like it wasn't the case, going against my expectations. I'm correcting this with this patch. The status page is being made available on both HTTP and HTTPS. Serving over HTTP is likely necessary for services like Longview (https://www.linode.com/docs/platform/longview/longview-app-for-nginx/)
2019-08-07 09:53:53 +00:00
This will serve the status page under the following addresses:
- `http://matrix.DOMAIN/nginx_status` (using HTTP)
- `https://matrix.DOMAIN/nginx_status` (using HTTPS)
serve status page for matrix.DOMAIN only
2019-08-07 08:54:14 +00:00
Update configuring-playbook-ngnix.md
2019-08-07 09:35:48 +00:00
By default, if ```matrix_nginx_proxy_nginx_status_enabled``` is enabled, access to the status page would be allowed from the local IP address of the server. If you wish to allow access from other IP addresses, you can provide them as a list:
add suggested change; correct indent
2019-04-23 07:44:02 +00:00
```yaml
serve status page for matrix.DOMAIN only
2019-08-07 08:54:14 +00:00
matrix_nginx_proxy_proxy_matrix_nginx_status_allowed_addresses:
add suggested change; correct indent
2019-04-23 07:44:02 +00:00
- 8.8.8.8
- 1.1.1.1
```
Add support for reverse-proxying /_synapse/oidc This broke in 63a49bb2dc7780e023b28. Proxying the OpenID Connect endpoints is now possible, but needs to be enabled explicitly now. Supersedes #702 (Github Pull Request). This patch builds up on the idea from that Pull Request, but does things in a cleaner way.
2020-11-02 09:10:03 +00:00
Document the new variables for ngingx SSL config The new variables created to the nginx reverse proxy are properly added to the documentation.
2020-12-16 09:50:08 +00:00
## Adjusting SSL in your server
Fix errors per spantaleev suggestions The different configurations are now all lower case, for consistent naming. `matrix_nginx_proxy_ssl_config` is now called `matrix_nginx_proxy_ssl_preset`. The different options for "modern", "intermediate" and "old" are stored in the main.yml file, instead of being hardcoded in the configuration files. This will improve the maintainability of the code. The "custom" preset was removed. Now if one of the variables is set, it will use it instead of the preset. This will allow to mix and match more easily, for example using all the intermediate options but only supporting TLSv1.2. This will also provide better backward compatibility.
2021-01-08 10:20:29 +00:00
You can adjust how the SSL is served by the nginx server by setting the `matrix_nginx_proxy_ssl_preset`. This is based on the Mozilla Server Side TLS
Document the new variables for ngingx SSL config The new variables created to the nginx reverse proxy are properly added to the documentation.
2020-12-16 09:50:08 +00:00
Recommended configurations. It changes the TLS Protocol, the SSL Cipher Suites and the `ssl_prefer_server_ciphers` variable of nginx.
The posible values are:
Fix errors per spantaleev suggestions The different configurations are now all lower case, for consistent naming. `matrix_nginx_proxy_ssl_config` is now called `matrix_nginx_proxy_ssl_preset`. The different options for "modern", "intermediate" and "old" are stored in the main.yml file, instead of being hardcoded in the configuration files. This will improve the maintainability of the code. The "custom" preset was removed. Now if one of the variables is set, it will use it instead of the preset. This will allow to mix and match more easily, for example using all the intermediate options but only supporting TLSv1.2. This will also provide better backward compatibility.
2021-01-08 10:20:29 +00:00
- "modern" - For Modern clients that support TLS 1.3, with no need for backwards compatibility
- "intermediate" - Recommended configuration for a general-purpose server
- "old" - Services accessed by very old clients or libraries, such as Internet Explorer 8 (Windows XP), Java 6, or OpenSSL 0.9.8
Document the new variables for ngingx SSL config The new variables created to the nginx reverse proxy are properly added to the documentation.
2020-12-16 09:50:08 +00:00
Fix errors per spantaleev suggestions The different configurations are now all lower case, for consistent naming. `matrix_nginx_proxy_ssl_config` is now called `matrix_nginx_proxy_ssl_preset`. The different options for "modern", "intermediate" and "old" are stored in the main.yml file, instead of being hardcoded in the configuration files. This will improve the maintainability of the code. The "custom" preset was removed. Now if one of the variables is set, it will use it instead of the preset. This will allow to mix and match more easily, for example using all the intermediate options but only supporting TLSv1.2. This will also provide better backward compatibility.
2021-01-08 10:20:29 +00:00
The default is set to `"intermediate"`.
Document the new variables for ngingx SSL config The new variables created to the nginx reverse proxy are properly added to the documentation.
2020-12-16 09:50:08 +00:00
Fix errors per spantaleev suggestions The different configurations are now all lower case, for consistent naming. `matrix_nginx_proxy_ssl_config` is now called `matrix_nginx_proxy_ssl_preset`. The different options for "modern", "intermediate" and "old" are stored in the main.yml file, instead of being hardcoded in the configuration files. This will improve the maintainability of the code. The "custom" preset was removed. Now if one of the variables is set, it will use it instead of the preset. This will allow to mix and match more easily, for example using all the intermediate options but only supporting TLSv1.2. This will also provide better backward compatibility.
2021-01-08 10:20:29 +00:00
**Be really carefull when setting it to "modern"**. This could break the comunication with other matrix servers, limiting your feration posibilities and the
Document the new variables for ngingx SSL config The new variables created to the nginx reverse proxy are properly added to the documentation.
2020-12-16 09:50:08 +00:00
[Federarion tester](https://federationtester.matrix.org/) won't work.
Fix errors per spantaleev suggestions The different configurations are now all lower case, for consistent naming. `matrix_nginx_proxy_ssl_config` is now called `matrix_nginx_proxy_ssl_preset`. The different options for "modern", "intermediate" and "old" are stored in the main.yml file, instead of being hardcoded in the configuration files. This will improve the maintainability of the code. The "custom" preset was removed. Now if one of the variables is set, it will use it instead of the preset. This will allow to mix and match more easily, for example using all the intermediate options but only supporting TLSv1.2. This will also provide better backward compatibility.
2021-01-08 10:20:29 +00:00
If you want to override one of the values used by the preset, you can use this three variables:
Document the new variables for ngingx SSL config The new variables created to the nginx reverse proxy are properly added to the documentation.
2020-12-16 09:50:08 +00:00
- `matrix_nginx_proxy_ssl_protocols`: for specifying the supported TLS protocols.
- `matrix_nginx_proxy_ssl_prefer_server_ciphers`: for specifying if the server or the client choice when negociating the chipher. It can set to "on" or "off".
- `matrix_nginx_proxy_ssl_ciphers`: for specifying the SSL Cipher suites used by nginx.
For more information about this variables, check the `roles/matrix-nginx-proxy/defaults/main.yml` file.
Add support for reverse-proxying /_synapse/oidc This broke in 63a49bb2dc7780e023b28. Proxying the OpenID Connect endpoints is now possible, but needs to be enabled explicitly now. Supersedes #702 (Github Pull Request). This patch builds up on the idea from that Pull Request, but does things in a cleaner way.
2020-11-02 09:10:03 +00:00
## Synapse + OpenID Connect for Single-Sign-On
If you want to use OpenID Connect as an SSO provider (as per the [Synapse OpenID docs](https://github.com/matrix-org/synapse/blob/develop/docs/openid.md)), you need to use the following configuration (in your `vars.yml` file) to instruct nginx to forward `/_synapse/oidc` to Synapse:
```yaml
matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled: true
```
add option to disable nginx access log
2020-12-20 16:30:28 +00:00
## Disable Nginx access logs
This will disable the access logging for nginx.
```yaml
matrix_nginx_proxy_access_log_enabled: false
```
Reference in New Issue Copy Permalink