diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md index 0b10902e..885f24a9 100644 --- a/docs/configuring-playbook-own-webserver.md +++ b/docs/configuring-playbook-own-webserver.md @@ -32,69 +32,69 @@ matrix_nginx_proxy_enabled: false 1. Create a new apache configuration file named 000-matrix-ssl.conf and enable it. - # Auto redirect http to https - - ServerName matrix.DOMAIN - Redirect permanent / https://matrix.DOMAIN/ - + # Auto redirect http to https + + ServerName matrix.DOMAIN + Redirect permanent / https://matrix.DOMAIN/ + - - ServerName matrix.DOMAIN + + ServerName matrix.DOMAIN - SSLEngine On - SSLCertificateFile /etc/letsencrypt/live/DOMAIN/fullchain.pem - SSLCertificateKeyFile /etc/letsencrypt/live/DOMAIN/privkey.pem + SSLEngine On + SSLCertificateFile /etc/letsencrypt/live/DOMAIN/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/DOMAIN/privkey.pem - SSLProxyEngine on - SSLProxyProtocol +TLSv1.1 +TLSv1.2 - SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH - - ProxyPreserveHost On - ProxyRequests Off - ProxyVia On - # Keep /.well-known/matrix/client and /_matrix/identity free for different proxy/location - ProxyPassMatch ^/.well-known/matrix/client ! - ProxyPassMatch ^/_matrix/identity ! - # Proxy all 443 traffic to the synapse matrix client api - ProxyPass / http://localhost:8008/ - ProxyPassReverse / http://localhost:8008/ + SSLProxyEngine on + SSLProxyProtocol +TLSv1.1 +TLSv1.2 + SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH + + ProxyPreserveHost On + ProxyRequests Off + ProxyVia On + # Keep /.well-known/matrix/client and /_matrix/identity free for different proxy/location + ProxyPassMatch ^/.well-known/matrix/client ! + ProxyPassMatch ^/_matrix/identity ! + # Proxy all 443 traffic to the synapse matrix client api + ProxyPass / http://localhost:8008/ + ProxyPassReverse / http://localhost:8008/ - # Map /.well-known/matrix/client for client discovery - Alias /.well-known/matrix/client /matrix/static-files/.well-known/matrix/client - - Require all granted - - - Header always set Content-Type "application/json" - Header always set Access-Control-Allow-Origin "*" - - - AllowOverride All - # Apache 2.4: - Require all granted - # Or for Apache 2.2: - #order allow,deny - - - # Map /_matrix/identity to the identity server - - ProxyPass http://localhost:8090/_matrix/identity - + # Map /.well-known/matrix/client for client discovery + Alias /.well-known/matrix/client /matrix/static-files/.well-known/matrix/client + + Require all granted + + + Header always set Content-Type "application/json" + Header always set Access-Control-Allow-Origin "*" + + + AllowOverride All + # Apache 2.4: + Require all granted + # Or for Apache 2.2: + #order allow,deny + + + # Map /_matrix/identity to the identity server + + ProxyPass http://localhost:8090/_matrix/identity + - ErrorLog ${APACHE_LOG_DIR}/synapse-error.log - CustomLog ${APACHE_LOG_DIR}/synapse-access.log combined - + ErrorLog ${APACHE_LOG_DIR}/synapse-error.log + CustomLog ${APACHE_LOG_DIR}/synapse-access.log combined + 2. Enable required apache2 modules - a2enmod proxy - a2enmod proxy_http - a2enmod proxy_connect - a2enmod proxy_html - a2enmod headers + a2enmod proxy + a2enmod proxy_http + a2enmod proxy_connect + a2enmod proxy_html + a2enmod headers 3. Reload apache - systemctl restart apache2 + systemctl restart apache2 Notes: port 8448 does not get proxied and is left available for the homeserver federation api.