11# Synapse reverse proxy including .well-known/matrix/client
2+ # domain synapse.m.localhost
23server {
34 listen 80;
45 listen [::]:80;
@@ -26,21 +27,61 @@ server {
2627 # This is also required for development environment.
2728 # Reason: the lk-jwt-service uses the federation API for the openid token
2829 # verification, which requires TLS
29- location / {
30- proxy_pass "http://homeserver:8008";
30+ location ~ ^(/_matrix|/_synapse/client) {
31+ proxy_pass "http://homeserver:8008";
3132 proxy_http_version 1.1;
32- proxy_set_header Upgrade $http_upgrade;
33- proxy_set_header Connection "upgrade";
34- proxy_set_header Host $host;
3533 proxy_set_header X-Forwarded-For $remote_addr;
3634 proxy_set_header X-Forwarded-Proto $scheme;
35+ proxy_set_header Host $host;
36+ }
37+
38+ error_page 500 502 503 504 /50x.html;
39+
40+ }
41+
42+ # Synapse reverse proxy including .well-known/matrix/client
43+ # domain synapse.othersite.m.localhost
44+ server {
45+ listen 80;
46+ listen [::]:80;
47+ listen 443 ssl;
48+ listen 8448 ssl;
49+ listen [::]:443 ssl;
50+ listen [::]:8448 ssl;
51+ server_name synapse.othersite.m.localhost;
52+ ssl_certificate /root/ssl/cert.pem;
53+ ssl_certificate_key /root/ssl/key.pem;
54+
55+ # well-known config adding rtc_foci backend
56+ # Note well-known is currently not effective due to:
57+ # https://spec.matrix.org/v1.12/client-server-api/#well-known-uri the spec
58+ # says it must be at https://$server_name/... (implied port 443) Hence, we
59+ # currently rely for local development environment on deprecated config.json
60+ # setting for livekit_service_url
61+ location /.well-known/matrix/client {
62+ add_header Access-Control-Allow-Origin *;
63+ return 200 '{"m.homeserver": {"base_url": "https://synapse.othersite.m.localhost"}, "org.matrix.msc4143.rtc_foci": [{"type": "livekit", "livekit_service_url": "https://matrix-rtc.othersite.m.localhost/livekit/jwt"}]}';
64+ default_type application/json;
65+ }
66+
67+ # Reverse proxy for Matrix Synapse Homeserver
68+ # This is also required for development environment.
69+ # Reason: the lk-jwt-service uses the federation API for the openid token
70+ # verification, which requires TLS
71+ location ~ ^(/_matrix|/_synapse/client) {
72+ proxy_pass "http://homeserver-1:18008";
73+ proxy_http_version 1.1;
74+ proxy_set_header X-Forwarded-For $remote_addr;
75+ proxy_set_header X-Forwarded-Proto $scheme;
76+ proxy_set_header Host $host;
3777 }
3878
3979 error_page 500 502 503 504 /50x.html;
4080
4181}
4282
4383# MatrixRTC reverse proxy
84+ # domain matrix-rtc.m.localhost
4485# - MatrixRTC Authorization Service
4586# - LiveKit SFU websocket signaling connection
4687upstream jwt-auth-services {
@@ -49,12 +90,8 @@ upstream jwt-auth-services {
4990}
5091
5192server {
52- listen 80;
53- listen [::]:80;
5493 listen 443 ssl;
5594 listen [::]:443 ssl;
56- listen 8448 ssl;
57- listen [::]:8448 ssl;
5895 server_name matrix-rtc.m.localhost;
5996 ssl_certificate /root/ssl/cert.pem;
6097 ssl_certificate_key /root/ssl/key.pem;
@@ -96,6 +133,54 @@ server {
96133
97134}
98135
136+ # MatrixRTC reverse proxy
137+ # domain matrix-rtc.othersite.m.localhost
138+ # - MatrixRTC Authorization Service
139+ # - LiveKit SFU websocket signaling connection
140+ server {
141+ listen 443 ssl;
142+ listen [::]:443 ssl;
143+ server_name matrix-rtc.othersite.m.localhost;
144+ ssl_certificate /root/ssl/cert.pem;
145+ ssl_certificate_key /root/ssl/key.pem;
146+
147+ http2 on;
148+
149+
150+ location ^~ /livekit/jwt/ {
151+
152+ proxy_set_header Host $host;
153+ proxy_set_header X-Real-IP $remote_addr;
154+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
155+ proxy_set_header X-Forwarded-Proto $scheme;
156+
157+ # JWT Service running at port 16080
158+ proxy_pass http://auth-service-1:16080/;
159+
160+ }
161+
162+ location ^~ /livekit/sfu/ {
163+ proxy_set_header Host $host;
164+ proxy_set_header X-Real-IP $remote_addr;
165+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
166+ proxy_set_header X-Forwarded-Proto $scheme;
167+
168+ proxy_send_timeout 120;
169+ proxy_read_timeout 120;
170+ proxy_buffering off;
171+
172+ proxy_set_header Accept-Encoding gzip;
173+ proxy_set_header Upgrade $http_upgrade;
174+ proxy_set_header Connection "upgrade";
175+
176+ # LiveKit SFU websocket connection running at port 17880
177+ proxy_pass http://livekit-sfu-1:17880/;
178+ }
179+
180+ error_page 500 502 503 504 /50x.html;
181+
182+ }
183+
99184# Convenience reverse proxy for the call.m.localhost domain to yarn dev --host
100185server {
101186 listen 80;
@@ -161,3 +246,36 @@ server {
161246 error_page 500 502 503 504 /50x.html;
162247
163248}
249+
250+ # Convenience reverse proxy app.othersite.m.localhost for element web
251+ server {
252+ listen 80;
253+ listen [::]:80;
254+ server_name app.othersite.m.localhost;
255+
256+ return 301 https://$host$request_uri;
257+ }
258+
259+ server {
260+ listen 443 ssl;
261+ listen [::]:443 ssl;
262+ server_name app.othersite.m.localhost;
263+ ssl_certificate /root/ssl/cert.pem;
264+ ssl_certificate_key /root/ssl/key.pem;
265+
266+
267+ location ^~ / {
268+
269+ proxy_set_header Host $host;
270+ proxy_set_header X-Real-IP $remote_addr;
271+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
272+ proxy_set_header X-Forwarded-Proto $scheme;
273+
274+ proxy_pass http://element-web-1:18081;
275+ proxy_ssl_verify off;
276+
277+ }
278+
279+ error_page 500 502 503 504 /50x.html;
280+
281+ }
0 commit comments