From 15c9757027342c178978c484d858166a26e63844 Mon Sep 17 00:00:00 2001 From: Tommy Date: Fri, 8 Sep 2023 14:38:07 -0700 Subject: [PATCH] Synapse Unix socket --- README.md | 1 + etc/matrix-synapse/homeserver.yaml | 3 ++- etc/nginx/conf.d/synapse.conf | 2 +- etc/systemd/system/matrix-synapse.service.d/override.conf | 6 +++++- 4 files changed, 9 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 20c86b6..1ca7d6e 100644 --- a/README.md +++ b/README.md @@ -8,6 +8,7 @@ This configuration does not include some hardening configurations, as those are - A lot of these configuration files use ArcticFoxes's domain. If you are adopting this to your own system, make sure that you replace them. - The Certbot-OCSP-Fetcher script can be found [here](https://github.com/GrapheneOS/infrastructure/blob/main/certbot-ocsp-fetcher) - You need to create a `postgres-socket` and add the `postgres` and `matrix-synapse` user to it. +- You need to create a `matrix-synapse-socket` and add the `matrix-synapse` and `nginx` user to it. - Systemd overrides for NGINX and SSHD services are based on [GrapheneOS's configurations](https://github.com/GrapheneOS/infrastructure/tree/main/systemd/system). - Systemd override for Synapse is based on Arch Linux's [matrix-synapse](https://gitlab.archlinux.org/archlinux/packaging/packages/matrix-synapse/-/blob/main/override-hardened.conf?ref_type=heads) package. - The repolists of PostgreSQL and Docker have been modified so that they read GPG keys from `/usr/share/keyring` by default. Make sure that when you follow upstream's documentation on adding their GPG keys, you adjust the location. For PostgreSQL's GPG key, run `curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /usr/share/keyrings/postgresql-debian-repo.gpg >/dev/null` diff --git a/etc/matrix-synapse/homeserver.yaml b/etc/matrix-synapse/homeserver.yaml index 974b856..9af630d 100644 --- a/etc/matrix-synapse/homeserver.yaml +++ b/etc/matrix-synapse/homeserver.yaml @@ -14,7 +14,8 @@ # server_name: "SERVERNAME" pid_file: "/var/run/matrix-synapse.pid" listeners: - - port: 8008 + - path: /var/lib/matrix-synapse/matrix-synapse.sock + mode: 0660 tls: false type: http x_forwarded: true diff --git a/etc/nginx/conf.d/synapse.conf b/etc/nginx/conf.d/synapse.conf index d0bb4da..ca6ab1d 100644 --- a/etc/nginx/conf.d/synapse.conf +++ b/etc/nginx/conf.d/synapse.conf @@ -35,6 +35,6 @@ server { set $upstream_app 127.0.0.1; set $upstream_port 8008; set $upstream_proto http; - proxy_pass $upstream_proto://$upstream_app:$upstream_port; + proxy_pass http://unix:/var/lib/matrix-synapse/matrix-synapse.sock:; } } \ No newline at end of file diff --git a/etc/systemd/system/matrix-synapse.service.d/override.conf b/etc/systemd/system/matrix-synapse.service.d/override.conf index 4d6f520..7eeaf0e 100644 --- a/etc/systemd/system/matrix-synapse.service.d/override.conf +++ b/etc/systemd/system/matrix-synapse.service.d/override.conf @@ -1,4 +1,8 @@ [Service] +User=matrix-synapse +Group=matrix-synapse +ExecStartPost=/usr/bin/chgrp matrix-synapse-socket /var/lib/matrix-synapse/matrix-synapse.sock + # The following directives give the synapse service R/W access to: # - /var/lib/matrix-synapse # - /var/log/matrix-synapse @@ -26,4 +30,4 @@ PrivateDevices=true # - Hostname # - System Clock ProtectSystem=strict -ProtectKernelTunables=true +ProtectKernelTunables=true \ No newline at end of file