Reverse-proxy to Synapse via matrix-synapse-reverse-proxy-companion
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2090
This commit is contained in:
Slavi Pantaleev
@ -0,0 +1,208 @@
|
||||
#jinja2: lstrip_blocks: "True"
|
||||
|
||||
{% set generic_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'generic_worker') | list %}
|
||||
{% set stream_writer_typing_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'typing') | list %}
|
||||
{% set stream_writer_to_device_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'to_device') | list %}
|
||||
{% set stream_writer_account_data_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'account_data') | list %}
|
||||
{% set stream_writer_receipts_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'receipts') | list %}
|
||||
{% set stream_writer_presence_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'presence') | list %}
|
||||
{% set media_repository_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'media_repository') | list %}
|
||||
{% set user_dir_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'user_dir') | list %}
|
||||
|
||||
{% macro render_worker_upstream(name, workers) %}
|
||||
{% if workers | length > 0 %}
|
||||
upstream {{ name }} {
|
||||
{% for worker in workers %}
|
||||
server "{{ worker.name }}:{{ worker.port }}";
|
||||
{% endfor %}
|
||||
}
|
||||
{% endif %}
|
||||
{% endmacro %}
|
||||
|
||||
{% macro render_locations_to_upstream(locations, upstream_name) %}
|
||||
{% for location in locations %}
|
||||
location ~ {{ location }} {
|
||||
proxy_pass http://{{ upstream_name }}$request_uri;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
{% endfor %}
|
||||
{% endmacro %}
|
||||
|
||||
{% if matrix_synapse_reverse_proxy_companion_synapse_workers_enabled %}
|
||||
{% if matrix_synapse_reverse_proxy_companion_synapse_cache_enabled %}
|
||||
proxy_cache_path {{ matrix_synapse_reverse_proxy_companion_synapse_cache_path }} levels=1:2 keys_zone={{ matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_name }}:{{ matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_size }} inactive={{ matrix_synapse_reverse_proxy_companion_synapse_cache_inactive_time }} max_size={{ matrix_synapse_reverse_proxy_companion_synapse_cache_max_size_mb }}m;
|
||||
{% endif %}
|
||||
# Round Robin "upstream" pools for workers
|
||||
|
||||
{% if generic_workers |length > 0 %}
|
||||
upstream generic_workers_upstream {
|
||||
# ensures that requests from the same client will always be passed
|
||||
# to the same server (except when this server is unavailable)
|
||||
hash $http_x_forwarded_for;
|
||||
|
||||
{% for worker in generic_workers %}
|
||||
server "{{ worker.name }}:{{ worker.port }}";
|
||||
{% endfor %}
|
||||
}
|
||||
{% endif %}
|
||||
|
||||
{{ render_worker_upstream('stream_writer_typing_stream_workers_upstream', stream_writer_typing_stream_workers) }}
|
||||
{{ render_worker_upstream('stream_writer_to_device_stream_workers_upstream', stream_writer_to_device_stream_workers) }}
|
||||
{{ render_worker_upstream('stream_writer_account_data_stream_workers_upstream', stream_writer_account_data_stream_workers) }}
|
||||
{{ render_worker_upstream('stream_writer_receipts_stream_workers_upstream', stream_writer_receipts_stream_workers) }}
|
||||
{{ render_worker_upstream('stream_writer_presence_stream_workers_upstream', stream_writer_presence_stream_workers) }}
|
||||
|
||||
{{ render_worker_upstream('media_repository_workers_upstream', media_repository_workers) }}
|
||||
|
||||
{{ render_worker_upstream('user_dir_workers_upstream', user_dir_workers) }}
|
||||
{% endif %}
|
||||
|
||||
server {
|
||||
listen 8008;
|
||||
server_name {{ matrix_synapse_reverse_proxy_companion_hostname }};
|
||||
|
||||
server_tokens off;
|
||||
root /dev/null;
|
||||
|
||||
gzip on;
|
||||
gzip_types text/plain application/json;
|
||||
|
||||
{% if matrix_synapse_reverse_proxy_companion_synapse_workers_enabled %}
|
||||
{# Workers redirects BEGIN #}
|
||||
|
||||
{% if generic_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#synapseappgeneric_worker
|
||||
