Update quadlets

matrix/configs/NGINX-domainroot.conf

@@ -0,0 +1,28 @@
+    location ~ ^(/_matrix|/_synapse/client|/_synapse/admin) {
+        # otherwise nginx will canonicalise the URI and cause signature verification
+        # errors.
+        proxy_pass http://localhost:8008;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+
+        # Nginx by default only allows file uploads up to 1M in size
+        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
+
+    # Synapse responses may be chunked, which is an HTTP/1.1 feature.
+    proxy_http_version 1.1;
+    }
+
+
+location /.well-known/matrix/client {
+    alias /var/www/html/.well-known/matrix/client;
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+}
+
+
+    location /.well-known/element/element.json {
+        root /var/www/html;       # points to the folder containing '.well-known'
+        default_type application/json;
+        add_header Access-Control-Allow-Origin *;
+    }

matrix/configs/NGINX-element-web.conf

@@ -0,0 +1,56 @@
+server {
+    listen 443 ssl;
+    server_name element.YOURDOMAIN.COM;
+
+    http2 on;
+
+    ssl_certificate /etc/letsencrypt/live/element.YOURDOMAIN.COM/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/element.YOURDOMAIN.COM/privkey.pem;
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript application/xml text/javascript;
+    gzip_min_length 256;
+
+    location / {
+        proxy_pass http://127.0.0.1:8445;
+
+       proxy_set_header Connection "upgrade";
+       proxy_set_header Upgrade $http_upgrade;
+
+       proxy_set_header Host $host;
+       proxy_set_header X-Forwarded-Server $host;
+       proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+       proxy_set_header X-Forwarded-Proto $scheme;
+
+
+#unrelated ccs and background injection
+
+#add_header X-Frame-Options SAMEORIGIN;
+#add_header X-Content-Type-Options nosniff;
+#add_header X-XSS-Protection "1; mode=block";
+#add_header Content-Security-Policy "frame-ancestors 'self'";
+
+#proxy_set_header Accept-Encoding "";
+#    sub_filter_once off;
+#    sub_filter '</head>' '<link rel="stylesheet" href="/custom.css"></head>';
+#    }
+
+#    location /custom.css {
+#       alias /var/www/html/nginx/custom_element.css;
+#       default_type text/css;
+#       add_header Access-Control-Allow-Origin *;
+#}
+
+
+#    location /themes/element/img/backgrounds/lake.jpg {
+#       alias /var/www/html/nginx/background.jpg;
+#       add_header Access-Control-Allow-Origin *;
+#    }
+
+}
+
+
+
+
+

matrix/configs/NGINX-jwt-matrixrtc.conf

@@ -0,0 +1,32 @@
+ server {
+    listen 443 ssl;
+    server_name jwt.matrixrtc.YOURDOMAIN.COM;
+
+    http2 on;
+
+    ssl_certificate /etc/letsencrypt/live/jwt.matrixrtc.YOURDOMAIN.COM/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/jwt.matrixrtc.YOURDOMAIN.COM/privkey.pem;
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript application/xml text/javascript;
+    gzip_min_length 256;
+
+    location / {
+        proxy_pass http://127.0.0.1:8909;
+
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+
+      proxy_send_timeout 120;
+      proxy_read_timeout 120;
+      proxy_buffering off;
+
+      proxy_set_header Accept-Encoding gzip;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+
+
+    }
+}

matrix/configs/NGINX-matrix-federation.conf

@@ -0,0 +1,20 @@
+ server {
+
+    listen 8448 ssl;
+
+    server_name YOURDOMAIN.COM;
+
+    ssl_certificate /etc/letsencrypt/live/YOURDOMAIN.COM/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/YOURDOMAIN.COM/privkey.pem;
+
+    location / {
+        proxy_pass http://127.0.0.1:8449;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+}
+
+

matrix/configs/NGINX-matrixrtc.conf

@@ -0,0 +1,26 @@
+server {
+    listen 443 ssl;
+    server_name matrixrtc.YOURDOMAIN.COM;
+
+    http2 on;
+
+    ssl_certificate /etc/letsencrypt/live/matrixrtc.YOURDOMAIN.COM/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/matrixrtc.YOURDOMAIN.COM/privkey.pem;
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript application/xml text/javascript;
+    gzip_min_length 256;
+
+    location / {
+        proxy_pass http://127.0.0.1:7880;
+
+       proxy_set_header Connection "upgrade";
+       proxy_set_header Upgrade $http_upgrade;
+
+       proxy_set_header Host $host;
+       proxy_set_header X-Forwarded-Server $host;
+       proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+       proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

