From 724373b12358664dd226a658ed2ff4c7f9d21d6c Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Mon, 27 Feb 2023 14:59:36 +0100 Subject: [PATCH 1/6] add nginx to list of own webserver example configs --- docs/configuring-playbook-own-webserver.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md index ff9d2c93..35c22b35 100644 --- a/docs/configuring-playbook-own-webserver.md +++ b/docs/configuring-playbook-own-webserver.md @@ -232,4 +232,4 @@ Some of these services are configured with certain default expecations with rega For each new playbook service that you enable, you'll need special handling. -The [`examples/`](../examples/) directory contains examples for various servers: Caddy, Apache, HAproxy, etc. +The [`examples/`](../examples/) directory contains examples for various servers: Caddy, Apache, HAproxy, Nginx, etc. From 8dacdb038b67dc41711bf72648f749a106c550e6 Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Mon, 27 Feb 2023 15:34:37 +0100 Subject: [PATCH 2/6] add: nginx example conf + readme for fronting playbooks traefik with own nginx --- examples/nginx/README.md | 32 +++++++++++++ examples/nginx/matrix.conf | 96 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 128 insertions(+) create mode 100644 examples/nginx/README.md create mode 100644 examples/nginx/matrix.conf diff --git a/examples/nginx/README.md b/examples/nginx/README.md new file mode 100644 index 00000000..d2d2a6ce --- /dev/null +++ b/examples/nginx/README.md @@ -0,0 +1,32 @@ +# Nginx reverse-proxy fronting playbook's Traefik + +This directory contains a sample config that show you how to do reverse-proxying using Nginx and the playbook's internal traefik container. + +This is for when you wish to front the playbook's integrated traefik container with a self-managed Nginx reverse-proxy running on the same server. +See the [Using your own webserver, instead of this playbook's nginx proxy & Fronting the integrated reverse-proxy webserver with another reverse-proxy](../../docs/configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) documentation page and follow the instructions for the playbook's configuration (`inventory/host_vars/matrix./vars.yml`). + +That is this part: +**For Traefik** fronted by another reverse-proxy, you would need some configuration like this: + +```yaml +matrix_playbook_reverse_proxy_type: playbook-managed-traefik + +# Ensure that public urls use https +matrix_playbook_ssl_enabled: true + +# Disable the web-secure (port 443) endpoint, which also disables SSL certificate retrieval +devture_traefik_config_entrypoint_web_secure_enabled: false + +devture_traefik_container_web_host_bind_port: '127.0.0.1:81' + +devture_traefik_additional_entrypoints_auto: + - name: matrix-federation + port: 8449 + host_bind_port: '127.0.0.1:8449' + config: {} +``` + +**NOTE**: +- that this also disables SSL certificate retrieval, which then has to be done manually (e.g. by using certbot and setting the appropriate path as found in [the example nginx configuration file](./matrix.conf)). For the example nginx config one certificate is used that contains all the used subdomains. +- that [the example nginx configuration file](./matrix.conf) has to be adapted to whatever services you are using. For example, remove element.domain.com from the `server_name` list if you don't use Element web client or add dimension.domain.com to it if you do use Dimension. +- that this is just an example and may not be entirely accurate. It may also not cover other use cases (enabling various services or bridges requires additional reverse-proxying configuration). diff --git a/examples/nginx/matrix.conf b/examples/nginx/matrix.conf new file mode 100644 index 00000000..366a8a8e --- /dev/null +++ b/examples/nginx/matrix.conf @@ -0,0 +1,96 @@ +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + # TODO: add/remove services and their subdomains if you use/don't use them + # this example is using hosting something on the base domain and an element web client, so example.com and element.example.com are listed in addition to matrix.example.com + # if you don't use those, you can remove them + # if you use e.g. dimension on dimension.example.com, add dimension.example.com to the server_name list + server_name example.com matrix.example.com element.example.com; + + location / { + # note: do not add a path (even a single /) after the port in `proxy_pass`, + # otherwise, nginx will canonicalise the URI and cause signature verification + # errors. + proxy_pass http://localhost:81; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + + access_log /var/log/nginx/matrix.access.log; + error_log /var/log/nginx/matrix.error.log; + + # Nginx by default only allows file uploads up to 1M in size + # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml + client_max_body_size 50M; + } + + # TODO: adapt the path to your ssl certificate for the domains listed on server_name + ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot + # TODO: adapt the path to your ssl certificate for the domains listed on server_name + ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot +} + +# settings for matrix federation +server { + # For the federation port + listen 8448 ssl http2 default_server; + listen [::]:8448 ssl http2 default_server; + + server_name matrix.example.com; + + location / { + proxy_pass http://localhost:8449; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $host; + + access_log /var/log/nginx/matrix.access.log; + error_log /var/log/nginx/matrix.error.log; + + # Nginx by default only allows file uploads up to 1M in size + # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml + client_max_body_size 50M; + } + # TODO: adapt the path to your ssl certificate for the domains listed on server_name + ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot + # TODO: adapt the path to your ssl certificate for the domains listed on server_name + ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot +} + +# ensure using https +# TODO: remove server blocks that you don't use / add server blocks for domains you do use +server { + if ($host = example.com) { + return 301 https://$host$request_uri; + } # managed by Certbot + + server_name example.com; + listen 80; + return 404; # managed by Certbot +} + +server { + if ($host = matrix.example.com) { + return 301 https://$host$request_uri; + } # managed by Certbot + + server_name matrix.example.com; + listen 80; + return 404; # managed by Certbot +} + +server { + if ($host = element.example.com) { + return 301 https://$host$request_uri; + } # managed by Certbot + + server_name element.example.com; + listen 80; + return 404; # managed by Certbot +} \ No newline at end of file From 89b9fca85cbe88673cf9ff63bce5656be6393ca6 Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Mon, 27 Feb 2023 15:51:04 +0100 Subject: [PATCH 3/6] remove duplicate of playbook config instructions --- examples/nginx/README.md | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/examples/nginx/README.md b/examples/nginx/README.md index d2d2a6ce..038b060e 100644 --- a/examples/nginx/README.md +++ b/examples/nginx/README.md @@ -5,27 +5,6 @@ This directory contains a sample config that show you how to do reverse-proxying This is for when you wish to front the playbook's integrated traefik container with a self-managed Nginx reverse-proxy running on the same server. See the [Using your own webserver, instead of this playbook's nginx proxy & Fronting the integrated reverse-proxy webserver with another reverse-proxy](../../docs/configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) documentation page and follow the instructions for the playbook's configuration (`inventory/host_vars/matrix./vars.yml`). -That is this part: -**For Traefik** fronted by another reverse-proxy, you would need some configuration like this: - -```yaml -matrix_playbook_reverse_proxy_type: playbook-managed-traefik - -# Ensure that public urls use https -matrix_playbook_ssl_enabled: true - -# Disable the web-secure (port 443) endpoint, which also disables SSL certificate retrieval -devture_traefik_config_entrypoint_web_secure_enabled: false - -devture_traefik_container_web_host_bind_port: '127.0.0.1:81' - -devture_traefik_additional_entrypoints_auto: - - name: matrix-federation - port: 8449 - host_bind_port: '127.0.0.1:8449' - config: {} -``` - **NOTE**: - that this also disables SSL certificate retrieval, which then has to be done manually (e.g. by using certbot and setting the appropriate path as found in [the example nginx configuration file](./matrix.conf)). For the example nginx config one certificate is used that contains all the used subdomains. - that [the example nginx configuration file](./matrix.conf) has to be adapted to whatever services you are using. For example, remove element.domain.com from the `server_name` list if you don't use Element web client or add dimension.domain.com to it if you do use Dimension. From 84e6677bc0fcbde82a91db920b9a0af84b0566c8 Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Mon, 27 Feb 2023 15:56:34 +0100 Subject: [PATCH 4/6] in own webserver doc link to nginx fronting traefik example --- docs/configuring-playbook-own-webserver.