{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_generic_worker_client_server_locations, 'generic_workers_upstream') }}
|
||||
{% endif %}
|
||||
|
||||
{% if stream_writer_typing_stream_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#the-typing-stream
|
||||
{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_typing_stream_worker_client_server_locations, 'stream_writer_typing_stream_workers_upstream') }}
|
||||
{% endif %}
|
||||
|
||||
{% if stream_writer_to_device_stream_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#the-to_device-stream
|
||||
{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_to_device_stream_worker_client_server_locations, 'stream_writer_to_device_stream_workers_upstream') }}
|
||||
{% endif %}
|
||||
|
||||
{% if stream_writer_account_data_stream_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#the-account_data-stream
|
||||
{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_account_data_stream_worker_client_server_locations, 'stream_writer_account_data_stream_workers_upstream') }}
|
||||
{% endif %}
|
||||
|
||||
{% if stream_writer_receipts_stream_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#the-receipts-stream
|
||||
{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_receipts_stream_worker_client_server_locations, 'stream_writer_receipts_stream_workers_upstream') }}
|
||||
{% endif %}
|
||||
|
||||
{% if stream_writer_presence_stream_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#the-presence-stream
|
||||
{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_presence_stream_worker_client_server_locations, 'stream_writer_presence_stream_workers_upstream') }}
|
||||
{% endif %}
|
||||
|
||||
{% if media_repository_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#synapseappmedia_repository
|
||||
{% for location in matrix_synapse_reverse_proxy_companion_synapse_media_repository_locations %}
|
||||
location ~ {{ location }} {
|
||||
proxy_pass http://media_repository_workers_upstream$request_uri;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
client_body_buffer_size 25M;
|
||||
client_max_body_size {{ matrix_synapse_reverse_proxy_companion_client_api_client_max_body_size_mb }}M;
|
||||
proxy_max_temp_file_size 0;
|
||||
|
||||
{% if matrix_synapse_reverse_proxy_companion_synapse_cache_enabled %}
|
||||
proxy_buffering on;
|
||||
proxy_cache {{ matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_name }};
|
||||
proxy_cache_valid any {{ matrix_synapse_reverse_proxy_companion_synapse_cache_proxy_cache_valid_time }};
|
||||
proxy_force_ranges on;
|
||||
add_header X-Cache-Status $upstream_cache_status;
|
||||
{% endif %}
|
||||
}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if user_dir_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#updating-the-user-directory
|
||||
{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_user_dir_locations, 'user_dir_workers_upstream') }}
|
||||
{% endif %}
|
||||
{# Workers redirects END #}
|
||||
{% endif %}
|
||||
|
||||
{% for configuration_block in matrix_synapse_reverse_proxy_companion_synapse_client_api_additional_server_configuration_blocks %}
|
||||
{{- configuration_block }}
|
||||
{% endfor %}
|
||||
|
||||
{# Everything else just goes to the API server ##}
|
||||
location / {
|
||||
{# Use the embedded DNS resolver in Docker containers to discover the service #}
|
||||
resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }} valid=5s;
|
||||
set $backend "{{ matrix_synapse_reverse_proxy_companion_client_api_addr }}";
|
||||
proxy_pass http://$backend;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
client_body_buffer_size 25M;
|
||||
client_max_body_size {{ matrix_synapse_reverse_proxy_companion_client_api_client_max_body_size_mb }}M;
|
||||
proxy_max_temp_file_size 0;
|
||||
}
|
||||
}
|
||||
|
||||
{% if matrix_synapse_reverse_proxy_companion_federation_api_enabled %}
|
||||
server {
|
||||
listen 8048;
|
||||
server_name {{ matrix_synapse_reverse_proxy_companion_hostname }};
|
||||
|
||||
server_tokens off;
|
||||
|
||||
root /dev/null;
|
||||
|
||||
gzip on;
|
||||
gzip_types text/plain application/json;
|
||||
|
||||
{% if matrix_synapse_reverse_proxy_companion_synapse_workers_enabled %}
|
||||
{% if generic_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#synapseappgeneric_worker
|
||||
{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_generic_worker_federation_locations, 'generic_workers_upstream') }}
|
||||
{% endif %}
|
||||
{% if media_repository_workers | length > 0 %}
|
||||
# https://matrix-org.github.io/synapse/latest/workers.html#synapseappmedia_repository
|
||||
{% for location in matrix_synapse_reverse_proxy_companion_synapse_media_repository_locations %}
|
||||
location ~ {{ location }} {
|
||||
proxy_pass http://media_repository_workers_upstream$request_uri;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
client_body_buffer_size 25M;
|
||||
client_max_body_size {{ matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb }}M;
|
||||
proxy_max_temp_file_size 0;
|
||||
|
||||
{% if matrix_synapse_reverse_proxy_companion_synapse_cache_enabled %}
|
||||
proxy_buffering on;
|
||||
proxy_cache {{ matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_name }};
|
||||
proxy_cache_valid any {{ matrix_synapse_reverse_proxy_companion_synapse_cache_proxy_cache_valid_time }};
|
||||
proxy_force_ranges on;
|
||||
add_header X-Cache-Status $upstream_cache_status;
|
||||
{% endif %}
|
||||
}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
{% for configuration_block in matrix_synapse_reverse_proxy_companion_synapse_federation_api_additional_server_configuration_blocks %}
|
||||
{{- configuration_block }}
|
||||
{% endfor %}
|
||||
|
||||
location / {
|
||||
{# Use the embedded DNS resolver in Docker containers to discover the service #}
|
||||
resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }} valid=5s;
|
||||
set $backend "{{ matrix_synapse_reverse_proxy_companion_federation_api_addr }}";
|
||||
proxy_pass http://$backend;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
client_body_buffer_size 25M;
|
||||
client_max_body_size {{ matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb }}M;
|
||||
proxy_max_temp_file_size 0;
|
||||
}
|
||||
}
|
||||
{% endif %}
|
||||
@ -0,0 +1,13 @@
|
||||
#jinja2: lstrip_blocks: "True"
|
||||
# The default is aligned to the CPU's cache size,
|
||||
# which can sometimes be too low.
|
||||
# Thus, we ensure a larger bucket size value is used.
|
||||
server_names_hash_bucket_size 64;
|
||||
|
||||
{% if matrix_synapse_reverse_proxy_companion_http_level_resolver %}
|
||||
resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }};
|
||||
{% endif %}
|
||||
|
||||
{% for configuration_block in matrix_synapse_reverse_proxy_companion_http_additional_server_configuration_blocks %}
|
||||
{{- configuration_block }}
|
||||
{% endfor %}
|
||||
@ -0,0 +1,66 @@
|
||||
#jinja2: lstrip_blocks: "True"
|
||||
# This is a custom nginx configuration file that we use in the container (instead of the default one),
|
||||
# because it allows us to run nginx with a non-root user.
|
||||
#
|
||||
# For this to work, the default vhost file (`/etc/nginx/conf.d/default.conf`) also needs to be removed.
|
||||
#
|
||||
# The following changes have been done compared to a default nginx configuration file:
|
||||
# - various temp paths are changed to `/tmp`, so that a non-root user can write to them
|
||||
# - the `user` directive was removed, as we don't want nginx to switch users
|
||||
|
||||
worker_processes {{ matrix_synapse_reverse_proxy_companion_worker_processes }};
|
||||
error_log /var/log/nginx/error.log warn;
|
||||
pid /tmp/nginx.pid;
|
||||
{% for configuration_block in matrix_synapse_reverse_proxy_companion_additional_configuration_blocks %}
|
||||
{{- configuration_block }}
|
||||
{% endfor %}
|
||||
|
||||
events {
|
||||
worker_connections {{ matrix_synapse_reverse_proxy_companion_worker_connections }};
|
||||
{% for configuration_block in matrix_synapse_reverse_proxy_companion_event_additional_configuration_blocks %}
|
||||
{{- configuration_block }}
|
||||
{% endfor %}
|
||||
}
|
||||
|
||||
|
||||
http {
|
||||
proxy_temp_path /tmp/proxy_temp;
|
||||
client_body_temp_path /tmp/client_temp;
