1+ # Synapse reverse proxy including .well-known/matrix/client
2+ server {
3+ listen 80;
4+ listen [::]:80;
5+ listen 443 ssl;
6+ listen 8448 ssl;
7+ listen [::]:443 ssl;
8+ listen [::]:8448 ssl;
9+ server_name synapse.m.localhost;
10+ ssl_certificate /root/ssl/cert.pem;
11+ ssl_certificate_key /root/ssl/key.pem;
12+
13+ # well-known config adding rtc_foci backend
14+ # Note well-known is currently not effective due to:
15+ # https://spec.matrix.org/v1.12/client-server-api/#well-known-uri the spec
16+ # says it must be at https://$server_name/... (implied port 443) Hence, we
17+ # currently rely for local development environment on deprecated config.json
18+ # setting for livekit_service_url
19+ location /.well-known/matrix/client {
20+ add_header Access-Control-Allow-Origin *;
21+ return 200 '{"m.homeserver": {"base_url": "https://synapse.m.localhost"}, "org.matrix.msc4143.rtc_foci": [{"type": "livekit", "livekit_service_url": "https://matrix-rtc.m.localhost/livekit/jwt"}]}';
22+ default_type application/json;
23+ }
24+
25+ # Reverse proxy for Matrix Synapse Homeserver
26+ # This is also required for development environment.
27+ # Reason: the lk-jwt-service uses the federation API for the openid token
28+ # verification, which requires TLS
29+ location / {
30+ proxy_pass "http://homeserver:8008";
31+ proxy_http_version 1.1;
32+ proxy_set_header Upgrade $http_upgrade;
33+ proxy_set_header Connection "upgrade";
34+ proxy_set_header Host $host;
35+ proxy_set_header X-Forwarded-For $remote_addr;
36+ proxy_set_header X-Forwarded-Proto $scheme;
37+ }
38+
39+ error_page 500 502 503 504 /50x.html;
40+
41+ }
42+
43+ # MatrixRTC reverse proxy
44+ # - MatrixRTC Authorization Service
45+ # - LiveKit SFU websocket signaling connection
46+ server {
47+ listen 80;
48+ listen [::]:80;
49+ listen 443 ssl;
50+ listen [::]:443 ssl;
51+ listen 8448 ssl;
52+ listen [::]:8448 ssl;
53+ server_name matrix-rtc.m.localhost;
54+ ssl_certificate /root/ssl/cert.pem;
55+ ssl_certificate_key /root/ssl/key.pem;
56+
57+
58+ location ^~ /livekit/jwt/ {
59+
60+ proxy_set_header Host $host;
61+ proxy_set_header X-Real-IP $remote_addr;
62+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
63+ proxy_set_header X-Forwarded-Proto $scheme;
64+
65+ # JWT Service running at port 8080
66+ proxy_pass http://auth-server:8080/;
67+ }
68+
69+ location ^~ /livekit/sfu/ {
70+ proxy_set_header Host $host;
71+ proxy_set_header X-Real-IP $remote_addr;
72+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
73+ proxy_set_header X-Forwarded-Proto $scheme;
74+
75+ proxy_send_timeout 120;
76+ proxy_read_timeout 120;
77+ proxy_buffering off;
78+
79+ proxy_set_header Accept-Encoding gzip;
80+ proxy_set_header Upgrade $http_upgrade;
81+ proxy_set_header Connection "upgrade";
82+
83+ # LiveKit SFU websocket connection running at port 7880
84+ proxy_pass http://livekit-sfu:7880/;
85+ }
86+
87+ error_page 500 502 503 504 /50x.html;
88+
89+ }
90+
91+ # Convenience reverse proxy for the call.m.localhost domain to yarn dev --host
92+ server {
93+ listen 80;
94+ listen [::]:80;
95+ server_name call.m.localhost;
96+
97+ return 301 https://$host$request_uri;
98+ }
99+
100+ server {
101+ listen 443 ssl;
102+ listen [::]:443 ssl;
103+ server_name call.m.localhost;
104+ ssl_certificate /root/ssl/cert.pem;
105+ ssl_certificate_key /root/ssl/key.pem;
106+
107+
108+ location ^~ / {
109+
110+ proxy_set_header Host $host;
111+ proxy_set_header X-Real-IP $remote_addr;
112+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
113+ proxy_set_header X-Forwarded-Proto $scheme;
114+
115+ proxy_pass https://host.docker.internal:3000;
116+ proxy_ssl_verify off;
117+
118+ }
119+
120+ error_page 500 502 503 504 /50x.html;
121+
122+ }
123+
124+ # Convenience reverse proxy app.m.localhost for element web
125+ server {
126+ listen 80;
127+ listen [::]:80;
128+ server_name app.m.localhost;
129+
130+ return 301 https://$host$request_uri;
131+ }
132+
133+ server {
134+ listen 443 ssl;
135+ listen [::]:443 ssl;
136+ server_name app.m.localhost;
137+ ssl_certificate /root/ssl/cert.pem;
138+ ssl_certificate_key /root/ssl/key.pem;
139+
140+
141+ location ^~ / {
142+
143+ proxy_set_header Host $host;
144+ proxy_set_header X-Real-IP $remote_addr;
145+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
146+ proxy_set_header X-Forwarded-Proto $scheme;
147+
148+ proxy_pass http://element-web:81;
149+ proxy_ssl_verify off;
150+
151+ }
152+
153+ error_page 500 502 503 504 /50x.html;
154+
155+ }
0 commit comments