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md index 35c22b35..cae1486e 100644 --- a/docs/configuring-playbook-own-webserver.md +++ b/docs/configuring-playbook-own-webserver.md @@ -143,6 +143,8 @@ devture_traefik_additional_entrypoints_auto: config: {} ``` +For an example where the playbook's traefik is fronted by Nginx running on the same server, see [Nginx reverse-proxy fronting playbook's Traefik](../examples/nginx/README.md). + (Deprecated) **For `matrix-nginx-proxy`** fronted by another reverse-proxy, you would need some configuration like this: ```yaml From 91660f7433867b0ea4d1165c53d76b05e4d4387a Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 27 Feb 2023 17:45:28 +0200 Subject: [PATCH 5/6] Improve wordng in examples/nginx/README.md --- examples/nginx/README.md | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/examples/nginx/README.md b/examples/nginx/README.md index 038b060e..f9be21fd 100644 --- a/examples/nginx/README.md +++ b/examples/nginx/README.md @@ -1,11 +1,17 @@ -# Nginx reverse-proxy fronting playbook's Traefik +# Nginx reverse-proxy fronting the playbook's integrated Traefik reverse-proxy -This directory contains a sample config that show you how to do reverse-proxying using Nginx and the playbook's internal traefik container. +This directory contains a sample config that shows you how use the [nginx](https://nginx.org/) webserver to front the integrated [Traefik](https://traefik.io/) reverse-proxy webserver with another reverse-proxy. -This is for when you wish to front the playbook's integrated traefik container with a self-managed Nginx reverse-proxy running on the same server. -See the [Using your own webserver, instead of this playbook's nginx proxy & Fronting the integrated reverse-proxy webserver with another reverse-proxy](../../docs/configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) documentation page and follow the instructions for the playbook's configuration (`inventory/host_vars/matrix./vars.yml`). -**NOTE**: -- that this also disables SSL certificate retrieval, which then has to be done manually (e.g. by using certbot and setting the appropriate path as found in [the example nginx configuration file](./matrix.conf)). For the example nginx config one certificate is used that contains all the used subdomains. -- that [the example nginx configuration file](./matrix.conf) has to be adapted to whatever services you are using. For example, remove element.domain.com from the `server_name` list if you don't use Element web client or add dimension.domain.com to it if you do use Dimension. -- that this is just an example and may not be entirely accurate. It may also not cover other use cases (enabling various services or bridges requires additional reverse-proxying configuration). +## Prerequisite configuration + +To get started, first follow the [front the integrated reverse-proxy webserver with another reverse-proxy](../../docs/configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instructions and update your playbook's configuration (`inventory/host_vars/matrix./vars.yml`). + + +## Using the nginx configuration + +Copy the [matrix.conf](matrix.conf) file to your nginx server's filesystem, modify it to your needs and include it your nginx configuration (e.g. `include /path/to/matrix.conf;`). + +This configuration **disables SSL certificate retrieval**, so you will **need to obtain SSL certificates manually** (e.g. by using [certbot](https://certbot.eff.org/)) and set the appropriate path in `matrix.conf`. In the example nginx configuration, a single certificate is used for all subdomains (`matrix.DOMAIN`, `element.DOMAIN`, etc.). For your setup, may wish to change this and use separate `server` blocks and separate certificate files for each host. + +Also note that your copy of the `matrix.conf` file has to be adapted to whatever services you are using. For example, remove `element.domain.com` from the `server_name` list if you don't use [Element](../../docs/configuring-playbook-client-element.md) web client or add `dimension.domain.com` to it if you do use the [Dimension](../../docs/configuring-playbook-dimension.md) integration manager. From faa074f7af4ca4b5fa86122a38a303ab50e3cf57 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 27 Feb 2023 17:47:19 +0200 Subject: [PATCH 6/6] Improve wording --- docs/configuring-playbook-own-webserver.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md index cae1486e..81b154e2 100644 --- a/docs/configuring-playbook-own-webserver.md +++ b/docs/configuring-playbook-own-webserver.md @@ -143,7 +143,7 @@ devture_traefik_additional_entrypoints_auto: config: {} ``` -For an example where the playbook's traefik is fronted by Nginx running on the same server, see [Nginx reverse-proxy fronting playbook's Traefik](../examples/nginx/README.md). +For an example where the playbook's Traefik reverse-proxy is fronted by [Nginx](https://nginx.org/) running on the same server, see [Nginx reverse-proxy fronting the playbook's Traefik](../examples/nginx/README.md). (Deprecated) **For `matrix-nginx-proxy`** fronted by another reverse-proxy, you would need some configuration like this: