#jinja2: lstrip_blocks: "True" {% macro render_nginx_status_location_block(addresses) %} {# Empty first line to make indentation prettier. #} location /nginx_status { stub_status on; access_log off; {% for address in addresses %} allow {{ address }}; {% endfor %} deny all; } {% endmacro %} {% macro render_vhost_directives() %} gzip on; gzip_types text/plain application/json; location /.well-known/matrix { root {{ matrix_static_files_base_path }}; {# A somewhat long expires value is used to prevent outages in case this is unreachable due to network failure or due to the base domain's server completely dying. #} expires 4h; default_type application/json; add_header Access-Control-Allow-Origin *; } {% if matrix_nginx_proxy_proxy_matrix_nginx_status_enabled %} {{ render_nginx_status_location_block(matrix_nginx_proxy_proxy_matrix_nginx_status_allowed_addresses) }} {% endif %} {% if matrix_nginx_proxy_proxy_matrix_corporal_api_enabled %} location /_matrix/corporal { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "{{ matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container }}"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container }}; {% endif %} proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% if matrix_nginx_proxy_proxy_matrix_identity_api_enabled %} location /_matrix/identity { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "{{ matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container }}"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container }}; {% endif %} proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% if matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled %} location /_matrix/client/r0/user_directory/search { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "{{ matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container }}"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container }}; {% endif %} proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% if matrix_nginx_proxy_proxy_matrix_3pid_registration_enabled %} location ~ ^/_matrix/client/r0/register/(email|msisdn)/requestToken$ { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "{{ matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container }}"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container }}; {% endif %} proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% if synchrotron_workers %} {# c.f. https://github.com/matrix-org/synapse/blame/master/docs/workers.md#L134 #} location /_matrix/client/r0/sync { proxy_pass http://synchrotron$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } location /_matrix/client/r0/events { proxy_pass http://synchrotron$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } location /_matrix/client/r0/initialSync { proxy_pass http://synchrotron$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } location ~ ^/_matrix/client/r0/rooms/[^/]+/initialSync$ { proxy_pass http://synchrotron$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% set client_reader_worker = matrix_synapse_workers_enabled_list|selectattr('worker', 'equalto', 'client_reader')|first %} {% if client_reader_worker %} {# c.f. https://github.com/matrix-org/synapse/blame/master/docs/workers.md#L252 #} location ^/_matrix/client/(versions$|(api/v1|r0|unstable)/(publicRooms$|rooms/.*/joined_me|rooms/.*/context/.|rooms/.*/members$|rooms/.*/messages$|rooms/.*/state$|login$|account/3pid$|keys/query$|keys/changes$|voip/turnServer$|joined_groups$|publicised_groups$|publicised_groups/|pushrules/.*$|groups/.*$|register$|auth/.*/fallback/web$)) { proxy_pass http://127.0.0.1:{{ client_reader_worker.port }}$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% set media_repository_worker = matrix_synapse_workers_enabled_list|selectattr('worker', 'equalto', 'media_repository')|first %} {% if media_repository_worker %} {# c.f. https://github.com/matrix-org/synapse/blame/master/docs/workers.md#L219 #} location /_matrix/media/ { proxy_pass http://127.0.0.1:{{ media_repository_worker.port }}$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {# c.f. https://github.com/matrix-org/synapse/blame/master/docs/workers.md#L223 #} location ~ ^/_synapse/admin/v1/(purge_media_cache|room/.*/media.*|user/.*/media.*|media/.*|quarantine_media/.*)$ { proxy_pass http://127.0.0.1:{{ media_repository_worker.port }}$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% set event_creator_worker = matrix_synapse_workers_enabled_list|selectattr('worker', 'equalto', 'event_creator')|first %} {% if event_creator_worker %} {# c.f. https://github.com/matrix-org/synapse/blame/master/docs/workers.md#L323 #} location ~ ^/_matrix/client/(api/v1|r0|unstable)/(rooms/.*/send|rooms/.*/state/|rooms/.*/(join|invite|leave|ban|unban|kick)$|join/|profile/) { proxy_pass http://127.0.0.1:{{ event_creator_worker.port }}$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% set frontend_proxy_worker = matrix_synapse_workers_enabled_list|selectattr('worker', 'equalto', 'frontend_proxy')|first %} {% if frontend_proxy_worker %} {# c.f. https://github.com/matrix-org/synapse/blame/master/docs/workers.md#L302 #} location ~ ^/_matrix/client/(api/v1|r0|unstable)/keys/upload { proxy_pass http://127.0.0.1:{{ frontend_proxy_worker.port }}$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% if not matrix_synapse_use_presence %} location ~ ^/_matrix/client/(api/v1|r0|unstable)/presence/[^/]+/status { proxy_pass http://127.0.0.1:{{ frontend_proxy_worker.port }}$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% endif %} {% set user_dir_worker = matrix_synapse_workers_enabled_list|selectattr('worker', 'equalto', 'user_dir')|first %} {% if user_dir_worker %} {# c.f. https://github.com/matrix-org/synapse/blame/master/docs/workers.md#L290 #} location ~ ^/_matrix/client/(api/v1|r0|unstable)/user_directory/search$ { proxy_pass http://127.0.0.1:{{ user_dir_worker.port }}$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} {% for configuration_block in matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks %} {{- configuration_block }} {% endfor %} {# This handles the Matrix Client API only. The Matrix Federation API is handled by a separate vhost. #} location /_matrix { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container }}"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container }}; {% endif %} proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; client_body_buffer_size 25M; client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb }}M; proxy_max_temp_file_size 0; } {% if matrix_nginx_proxy_proxy_synapse_metrics %} location /_synapse/metrics { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "{{ matrix_nginx_proxy_proxy_synapse_metrics_addr_with_container }}"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} proxy_pass http://{{ matrix_nginx_proxy_proxy_synapse_metrics_addr_sans_container }}; {% endif %} proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; {% if matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled %} auth_basic "protected"; auth_basic_user_file /nginx-data/matrix-synapse-metrics-htpasswd; {% endif %} } {% endif %} location /_synapse/admin { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container }}"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container }}; {% endif %} proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; client_body_buffer_size 25M; client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb }}M; proxy_max_temp_file_size 0; } location / { rewrite ^/$ /_matrix/static/ last; } {% endmacro %} {% set synchrotron_workers = matrix_synapse_workers_enabled_list|selectattr('worker', 'equalto', 'synchrotron')|list %} {% if synchrotron_workers %} upstream synchrotron { # ensures that requests from the same client will always be passed # to the same server (except when this server is unavailable) ip_hash; {% for worker in synchrotron_workers %} server 127.0.0.1:{{ worker.port }}; {% endfor %} } {% endif %} server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; server_name {{ matrix_nginx_proxy_proxy_matrix_hostname }}; server_tokens off; root /dev/null; {% if matrix_nginx_proxy_https_enabled %} location /.well-known/acme-challenge { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "matrix-certbot:8080"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }}; {% endif %} } {% if matrix_nginx_proxy_proxy_matrix_nginx_status_enabled %} {{ render_nginx_status_location_block(matrix_nginx_proxy_proxy_matrix_nginx_status_allowed_addresses) }} {% endif %} location / { return 301 https://$http_host$request_uri; } {% else %} {{ render_vhost_directives() }} {% endif %} } {% if matrix_nginx_proxy_https_enabled %} server { listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2; listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2; server_name {{ matrix_nginx_proxy_proxy_matrix_hostname }}; server_tokens off; root /dev/null; ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_matrix_hostname }}/fullchain.pem; ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_matrix_hostname }}/privkey.pem; ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }}; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; {{ render_vhost_directives() }} } {% endif %} {% if matrix_nginx_proxy_proxy_matrix_federation_api_enabled %} {# This federation vhost is a little special. It serves federation over HTTP or HTTPS, depending on `matrix_nginx_proxy_https_enabled`. #} server { {% if matrix_nginx_proxy_https_enabled %} listen 8448 ssl http2; listen [::]:8448 ssl http2; {% else %} listen 8448; {% endif %} server_name {{ matrix_nginx_proxy_proxy_matrix_hostname }}; server_tokens off; root /dev/null; gzip on; gzip_types text/plain application/json; {% if matrix_nginx_proxy_https_enabled %} ssl_certificate {{ matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate }}; ssl_certificate_key {{ matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key }}; ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }}; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; {% endif %} {% set federation_worker = matrix_synapse_workers_enabled_list|selectattr('worker', 'equalto', 'federation_reader')|first %} {% if federation_worker %} {# c.f. https://github.com/matrix-org/synapse/blame/master/docs/workers.md#L160 #} location ~ ^(/_matrix/federation/v1/event/|/_matrix/federation/v1/state/|/_matrix/federation/v1/state_ids/|/_matrix/federation/v1/backfill/|/_matrix/federation/v1/get_missing_events/|/_matrix/federation/v1/publicRooms|/_matrix/federation/v1/query/|/_matrix/federation/v1/make_join/|/_matrix/federation/v1/make_leave/|/_matrix/federation/v1/send_join/|/_matrix/federation/v2/send_join/|/_matrix/federation/v1/send_leave/|/_matrix/federation/v2/send_leave/|/_matrix/federation/v1/invite/|/_matrix/federation/v2/invite/|/_matrix/federation/v1/query_auth/|/_matrix/federation/v1/event_auth/|/_matrix/federation/v1/exchange_third_party_invite/|/_matrix/federation/v1/user/devices/|/_matrix/federation/v1/send/|/_matrix/federation/v1/get_groups_publicised$|/_matrix/key/v2/query|/_matrix/federation/v1/groups/) { proxy_pass http://127.0.0.1:{{ federation_worker.port }}$request_uri; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } {% endif %} location / { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "{{ matrix_nginx_proxy_proxy_matrix_federation_api_addr_with_container }}"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container }}; {% endif %} proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; client_body_buffer_size 25M; client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb }}M; proxy_max_temp_file_size 0; } } {% endif %}