6.1 Matrix Synapse Server

• Docker installation
• Create Configuration File
• Homeserver.yaml
• Caddy File
• Users

Docker installation

This docker compose file is inspired by the docker compose file created by Jims Garage at Gitea Synapse Jims Garage

Since, I use a centralised caddy reverse proxy plugin for OPNSense I commented out the Traefik labels and the proxy network. 

services:
  synapse:
    container_name: synapse
    image: docker.io/matrixdotorg/synapse:latest
    # Since synapse does not retry to connect to the database, restart upon
    # failure
    restart: unless-stopped
    # See the readme for a full documentation of the environment settings
    environment:
    # config file location - be sure to create one first!
    # https://github.com/matrix-org/synapse/tree/develop/docker#generating-a-configuration-file
      - SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
      - UID=1000
      - GID=1000
    volumes:
      # You may either store all the files in a local folder
      - /home/dpasn/matrix/synapse/data:/data
      # .. or you may split this between different storage points
      # - ./files:/data
      # - /path/to/ssd:/data/uploads
      # - /path/to/large_hdd:/data/media
    depends_on:
    # We're going to use an external database as it's more performant for multiple
    # users
      - synapse-db
    networks:
        synapse:
#        proxy:
    # Uncomment if not using a proxy. In order to expose Synapse, remove one of the following, 
    # you might for instance expose the TLS port directly:
    ports:
      - 8448:8448/tcp
      - 8008:8008/tcp

    # ... or use a reverse proxy, here is an example for traefik:
#    labels:
#      - "traefik.enable=true"
#      - "traefik.http.routers.synapse.entrypoints=http"
#      - "traefik.http.routers.synapse.rule=Host(`matrix.yourdomain.com`)"
#      - "traefik.http.middlewares.synapse-https-redirect.redirectscheme.scheme=https"
#      - "traefik.http.routers.synapse.middlewares=synapse-https-redirect"
#      - "traefik.http.routers.synapse-secure.entrypoints=https"
#      - "traefik.http.routers.synapse-secure.rule=Host(`matrix.yourdomain.com`)"
#      - "traefik.http.routers.synapse-secure.tls=true"
#      - "traefik.http.routers.synapse-secure.service=synapse"
#      - "traefik.http.services.synapse.loadbalancer.server.port=8008"
#      - "traefik.docker.network=proxy"
        
  synapse-db:
    image: docker.io/postgres:15-alpine
    container_name: synapse-db
    restart: unless-stopped
    # Change password below, of course!
    environment:
      - POSTGRES_USER=synapse_user
      - POSTGRES_PASSWORD=skjsdf9834jf3j9j4598t3498j3908fn983yv3 # CHANGE ME!
      - POSTGRES_DB=synapse
      # ensure the database gets created correctly
      # https://github.com/matrix-org/synapse/blob/master/docs/postgres.md#set-up-database
      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
    volumes:
      # You may store the database tables in a local folder..
      - /home/dpasn/matrix/synapse/data_db:/var/lib/postgresql/data
      # .. or store them on some high performance storage for better results
      # - /path/to/ssd/storage:/var/lib/postgresql/data
    ports:
      - 5432:5432
    networks:
       synapse:

networks:
  synapse:
#  proxy:
#    external: true

Create Configuration File

docker run -it --rm \
  -v $(pwd)/data:/data \
  -e SYNAPSE_SERVER_NAME=example.com \
  -e SYNAPSE_REPORT_STATS=no \
  matrixdotorg/synapse:latest generate

You can call the folder where the configuration files are stored in as you like. In my case I simply call it data

After you have generated the files you need to make sure that you change the ownership again to your user and group with UID=1000 and GID=1000. Normally it is set by default to 991. In our docker compose file we set it to 1000 and hence we need to adjust this. We choose 1000 since it is than easier for you as user to have the right permissions to create and access files regarding your synapse instance. 

