OpenBSD Matrix Server

Install Packages

pkg_add -z python-3.6.6
pkg_add libffi py3-pip py3-setuptools sqlite3 py3-virtualenv libxslt jpeg

Synapse

Create user:

groupadd _synapse
useradd -m -g _synapse -d /usr/local/_synapse -s /bin/ksh _synapse

Virtualenv:

su _synapse
virtualenv-3 -p python3.6 ~/.synapse
. /usr/local/_synapse/.synapse/bin/activate
pip install lxml
pip install matrix-synapse
python3 -m synapse.app.homeserver \
    --server-name matrix.example.com \
    --config-path homeserver.yaml \
    --generate-config \
    --report-stats=no

Synapse Config:

vi homeserver.yaml

# web_client_location: "/path/to/web/root" ?
public_baseurl: https://matrix.example.com/

url_preview_ip_range_blacklist:
- '0.0.0.0/8'
- '10.0.0.0/8'
- '100.64.0.0/10'
- '127.0.0.0/8'
- '169.254.0.0/16'
- '172.16.0.0/12'
- '192.0.0.0/24'
- '192.0.2.0/24'
- '192.168.0.0/16'
- '198.18.0.0/15'
- '198.51.100.0/24'
- '203.0.113.0/24'
- '224.0.0.0/3'
- '::1/128'
- 'fe80::/64'
- 'fc00::/7'

push:
  include_content: false

use_presence: false

  - port: 8008
    tls: false
    bind_addresses: ['0.0.0.0']

bcrypt_rounds: 13

password_config:
   enabled: true
   # Uncomment and change to a secret random string for extra security.
   # DO NOT CHANGE THIS AFTER INITIAL SETUP!
   pepper: "$(openssl rand -hex 16)"

Service:

cat <<'EOF'> /usr/local/sbin/synapse
#!/bin/sh

cd ~ 
. ~/.synapse/bin/activate
synctl $1
EOF
chmod 755 /usr/local/sbin/synapse

cat <<'EOF'> /etc/rc.d/synapse
#!/bin/sh

daemon="/usr/local/sbin/synapse"
daemon_user="_synapse"

. /etc/rc.d/rc.subr

rc_bg=YES
rc_reload=NO
pexp="/usr/local/_synapse/.synapse/bin/python3.6 -B -m synapse.app.homeserver --daemonize -c homeserver.yaml"

rc_start() {
        ${rcexec} "${daemon} start >/dev/null 2>&1"
}

rc_stop() {
        ${rcexec} "${daemon} stop >/dev/null 2>&1"
}

rc_cmd $1
EOF
chmod 555 /etc/rc.d/synapse
rcctl enable synapse
rcctl start synapse

Create user

su _synapse
. ~/.synapse/bin/activate
register_new_matrix_user -c ~/homeserver.yaml http://127.0.0.1:8008

Add DNS record

matrix          IN A <your ip>
_matrix._tcp.matrix.example.com.    IN SRV 10 0 8448 matrix.example.com.

nginx

vHost:

server {
  listen 80;
  server_name matrix.example.com;
  location /.well-known/acme-challenge {
    alias /acme;
  }
  location / {
    return 301 https://matrix.example.com$request_uri;
  }
}

server {
  listen 443 ssl http2;
  server_name matrix.example.com;

  ssl_certificate /etc/ssl/example.com.fullchain.pem;
  ssl_certificate_key /etc/ssl/private/example.com.key;

  access_log /var/www/logs/matrix_access.log;
  error_log /var/www/logs/matrix_error.log;

  location /.well-known/matrix {
    alias /matrix;
  }
  location /_matrix {
    proxy_pass http://127.0.0.1:8008;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}

server {
  listen 8448 ssl http2;
  server_name matrix.example.com;

  ssl_certificate /etc/ssl/example.com.fullchain.pem;
  ssl_certificate_key /etc/ssl/private/example.com.key;

  access_log /var/www/logs/matrix_fed_access.log;
  error_log /var/www/logs/matrix_fed_error.log;

  location / {
    proxy_pass http://127.0.0.1:8008;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}

.well-known:

mkdir /var/www/matrix
echo '{"m.server":"matrix.example.com:8448"}' >/var/www/matrix/server

Sydent

NOTE: this section is TBD!

Create user:

groupadd _sydent
useradd -m -g _sydent -d /usr/local/_sydent -s /bin/ksh _sydent

Virtualenv:

su _sydent
virtualenv-3 -p python3.6 ~/.sydent
. ~/.sydent/bin/activate
pip install https://github.com/matrix-org/sydent/tarball/master

python3 -m sydent.sydent -h

python3 -m synapse.app.homeserver \
    --server-name matrix.example.com \
    --config-path homeserver.yaml \
    --generate-config \
    --report-stats=yes

Sydent Config:

vi 

Service:

cat <<'EOF'> /usr/local/sbin/sydent
#!/bin/sh

cd ~ 
. ~/.sydent/bin/activate
python3 -m sydent.sydent
EOF
chmod 755 /usr/local/sbin/sydent

cat <<'EOF'> /etc/rc.d/sydent
#!/bin/sh

daemon="/usr/local/sbin/sydent"
daemon_user="_sydent"

. /etc/rc.d/rc.subr

rc_bg=YES
rc_reload=NO

rc_start() {
        ${rcexec} "${daemon} start >/dev/null 2>&1"
}

rc_stop() {
        ${rcexec} "${daemon} stop >/dev/null 2>&1"
}

rc_cmd $1
EOF
chmod 555 /etc/rc.d/sydent
rcctl enable sydent
rcctl start sydent

Sources

https://matrix.org/federationtester/