ArcticFoxes-net/Synapse-Ubuntu-ZFS
1
0
Fork 0
mirror of https://github.com/ArcticFoxes-net/Synapse-Ubuntu-ZFS synced 2024-12-21 23:31:34 -05:00
Code

Synapse Unix socket

Browse Source
This commit is contained in:
Tommy 2023-09-08 14:38:07 -07:00 committed by GitHub
parent 7d45a4b95d
commit 15c9757027
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
README.md
View File

@ -8,6 +8,7 @@ This configuration does not include some hardening configurations, as those are
- A lot of these configuration files use ArcticFoxes's domain. If you are adopting this to your own system, make sure that you replace them. - A lot of these configuration files use ArcticFoxes's domain. If you are adopting this to your own system, make sure that you replace them.
- The Certbot-OCSP-Fetcher script can be found [here](https://github.com/GrapheneOS/infrastructure/blob/main/certbot-ocsp-fetcher) - The Certbot-OCSP-Fetcher script can be found [here](https://github.com/GrapheneOS/infrastructure/blob/main/certbot-ocsp-fetcher)
- You need to create a `postgres-socket` and add the `postgres` and `matrix-synapse` user to it. - You need to create a `postgres-socket` and add the `postgres` and `matrix-synapse` user to it.
- You need to create a `matrix-synapse-socket` and add the `matrix-synapse` and `nginx` user to it.
- Systemd overrides for NGINX and SSHD services are based on [GrapheneOS's configurations](https://github.com/GrapheneOS/infrastructure/tree/main/systemd/system). - Systemd overrides for NGINX and SSHD services are based on [GrapheneOS's configurations](https://github.com/GrapheneOS/infrastructure/tree/main/systemd/system).
- Systemd override for Synapse is based on Arch Linux's [matrix-synapse](https://gitlab.archlinux.org/archlinux/packaging/packages/matrix-synapse/-/blob/main/override-hardened.conf?ref_type=heads) package. - Systemd override for Synapse is based on Arch Linux's [matrix-synapse](https://gitlab.archlinux.org/archlinux/packaging/packages/matrix-synapse/-/blob/main/override-hardened.conf?ref_type=heads) package.
- The repolists of PostgreSQL and Docker have been modified so that they read GPG keys from `/usr/share/keyring` by default. Make sure that when you follow upstream's documentation on adding their GPG keys, you adjust the location. For PostgreSQL's GPG key, run `curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /usr/share/keyrings/postgresql-debian-repo.gpg >/dev/null` - The repolists of PostgreSQL and Docker have been modified so that they read GPG keys from `/usr/share/keyring` by default. Make sure that when you follow upstream's documentation on adding their GPG keys, you adjust the location. For PostgreSQL's GPG key, run `curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /usr/share/keyrings/postgresql-debian-repo.gpg >/dev/null`

3
etc/matrix-synapse/homeserver.yaml
View File

@ -14,7 +14,8 @@
# server_name: "SERVERNAME" # server_name: "SERVERNAME"
pid_file: "/var/run/matrix-synapse.pid" pid_file: "/var/run/matrix-synapse.pid"
listeners: listeners:
- port: 8008 - path: /var/lib/matrix-synapse/matrix-synapse.sock
mode: 0660
tls: false tls: false
type: http type: http
x_forwarded: true x_forwarded: true

2
etc/nginx/conf.d/synapse.conf
View File

@ -35,6 +35,6 @@ server {
set $upstream_app 127.0.0.1; set $upstream_app 127.0.0.1;
set $upstream_port 8008; set $upstream_port 8008;
set $upstream_proto http; set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port; proxy_pass http://unix:/var/lib/matrix-synapse/matrix-synapse.sock:;
} }
} }

6
etc/systemd/system/matrix-synapse.service.d/override.conf
View File

@ -1,4 +1,8 @@
[Service] [Service]
User=matrix-synapse
Group=matrix-synapse
ExecStartPost=/usr/bin/chgrp matrix-synapse-socket /var/lib/matrix-synapse/matrix-synapse.sock
# The following directives give the synapse service R/W access to: # The following directives give the synapse service R/W access to:
# - /var/lib/matrix-synapse # - /var/lib/matrix-synapse
# - /var/log/matrix-synapse # - /var/log/matrix-synapse
@ -26,4 +30,4 @@ PrivateDevices=true
# - Hostname # - Hostname
# - System Clock # - System Clock
ProtectSystem=strict ProtectSystem=strict
ProtectKernelTunables=true ProtectKernelTunables=true