matrix/configs/element-config.json

@@ -0,0 +1,13 @@
+{
+  "default_server_config": {
+    "m.homeserver": {
+      "base_url": "https://{YOURDOMAIN.COM}",
+      "server_name": "{YOURNAME}"
+    }
+  },
+  "disable_custom_urls": true,
+  "disable_guests": true,
+  "features": {
+    "feature_group_calls": true
+  }
+}

matrix/configs/homeserver.yaml

@@ -0,0 +1,46 @@
+turn_uris: ["turn:terrorist.academy:3478?transport=udp", "turn:terrorist.academy:3478?transport=tcp", "turn:terrorist.academy:5349?transport=tcp"]
+
+turn_shared_secret: {YOUR TURNSERVER SECRET}
+
+# ABSOLUTE MUST DO NOT IGNORE
+url_preview_ip_range_blacklist:
+  - '10.0.0.0/8'
+  - "100.0.0.0/8"
+  - '172.16.0.0/12'
+  - '192.168.0.0/16'
+  - '100.64.0.0/10'
+  - '169.254.0.0/16'
+  - '::1/128'
+  - 'fe80::/64'
+  - 'fc00::/7'
+
+database:
+  name: psycopg2
+  args:
+    user: synapse
+    password: {YOUR DATABASE PASSWORD}
+    database: synapse
+    host: postgres
+    port: 5432
+
+# config for proxy
+  - port: 8008
+    tls: false
+    bind_addresses:
+      - '0.0.0.0'
+    type: http
+    x_forwarded: true
+
+    resources:
+      - names: [client]
+        compress: true
+
+  - port: 8448
+    type: http
+    bind_addresses: ['0.0.0.0']
+    resources:
+      - names: [federation]
+        compress: false
+
+#there are regirstration options somewhere just skim over the whole file these are mainly the important settings
+# theres email settings too somewhere theres also a list of experimental features you can activate its somehwere in the github or sm

matrix/configs/livekit-config.yaml

@@ -0,0 +1,28 @@
+# Basic LiveKit configuration
+port: 7880 # Port LiveKit listens on internally
+bind_addresses:
+  - "0.0.0.0" # Listen on all interfaces within the container
+
+rtc:
+  tcp_port: 7881
+  port_range_start: 50100 # Match docker-compose port range
+  port_range_end: 50200   # Match docker-compose port range
+  use_external_ip: false # Rely on reverse proxy/NAT
+
+logging:
+  level: info
+
+# Disable LiveKit's internal TURN server, since you probably have something already set up for the classic P2P calls.
+turn:
+  enabled: false
+  # domain: matrixrtc.fariszr.com # Not needed if disabled, updated comment for consistency
+  # cert_file: ""
+  # key_file: ""
+  # tls_port: 5349 # Default
+  # udp_port: 443 # Default
+  # external_tls: true # If using external certs, but disabled anyway
+
+# Keys are provided via environment variable LIVEKIT_KEYS in docker-compose.yml
+# keys:
+#   (livekit_api_key): (livekit_api_secret)
+

matrix/configs/turnserver.conf

@@ -0,0 +1,22 @@
+listening-port=3478
+tls-listening-port=5349
+
+realm=YOURDOMAIN.COM
+server-name=YOURDOMAIN.COM
+
+cert=/etc/coturn/fullchain.pem
+pkey=/etc/coturn/privkey.pem
+
+fingerprint
+use-auth-secret
+static-auth-secret={YOUR TURNSERVER SECRET}
+
+total-quota=100
+stale-nonce=600
+
+no-multicast-peers
+
+listening-ip=0.0.0.0
+
+min-port=49152
+max-port=49999

matrix/configs/well known (this shit suckkks).txt

@@ -0,0 +1,19 @@
+well known files suck dih but quite simple
+
+serve under /.well-known/matrix/client under domainroot
+{
+  "m.homeserver": {
+    "base_url": "https://terrorist.academy"
+  },
+  "org.matrix.msc4143.rtc_foci": [
+    {
+      "type": "livekit",
+      "livekit_service_url": "https://jwt.matrixrtc.terrorist.academy"
+    }
+  ],
+  "org.matrix.msc3575.proxy": {
+    "url": "https://matrixrtc.terrorist.academy"
+  }
+}
+
+serve under .well-known/element/element.json same thing