|
||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
||||
scgi_temp_path /tmp/scgi_temp;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
{% if matrix_synapse_reverse_proxy_companion_access_log_enabled %}
|
||||
access_log /var/log/nginx/access.log main;
|
||||
{% else %}
|
||||
access_log off;
|
||||
{% endif %}
|
||||
|
||||
proxy_connect_timeout {{ matrix_synapse_reverse_proxy_companion_proxy_connect_timeout }};
|
||||
proxy_send_timeout {{ matrix_synapse_reverse_proxy_companion_proxy_send_timeout }};
|
||||
proxy_read_timeout {{ matrix_synapse_reverse_proxy_companion_proxy_read_timeout }};
|
||||
send_timeout {{ matrix_synapse_reverse_proxy_companion_send_timeout }};
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
|
||||
keepalive_timeout 65;
|
||||
|
||||
server_tokens off;
|
||||
|
||||
#gzip on;
|
||||
{# Map directive needed for proxied WebSocket upgrades #}
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
}
|
||||
@ -0,0 +1,53 @@
|
||||
#jinja2: lstrip_blocks: "True"
|
||||
[Unit]
|
||||
Description=Synapse reverse-proxy companion
|
||||
{% for service in matrix_synapse_reverse_proxy_companion_systemd_required_services_list %}
|
||||
Requires={{ service }}
|
||||
After={{ service }}
|
||||
{% endfor %}
|
||||
{% for service in matrix_synapse_reverse_proxy_companion_systemd_wanted_services_list %}
|
||||
Wants={{ service }}
|
||||
{% endfor %}
|
||||
DefaultDependencies=no
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-synapse-reverse-proxy-companion 2>/dev/null || true'
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-reverse-proxy-companion 2>/dev/null || true'
|
||||
|
||||
ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \
|
||||
--rm \
|
||||
--name=matrix-synapse-reverse-proxy-companion \
|
||||
--log-driver=none \
|
||||
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
|
||||
--cap-drop=ALL \
|
||||
--read-only \
|
||||
--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_synapse_reverse_proxy_companion_tmp_directory_size_mb }}m \
|
||||
{% if matrix_synapse_reverse_proxy_companion_synapse_cache_enabled %}
|
||||
--tmpfs=/tmp/synapse-cache:rw,noexec,nosuid,size={{ matrix_synapse_reverse_proxy_companion_tmp_cache_directory_size_mb }}m\
|
||||
{% endif %}
|
||||
--network={{ matrix_synapse_reverse_proxy_companion_container_network }} \
|
||||
{% if matrix_synapse_reverse_proxy_companion_container_client_api_host_bind_port %}
|
||||
-p {{ matrix_synapse_reverse_proxy_companion_container_client_api_host_bind_port }}:8008 \
|
||||
{% endif %}
|
||||
{% if matrix_synapse_reverse_proxy_companion_container_federation_api_host_bind_port %}
|
||||
-p {{ matrix_synapse_reverse_proxy_companion_container_federation_api_host_bind_port }}:8048 \
|
||||
{% endif %}
|
||||
--mount type=bind,src={{ matrix_synapse_reverse_proxy_companion_base_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
|
||||
--mount type=bind,src={{ matrix_synapse_reverse_proxy_companion_confd_path }},dst=/etc/nginx/conf.d,ro \
|
||||
{{ matrix_synapse_reverse_proxy_companion_container_image }}
|
||||
|
||||
{% for network in matrix_synapse_reverse_proxy_companion_container_additional_networks %}
|
||||
ExecStartPost={{ devture_systemd_docker_base_host_command_sh }} -c 'attempt=0; while [ $attempt -le 29 ]; do attempt=$(( $attempt + 1 )); if [ "`docker inspect -f {{ '{{.State.Running}}' }} matrix-synapse-reverse-proxy-companion 2> /dev/null`" = "true" ]; then break; fi; sleep 1; done; {{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-synapse-reverse-proxy-companion'
|
||||
{% endfor %}
|
||||
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-synapse-reverse-proxy-companion 2>/dev/null || true'
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-reverse-proxy-companion 2>/dev/null || true'
|
||||
ExecReload={{ devture_systemd_docker_base_host_command_docker }} exec matrix-synapse-reverse-proxy-companion /usr/sbin/nginx -s reload
|
||||
Restart=always
|
||||
RestartSec=30
|
||||
SyslogIdentifier=matrix-synapse-reverse-proxy-companion
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Reference in New Issue
Block a user