From 6c1069fd16a81615ee2f96f38525ec675be7fcd9 Mon Sep 17 00:00:00 2001 From: SirHazza <31993698+SirHazza@users.noreply.github.com> Date: Fri, 19 Jan 2024 22:46:58 +0000 Subject: [PATCH 1/4] Updated nginx proxy fronting with NPM guide Updated the 'nginx reverse-proxy fronting' documentation with a guide for Nginx Proxy Manager, as you can't use the pre-existing nginx matrix.conf --- examples/reverse-proxies/nginx/README.md | 72 ++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/examples/reverse-proxies/nginx/README.md b/examples/reverse-proxies/nginx/README.md index 5501cf1e6..246d24ed3 100644 --- a/examples/reverse-proxies/nginx/README.md +++ b/examples/reverse-proxies/nginx/README.md @@ -15,3 +15,75 @@ Copy the [matrix.conf](matrix.conf) file to your nginx server's filesystem, modi This configuration **disables SSL certificate retrieval**, so you will **need to obtain SSL certificates manually** (e.g. by using [certbot](https://certbot.eff.org/)) and set the appropriate path in `matrix.conf`. In the example nginx configuration, a single certificate is used for all subdomains (`matrix.DOMAIN`, `element.DOMAIN`, etc.). For your setup, may wish to change this and use separate `server` blocks and separate certificate files for each host. Also note that your copy of the `matrix.conf` file has to be adapted to whatever services you are using. For example, remove `element.domain.com` from the `server_name` list if you don't use [Element](../../../docs/configuring-playbook-client-element.md) web client or add `dimension.domain.com` to it if you do use the [Dimension](../../../docs/configuring-playbook-dimension.md) integration manager. + +## Using Nginx Proxy Manager + +Similar to standard nginx, [Nginx Proxy Manager](https://nginxproxymanager.com/) provides nginx capabilities but inside a pre-built Docker container. With the ability for managing proxy hosts and automatic SSL certificates via a simple web interface. + +If Matrix federation is enabled, then you will need to make changes to [NPM's Docker configuration](https://nginxproxymanager.com/guide/#quick-setup). By default NPM has access to ports 443, 80 and 81, but you would also need to **provide access to the fedderation ports** `8448` and `8449`. + + +### Creating proxy hosts in Nginx Proxy Manager + +Open the 'Proxy Hosts' page in the NPM web interface and select `Add Proxy Host`, the first being for matrix web traffic. Apply the proxys configuration like this: + +```md +# Details +# Matrix web proxy config +Domain Names: matrix.DOMAIN +Scheme: http +Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX +Forward Port: 81 + +# Custom locations +# Add one custom location +Define location: / +Scheme: http +Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX +Forward Port: 81 +Custom config: + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + client_max_body_size 50M; + +# SSL +# Either 'Request a new certificate' or select an existing one +SSL Certificate: matrix.DOMAIN or *.DOMAIN +Force SSL: true +HTTP/2 Support: true +``` + +Again, under the 'Proxy Hosts' page select `Add Proxy Host`, this time for your federation traffic. Apply the proxys configuration like this: + +```md +# Details +# Matrix Federation proxy config +Domain Names: matrix.DOMAIN:8448 +Scheme: http +Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX +Forward Port: 8449 + +# Custom locations +# Add one custom location +Define location: / +Scheme: http +Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX +Forward Port: 8449 +Custom config: + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + client_max_body_size 50M; + +# SSL +# Either 'Request a new certificate' or select an existing one +SSL Certificate: matrix.DOMAIN or *.DOMAIN +Force SSL: true +HTTP/2 Support: true + +# Advanced +# Allows NPM to listen on the federation port +Custom Nginx Configuration: listen 8448 ssl http2; +``` + +Also note, NPM would need to be configured for whatever other services you are using. For example, you would need to create additional proxy hosts for `element.DOMAIN` or `jitsi.DOMAIN`, which would use the forwarding port `81`. From 55a8f2ee67b7e67e9b7258d6ea1faf1cd25dc10f Mon Sep 17 00:00:00 2001 From: SirHazza <31993698+SirHazza@users.noreply.github.com> Date: Sat, 20 Jan 2024 13:58:37 +0000 Subject: [PATCH 2/4] Added mention of nginx proxy manager in fronting the proxy doc --- docs/configuring-playbook-own-webserver.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md index 2295ecb3a..74d0d06c6 100644 --- a/docs/configuring-playbook-own-webserver.md +++ b/docs/configuring-playbook-own-webserver.md @@ -181,7 +181,7 @@ matrix_playbook_public_matrix_federation_api_traefik_entrypoint_config_custom: Such a configuration would expose all services on a local port `81` and Matrix Federation on a local port `8449`. -Your reverse-proxy configuration needs to send traffic to these ports. The [`examples/reverse-proxies` directory](../examples/reverse-proxies/) contains sample configuration for various webservers (Apache2, Caddy, HAproxy, nginx). +Your reverse-proxy configuration needs to send traffic to these ports. The [`examples/reverse-proxies` directory](../examples/reverse-proxies/) contains sample configuration for various webservers (Apache2, Caddy, HAproxy, nginx, Nginx Proxy Manager). It's important that these webservers proxy-pass requests to the correct place and also set the `Host` HTTP header appropriately. If you don't pass the `Host` header correctly, you would get a 404 not found error from Traefik. From 448484a6252b1591194fc6a060b681abd832b045 Mon Sep 17 00:00:00 2001 From: SirHazza <31993698+SirHazza@users.noreply.github.com> Date: Sat, 20 Jan 2024 13:59:58 +0000 Subject: [PATCH 3/4] Created dedicated guide on Nginx Proxy Manager --- .../nginx-proxy-manager/README.md | 80 +++++++++++++++++++ examples/reverse-proxies/nginx/README.md | 74 +---------------- 2 files changed, 81 insertions(+), 73 deletions(-) create mode 100644 examples/reverse-proxies/nginx-proxy-manager/README.md diff --git a/examples/reverse-proxies/nginx-proxy-manager/README.md b/examples/reverse-proxies/nginx-proxy-manager/README.md new file mode 100644 index 000000000..c349af2c8 --- /dev/null +++ b/examples/reverse-proxies/nginx-proxy-manager/README.md @@ -0,0 +1,80 @@ +# Nginx Proxy Manager fronting the playbook's integrated Traefik reverse-proxy + +Similar to standard nginx, [Nginx Proxy Manager](https://nginxproxymanager.com/) provides nginx capabilities but inside a pre-built Docker container. With the ability for managing proxy hosts and automatic SSL certificates via a simple web interface. + +This page summarizes how to use Nginx Proxy Manager (NPM) to front the integrated [Traefik](https://traefik.io/) reverse-proxy webserver with another reverse-proxy. + + +## Prerequisite configuration + +To get started, first follow the [front the integrated reverse-proxy webserver with another reverse-proxy](../../../docs/configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instructions and update your playbook's configuration (`inventory/host_vars/matrix./vars.yml`). + +If Matrix federation is enabled, then you will need to make changes to [NPM's Docker configuration](https://nginxproxymanager.com/guide/#quick-setup). By default NPM has access to ports 443, 80 and 81, but you would also need to **provide access to the federation ports** `8448` and `8449`. + + +## Using Nginx Proxy Manager + +You'll need to create two proxy hosts in NPM for matrix web and federation traffic. + +Open the 'Proxy Hosts' page in the NPM web interface and select `Add Proxy Host`, the first being for matrix web traffic. Apply the proxys configuration like this: + +```md +# Details +# Matrix web proxy config +Domain Names: matrix.DOMAIN +Scheme: http +Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX +Forward Port: 81 + +# Custom locations +# Add one custom location +Define location: / +Scheme: http +Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX +Forward Port: 81 +Custom config: + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + client_max_body_size 50M; + +# SSL +# Either 