Homeserver.yaml

# DO NOT USE THIS CONFIGURATION FILE FOR PRODUCTION

server_name: "dgroningen.org"
public_baseurl: "https://matrix.dgroningen.org/"

pid_file: /data/homeserver.pid
listeners:
  - port: 8008
    tls: false
    type: http
    x_forwarded: true
    resources:
      - names: [client, federation]
        compress: false
database:
 name: psycopg2
 args:
   user: synapse_user
   password: skjsdf9834jf3j9j4598t3498j3908fn983yv3
   database: synapse
   host: synapse-db
   cp_min: 5
   cp_max: 10
log_config: "/data/matrix.yourdomain.com.log.config"
media_store_path: /data/media_store
registration_shared_secret: "YRGKetN~MIoXWrqJGTkLaY2.3n0#UDClRF1oteAEk7mWq=1f95" # DO NOT USE THIS
report_stats: false
macaroon_secret_key: "#stDom~z;7M_Fjd0o,Mtn7BFOdIUqb5~DUg4;ipSo+6xEzuV#i" # DO NOT USE THIS
form_secret: ":ANf04Ysn5mh^1PdRHOXe3tT01NERDtBRYHMStkjUu.^wO@mUU" # DO NOT USE THIS
signing_key_path: "/data/matrix.yourdomain.com.signing.key"
trusted_key_servers:
  - server_name: "matrix.org"

#################################Custom Data that can be copied amongst instances######################################

enable_registration: true
# users require an email to sign up - needed for password resets
registrations_require_3pid:
  - email
#enable_registration_captcha: true
#recaptcha_public_key: <recaptcha site key>
#recaptcha_private_key: <recaptcha private key>

email:
  # The hostname of the outgoing SMTP server to use. Defaults to 'localhost'.
  #
  smtp_host: smtp.porkbun.com

  # The port on the mail server for outgoing SMTP. Defaults to 25.
  #
  smtp_port: 587

  # Username/password for authentication to the SMTP server. By default, no
  # authentication is attempted.
  #
  smtp_user: "dp@p2pnode.org"
  smtp_pass: "PuV9#@pUca49C70e2V46&keg"

  # Uncomment the following to require TLS transport security for SMTP.
  # By default, Synapse will connect over plain text, and will then switch to
  # TLS via STARTTLS *if the SMTP server supports it*. If this option is set,
  # Synapse will refuse to connect unless the server supports STARTTLS.
  #
  require_transport_security: true

  # notif_from defines the "From" address to use when sending emails.
  # It must be set if email sending is enabled.
  #
  # The placeholder '%(app)s' will be replaced by the application name,
  # which is normally 'app_name' (below), but may be overridden by the
  # Matrix client application.
  #
  # Note that the placeholder must be written '%(app)s', including the
  # trailing 's'.
  #
  notif_from: "Your Friendly %(app)s homeserver <noreply@yourdomain.com>"

  # app_name defines the default value for '%(app)s' in notif_from and email
  # subjects. It defaults to 'Matrix'.
  #
  app_name: DGroningen

  # Uncomment the following to enable sending emails for messages that the user
  # has missed. Disabled by default.
  #
  #enable_notifs: true

  # Uncomment the following to disable automatic subscription to email
  # notifications for new users. Enabled by default.
  #
  notif_for_new_users: true

# allows people to change their email address
enable_3pid_changes: true
# allows searching of all users in directory
user_directory.search_all_users: true
# allow room access over federation
matrix_synapse_allow_public_rooms_over_federation: true
# enable federation on port 443
serve_server_wellknown: true


# vim:ft=yaml

Caddy File

matrix.dgroningen.org {
    reverse_proxy /_matrix/* synapse:8008
    reverse_proxy /_synapse/* synapse:8008
}

matrix.dgroningen.org:8448 {
    reverse_proxy synapse:8008
}

dgroningen.org {
    handle /.well-known/matrix/server {
        respond `{"m.server": "matrix.dgroningen.org:443"}`
    }
    handle /.well-known/matrix/client {
        header Access-Control-Allow-Origin *
        respond `{"m.homeserver": {"base_url": "https://matrix.dgroningen.org"}}`
    }
}

Users

The first thing we need to do of course after setting up your server is setup an admin account. To do this we will use the following code that you can just copy paste. Instead of "admin" you can choose a more complicated name for security purposes. 

docker exec -it synapse register_new_matrix_user \
  -c /data/homeserver.yaml \
  -a -u admin http://localhost:8008