daarion-admin/microdao-daarion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ops(nginx): finalize matrix.daarion.space HTTPS config with Synapse proxy

Browse Source 
Made-with: Cursor
This commit is contained in:
Apple
2026-03-05 00:42:28 -08:00
parent e5480e92db
commit 313d777c84
1 changed files with 51 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

116
ops/nginx/matrix.daarion.space.conf
View File

@@ -1,15 +1,7 @@
# matrix.daarion.space — Synapse Matrix Homeserver (Phase M1) # matrix.daarion.space — Synapse Matrix Homeserver (Phase M1)
# Synapse: host 127.0.0.1:8008 (dagi-synapse-node1 container mapped) # Active on NODA1 since 2026-03-05
# # TLS: Let's Encrypt (auto-renew via certbot cron), expires 2026-06-03
# Deploy:
# cp ops/nginx/matrix.daarion.space.conf /etc/nginx/sites-enabled/
# nginx -t && nginx -s reload
# certbot --nginx -d matrix.daarion.space # after DNS A-record is live
#
# After certbot runs it appends the HTTPS block automatically.
# The HTTPS block below is the expected final state.
# ── HTTP: certbot challenge + redirect ────────────────────────────────────────
server { server {
listen 80; listen 80;
listen [::]:80; listen [::]:80;
@@ -25,58 +17,52 @@ server {
} }
} }
# ── HTTPS: added by certbot / manually after cert is issued ────────────────── server {
# Uncomment after: certbot --nginx -d matrix.daarion.space listen 443 ssl http2;
# listen [::]:443 ssl http2;
# server { server_name matrix.daarion.space;
# listen 443 ssl http2;
# listen [::]:443 ssl http2; ssl_certificate /etc/letsencrypt/live/matrix.daarion.space/fullchain.pem;
# server_name matrix.daarion.space; ssl_certificate_key /etc/letsencrypt/live/matrix.daarion.space/privkey.pem;
# include /etc/letsencrypt/options-ssl-nginx.conf;
# ssl_certificate /etc/letsencrypt/live/matrix.daarion.space/fullchain.pem; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
# ssl_certificate_key /etc/letsencrypt/live/matrix.daarion.space/privkey.pem;
# ssl_protocols TLSv1.2 TLSv1.3; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# ssl_ciphers HIGH:!aNULL:!MD5; add_header X-Content-Type-Options nosniff always;
# ssl_prefer_server_ciphers on; add_header X-Frame-Options SAMEORIGIN always;
# ssl_session_cache shared:SSL_MATRIX:10m;
# ssl_session_timeout 10m; # Matrix file uploads (media, avatars)
# client_max_body_size 50m;
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# add_header X-Content-Type-Options nosniff always; # Matrix Client-Server API
# add_header X-Frame-Options SAMEORIGIN always; location /_matrix {
# proxy_pass http://127.0.0.1:8008;
# # Matrix file uploads (media, avatars) proxy_set_header Host $host;
# client_max_body_size 50m; proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# # Matrix Client-Server API (/_matrix/*) proxy_set_header X-Forwarded-Proto https;
# location /_matrix { proxy_read_timeout 600s;
# proxy_pass http://127.0.0.1:8008; proxy_connect_timeout 10s;
# proxy_set_header Host $host; }
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # Synapse admin API
# proxy_set_header X-Forwarded-Proto https; location /_synapse {
# proxy_read_timeout 600s; proxy_pass http://127.0.0.1:8008;
# proxy_connect_timeout 10s; proxy_set_header Host $host;
# } proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# # Synapse admin API (/_synapse/*) proxy_set_header X-Forwarded-Proto https;
# location /_synapse { proxy_read_timeout 600s;
# proxy_pass http://127.0.0.1:8008; }
# proxy_set_header Host $host;
# proxy_set_header X-Real-IP $remote_addr; # Element auto-discovery
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; location /.well-known/matrix {
# proxy_set_header X-Forwarded-Proto https; default_type application/json;
# proxy_read_timeout 600s; add_header Access-Control-Allow-Origin *;
# } return 200 '{"m.homeserver":{"base_url":"https://matrix.daarion.space"}}';
# }
# # Client auto-discovery (Element uses this)
# location /.well-known/matrix { location /.well-known/acme-challenge/ {
# default_type application/json; root /var/www/certbot;
# add_header Access-Control-Allow-Origin *; }
# return 200 '{"m.homeserver":{"base_url":"https://matrix.daarion.space"}}'; }
# }
#
# location /.well-known/acme-challenge/ {
# root /var/www/certbot;
# }
# }