Opened 18 months ago

Closed 7 months ago

#2309 closed task (fixed)

Provide a Matrix homeserver

Reported by: strk Owned by: robe
Priority: normal Milestone:
Component: Systems Admin Keywords:
Cc:

Description

This ticket is to request a matrix homeserver for OSGeo. It could be https://matrix.osgeo.org and allow access via LDAP authentication. It could host existing matrix channels (would be mirroring them). See https://wiki.osgeo.org/wiki/Matrix

Change History (29)

comment:1 Changed 18 months ago by strk

Matrix reference homeserver (synapse) went 1.0 yesterday: https://matrix.org/blog/2019/06/11/introducing-matrix-1-0-and-the-matrix-org-foundation

comment:2 Changed 14 months ago by robe

Once we resetup osgeo3 maybe we can think about putting matrix there.

comment:3 Changed 8 months ago by robe

notes from #2432

Container created

strk -- let me know if you need more

goes thru hop.osgeo3.osgeo.org

added to https://wiki.osgeo.org/wiki/SAC_Service_Status#osgeo3

Last edited 8 months ago by robe (previous) (diff)

comment:4 Changed 8 months ago by robe

I still need to create an nginx entry for it but not sure what port it goes thru so will wait off on that.

comment:5 Changed 8 months ago by strk

Instructions about how to set it up: https://matrix.org/docs/guides/installing-synapse Regina: I'd need powers on that host

comment:6 Changed 8 months ago by strk

It looks like I do have powers already, will see if I find the time to move this on

comment:7 Changed 8 months ago by strk

I think it would be a good idea to start using ansible for deployment. There's an available "ansible playbook" to deploy a matrix server, which we could fork in a private Gitea repository to tweak to our needs: https://github.com/spantaleev/matrix-docker-ansible-deploy

comment:8 Changed 8 months ago by strk

Synapse is now installed, we'll want to proxy port 8008 of that host enabling HTTPS. How secure would the connection from the LXC host to the proxy ? Should the proxy be on osgeo3 ? Does it make sense to have synapse itself use https (I think it does not)

comment:9 Changed 8 months ago by strk

LDAP is also configured

comment:10 Changed 8 months ago by strk

So, what we need as the next step, is having osgeo.org TCP port 8448 provide HTTPS proxy to the matrix LXC host. Either that, or have osgeo.org:80/443 expose a .well-known/ file to redirect to another hostname which holds the proxy. If there's no difference in traffic I'd take the first solution...

comment:11 Changed 8 months ago by strk

.well-known can be hanlded by osgeo7-nginx with something like this:

location = /.well-known/matrix/server {
            add_header Content-Type application/json;
            return 200 '{\n  "m.server": "ACTUAL_SERVER"\n}';
}

location = /.well-known/matrix/client {
    add_header Access-Control-Allow-Origin *;
    add_header Content-Type application/json;
    return 200 '{\n  "m.homeserver": {\n    "base_url": "ACTUAL_SERVER"\n  }\n}';
}

But we'll still need the ACTUAL_SERVER to have a name, so how about matrix.osgeo.org to point to osgeo3 IP ?

comment:12 Changed 8 months ago by robe

you mean osgeo3 right?

comment:13 Changed 8 months ago by robe

strk - I have matrix.osgeo.org registered on osgeo3-nginx and with ssl cert. Have it proxied to matrix.lxd: 8008 but I see nothing

comment:14 Changed 8 months ago by strk

Fixed, the server was configured to only listen on loopback interface... Next we need the federation setup. Testing tool: https://federationtester.matrix.org/ Instructions for federation: https://github.com/matrix-org/synapse/blob/master/docs/federate.md

comment:15 Changed 8 months ago by strk

Performance thing to tweak: we need to expose HTTP2 support, to reduce number of requests from clients to the server. Right now, with HTTP1, my client (weechat-matrix) is making 1 request per second (Regina's is being lighter, what client is that @robe ?)

comment:16 Changed 8 months ago by strk

HTTP2 support enabled. Next I guess we want PostgreSQL database (currently using sqlite3 instead)

comment:17 Changed 8 months ago by strk

Regina, can you do the PostgreSQL setup ?

comment:18 Changed 8 months ago by robe

Sure version 12? or any issues with using 12? I'll install on the matrix container to keep self-contained.

comment:19 Changed 8 months ago by strk

Version 12 should be fine, thanks

comment:20 Changed 8 months ago by strk

I did setup federation, meanwhile (via well-known)

comment:21 Changed 8 months ago by strk

We need to remember to document this before closing the ticket. I've tested you can now use any Matrix client and authenticate with username @USER:osgeo.org and your LDAP password as a password. Feels good !

comment:22 Changed 8 months ago by robe

strk I have documented what I did to update Matrix here - can you please add whatever you installed to that doc?

https://git.osgeo.org/gitea/sac/osgeo3/wiki/matrix-container

Maybe sometime we can explore together using ansible. Right now my mind is not ready to learn new things or at least not by myself.

comment:23 Changed 8 months ago by strk

I created a wiki page about the setup: https://wiki.osgeo.org/wiki/SAC:MatrixSynapse

And... the homeserver configuration I pushed on https://git.osgeo.org/gitea/sac/matrix-synapse-config

comment:24 Changed 8 months ago by strk

Regina: reading https://git.osgeo.org/gitea/sac/osgeo3/wiki/matrix-container (now edited by me) I realized that https://git.osgeo.org/gitea/sac/osgeo3 includes /etc/nginx from osgeo3-nginx, should it then also include /etc/matrix-synapse from osgeo3-matrix, instead of having its own (as I created) https://git.osgeo.org/gitea/sac/matrix-synapse-config ?

I'm a bit concerned about the exponential complexity all of this is building... (ansible may be a possible answer)

comment:25 Changed 8 months ago by strk

I've installed PostgreSQL-11 on the matrix container, from official debian package repository. Did not do the database migration though, not yet. I've updated the https://git.osgeo.org/gitea/sac/osgeo3/wiki/matrix-container page accordingly.

comment:26 Changed 8 months ago by strk

DB in place now, cluster is within the matrix container. Only issue left is the IRC bridge issue, which may be just an issue for me and robe (the only current users)

comment:27 Changed 8 months ago by strk

The IRC Bridge issue could have been caused by this bug in the Bridge software: https://github.com/matrix-org/matrix-appservice-irc/pull/1024 (so unrelated to our setup)

What's left on OUR side would be:

comment:28 Changed 8 months ago by robe

I have it set to snapshot daily. I set the ram max to 8GB/ but left it at the 8 cpus. We can reduce if needed

comment:29 Changed 7 months ago by robe

Resolution: fixed
Status: assignedclosed

I'm going to close this out since we have it running and I'm actively using it - any additional tickets probably should be done for all containers (e.g. monitoring)

Note: See TracTickets for help on using tickets.