'Request a new certificate' or select an existing one +SSL Certificate: matrix.DOMAIN or *.DOMAIN +Force SSL: true +HTTP/2 Support: true +``` + +Again, under the 'Proxy Hosts' page select `Add Proxy Host`, this time for your federation traffic. Apply the proxys configuration like this: + +```md +# Details +# Matrix Federation proxy config +Domain Names: matrix.DOMAIN:8448 +Scheme: http +Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX +Forward Port: 8449 + +# Custom locations +# Add one custom location +Define location: / +Scheme: http +Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX +Forward Port: 8449 +Custom config: + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + client_max_body_size 50M; + +# SSL +# Either 'Request a new certificate' or select an existing one +SSL Certificate: matrix.DOMAIN or *.DOMAIN +Force SSL: true +HTTP/2 Support: true + +# Advanced +# Allows NPM to listen on the federation port +Custom Nginx Configuration: listen 8448 ssl http2; +``` + +Also note, NPM would need to be configured for whatever other services you are using. For example, you would need to create additional proxy hosts for `element.DOMAIN` or `jitsi.DOMAIN`, which would use the forwarding port `81`. \ No newline at end of file diff --git a/examples/reverse-proxies/nginx/README.md b/examples/reverse-proxies/nginx/README.md index 246d24ed3..fd7df72af 100644 --- a/examples/reverse-proxies/nginx/README.md +++ b/examples/reverse-proxies/nginx/README.md @@ -14,76 +14,4 @@ Copy the [matrix.conf](matrix.conf) file to your nginx server's filesystem, modi This configuration **disables SSL certificate retrieval**, so you will **need to obtain SSL certificates manually** (e.g. by using [certbot](https://certbot.eff.org/)) and set the appropriate path in `matrix.conf`. In the example nginx configuration, a single certificate is used for all subdomains (`matrix.DOMAIN`, `element.DOMAIN`, etc.). For your setup, may wish to change this and use separate `server` blocks and separate certificate files for each host. -Also note that your copy of the `matrix.conf` file has to be adapted to whatever services you are using. For example, remove `element.domain.com` from the `server_name` list if you don't use [Element](../../../docs/configuring-playbook-client-element.md) web client or add `dimension.domain.com` to it if you do use the [Dimension](../../../docs/configuring-playbook-dimension.md) integration manager. - -## Using Nginx Proxy Manager - -Similar to standard nginx, [Nginx Proxy Manager](https://nginxproxymanager.com/) provides nginx capabilities but inside a pre-built Docker container. With the ability for managing proxy hosts and automatic SSL certificates via a simple web interface. - -If Matrix federation is enabled, then you will need to make changes to [NPM's Docker configuration](https://nginxproxymanager.com/guide/#quick-setup). By default NPM has access to ports 443, 80 and 81, but you would also need to **provide access to the fedderation ports** `8448` and `8449`. - - -### Creating proxy hosts in Nginx Proxy Manager - -Open the 'Proxy Hosts' page in the NPM web interface and select `Add Proxy Host`, the first being for matrix web traffic. Apply the proxys configuration like this: - -```md -# Details -# Matrix web proxy config -Domain Names: matrix.DOMAIN -Scheme: http -Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX -Forward Port: 81 - -# Custom locations -# Add one custom location -Define location: / -Scheme: http -Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX -Forward Port: 81 -Custom config: - proxy_set_header X-Forwarded-For $remote_addr; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Real-IP $remote_addr; - client_max_body_size 50M; - -# SSL -# Either 'Request a new certificate' or select an existing one -SSL Certificate: matrix.DOMAIN or *.DOMAIN -Force SSL: true -HTTP/2 Support: true -``` - -Again, under the 'Proxy Hosts' page select `Add Proxy Host`, this time for your federation traffic. Apply the proxys configuration like this: - -```md -# Details -# Matrix Federation proxy config -Domain Names: matrix.DOMAIN:8448 -Scheme: http -Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX -Forward Port: 8449 - -# Custom locations -# Add one custom location -Define location: / -Scheme: http -Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX -Forward Port: 8449 -Custom config: - proxy_set_header X-Forwarded-For $remote_addr; - proxy_set_header X-Forwarded-Proto $scheme; - client_max_body_size 50M; - -# SSL -# Either 'Request a new certificate' or select an existing one -SSL Certificate: matrix.DOMAIN or *.DOMAIN -Force SSL: true -HTTP/2 Support: true - -# Advanced -# Allows NPM to listen on the federation port -Custom Nginx Configuration: listen 8448 ssl http2; -``` - -Also note, NPM would need to be configured for whatever other services you are using. For example, you would need to create additional proxy hosts for `element.DOMAIN` or `jitsi.DOMAIN`, which would use the forwarding port `81`. +Also note that your copy of the `matrix.conf` file has to be adapted to whatever services you are using. For example, remove `element.domain.com` from the `server_name` list if you don't use [Element](../../../docs/configuring-playbook-client-element.md) web client or add `dimension.domain.com` to it if you do use the [Dimension](../../../docs/configuring-playbook-dimension.md) integration manager. \ No newline at end of file From 60a01622cfbdbb328d979aac3206b6943b1803ef Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sat, 20 Jan 2024 16:09:14 +0200 Subject: [PATCH 4/4] Minor improvements to the nginx-proxy-manager docs --- examples/reverse-proxies/nginx-proxy-manager/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/reverse-proxies/nginx-proxy-manager/README.md b/examples/reverse-proxies/nginx-proxy-manager/README.md index c349af2c8..38de85897 100644 --- a/examples/reverse-proxies/nginx-proxy-manager/README.md +++ b/examples/reverse-proxies/nginx-proxy-manager/README.md @@ -2,14 +2,14 @@ Similar to standard nginx, [Nginx Proxy Manager](https://nginxproxymanager.com/) provides nginx capabilities but inside a pre-built Docker container. With the ability for managing proxy hosts and automatic SSL certificates via a simple web interface. -This page summarizes how to use Nginx Proxy Manager (NPM) to front the integrated [Traefik](https://traefik.io/) reverse-proxy webserver with another reverse-proxy. +This page summarizes how to use Nginx Proxy Manager (NPM) to front the integrated [Traefik](https://traefik.io/) reverse-proxy webserver. ## Prerequisite configuration To get started, first follow the [front the integrated reverse-proxy webserver with another reverse-proxy](../../../docs/configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instructions and update your playbook's configuration (`inventory/host_vars/matrix./vars.yml`). -If Matrix federation is enabled, then you will need to make changes to [NPM's Docker configuration](https://nginxproxymanager.com/guide/#quick-setup). By default NPM has access to ports 443, 80 and 81, but you would also need to **provide access to the federation ports** `8448` and `8449`. +If Matrix federation is enabled, then you will need to make changes to [NPM's Docker configuration](https://nginxproxymanager.com/guide/#quick-setup). By default NPM already exposes ports `80` and `443`, but you would also need to **additionally expose the Matrix Federation port** (as it appears on the public side): `8448`. ## Using Nginx Proxy Manager @@ -77,4 +77,4 @@ HTTP/2 Support: true Custom Nginx Configuration: listen 8448 ssl http2; ``` -Also note, NPM would need to be configured for whatever other services you are using. For example, you would need to create additional proxy hosts for `element.DOMAIN` or `jitsi.DOMAIN`, which would use the forwarding port `81`. \ No newline at end of file +Also note, NPM would need to be configured for whatever other services you are using. For example, you would need to create additional proxy hosts for `element.DOMAIN` or `jitsi.DOMAIN`, which would use the forwarding port `81`.