matrix/quadlets/matrix-coturn.container

@@ -0,0 +1,26 @@
+[Unit]
+Description=coturn for matrix
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-coturn
+
+Environment=TURN_CERT_PATH=/etc/coturn/fullchain.pem TURN_KEY_PATH=/etc/coturn/privkey.pem
+
+Image=coturn/coturn:latest
+PublishPort=3478:3478/udp
+PublishPort=3478:3478/tcp
+PublishPort=5349:5349/tcp
+PublishPort=0.0.0.0:49152-49999:49152-49999/udp
+
+Volume=%h/services/matrix/synapse/turnserver.conf:/etc/coturn/turnserver.conf:ro
+Volume=%h/services/matrix/synapse/homeserver.log:/homeserver.log
+Volume=/etc/letsencrypt/live/{YOURDOMAIN.COM}/fullchain.pem:/etc/coturn/fullchain.pem
+Volume=/etc/letsencrypt/live/{YOURDOMAIN.COM}/privkey.pem:/etc/coturn/privkey.pem
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-element-web.container

@@ -0,0 +1,19 @@
+[Unit]
+Description=element web intance
+
+PartOf=matrix.target
+
+[Container]
+AddCapability=NET_BIND_SERVICE
+
+ContainerName=matrix-element-web
+
+Image=vectorim/element-web:latest
+PublishPort=127.0.0.1:8445:80
+Volume=%h/services/matrix/element-config.json:/app/config.json:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-livekit-jwt.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=matrix livekit jtw
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-lk-jtw
+
+Environment=LK_JWT_PORT=8080
+Environment=LIVEKIT_URL=wss://matrixrtc.{YOURDOMAIN.COM}
+Environment=LIVEKIT_KEY={YOUR LIVEKIT KEY}
+Environment=LIVEKIT_SECRET={YOUR LIVEKIT SECRET}
+Environment=LIVEKIT_FULL_ACCESS_HOMESERVERS=terrorist.academy
+
+PublishPort=127.0.0.1:8909:8080
+Image=ghcr.io/element-hq/lk-jwt-service:latest
+AddHost=(matrixrtc.{YOURDOMAIN.COM}):host-gateway
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-livekit.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=livekit for matrix
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-livekit
+
+Environment="LIVEKIT_KEYS={YOUR LIVEKIT KEY}: {YOUR LIVEKIT SECRET}"
+Environment=LIVEKIT_WS_UR=wss://matrixrtc.{YOURDOMAIN>COM}
+Exec=--config /etc/livekit.yaml
+
+Image=livekit/livekit-server:latest
+PublishPort=127.0.0.1:7880:7880
+PublishPort=50100-50200:50100-50200/udp
+
+Volume=%h/services/matrix/synapse/livekit-config.yaml:/etc/livekit.yaml:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-postgres.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=postres database for matrix
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-postgres
+
+Environment=POSTGRES_PASSWORD={YOUR POSTGRES PASSWORD}
+Environment=POSTGRES_USER=synapse
+HostName=matrix-postres
+Image=postgres:14
+
+Volume=%h/services/matrix/pgdata:/var/lib/postgresql/data
+Volume=%h/services/matrix/turn:/var/lib/turn
+
+Network=matrix.network
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-synapse-admin.container

@@ -0,0 +1,16 @@
+[Unit]
+Description=synapse admin for matrix
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-synapse-admin
+HostName=synapse-admin
+Image=awesometechnologies/synapse-admin:latest
+PublishPort=127.0.0.1:9092:80
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-synapse.container

@@ -0,0 +1,30 @@
+[Unit]
+Description=main matrix server
+
+Requires=matrix-postgres.service
+After=matrix-postgres.service
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-synapse
+
+Environment=SYNAPSE_SERVER_NAME={YOURDOMAIN.COM}
+Environment=SYNAPSE_REPORT_STATS=no
+
+Image=matrixdotorg/synapse:latest
+PublishPort=127.0.0.1:8008:8008
+PublishPort=127.0.0.1:8449:8448
+
+Volume=%h/services/matrix/synapse:/data
+Volume=%h/services/matrix/synapse/app:/app
+Volume=%h/services/matrix/synapse/logs/:/log/
+
+Network=matrix.network
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target
+

matrix/quadlets/matrix.network

@@ -0,0 +1,7 @@
+[Unit]
+Description=Matrix Podman Network
+
+PartOf=matrix.target
+
+[Network]
+NetworkName=matrix

matrix/quadlets/matrix.target

@@ -0,0 +1,13 @@
+[Unit]
+Description=matrix synapse container stack
+
+Wants=matrix-coturn.service
+Wants=matrix-livekit.service
+Wants=matrix-postgres.service
+Wants=matrix-synapse.service
+Wants=matrix-element-web.service
+Wants=matrix-livekit-jwt.service
+Wants=matrix-synapse-admin.service
+
+[Install]
+WantedBy=default.target