Matrix Protocol Server

The Jacksonville Linux Users Group Inc. operates a single Matrix protocol homeserver, an open standard and communication protocol for real-time communication, located in Atlanta, Georgia. Unlike most all our other servers, this one is brand spanking new; ok, it was cloned from ns1, so not entirely true. This provides the first ever in-house self-hosted communication platform for the JaxLUG! We are very excited about this new server of ours, and we encourage members to employ their own Matrix homeserver to connect to ours for fully decentralized communications; audio, text, and/or video.

For information on using our Matrix protocol homeserver, please see our interact with us Matrix page.

Synapse

The JaxLUG runs Synapse from Element for Matrix protocol homeserver software, this is the reference implementation of the Matrix protocol that is developed by the Matrix.org Foundation under the Element brand, which is the reference Matrix protocol client software available for mobile and web. There is a variety Matrix protocol homeserver software available in the ecosystem, and we may switch from Synpase someday, or remain with it till the very end. Synapse is open-source software under the AGPL-3.0 + Commercial Licenses that is developed by the Matrix.org Foundation, for more information please visit Synapse's documentation page.

While many use proprietary protocols like Discord, this is a private and secure server that only local people administrate and have access to, which affords for greater data privacy. No AI mining, or other usage of communication data.

Reverse Proxy via lighttpd

lighttpd is an open-source web server ideal for embedded and speed-critical environments, and while it is a current undocumented reverse proxy for use with Matrix protocol homeserver. You can expose a Matrix protocol homeserver directly, unwise for a variety of reasons, or the more common, exposure through a reverse proxy, which then use plan HTTP/HTTPS for communication.

Now we cannot just stop there, you can proxy one of two ways, port or socket, with socket file communication being much faster and lower overhead than port. Therefore, we configured lighttpd to be a reverse proxy for Synapse via socket communication. We plan to provide such contributions upstream in a Pull Request (PR) as an example of how the JaxLUG will be contributing to FOSS, not just consuming!

lighttpd configuration

The following configuration provides Matrix protocol homeserver proxy services over IPv4 and IPv6, HTTP for certificate renewal and some homeserver location URL endpoints, with primary communication over secure HTTPS using TLS and ultra-fast socket file communication to Synapse. That does require the socket file to have permissions for both lighttpd and Synapse to have read and write access.

                
# lighttpd.conf

server.modules = (
    "mod_rewrite",
    "mod_redirect",
    "mod_access",
    "mod_setenv",
    "mod_openssl",
    "mod_proxy",
    "mod_accesslog"
)

server.username      = "lighttpd"
server.groupname     = "lighttpd"

#server.use-ipv6 = "enable"

$SERVER["socket"] == "0.0.0.0:80" {
}

ssl.pemfile = "/etc/lighttpd/cert+privkey.pem"
ssl.ca-file = "/etc/lighttpd/fullchain.pem"

$SERVER["socket"] == "0.0.0.0:443" {
    ssl.engine = "enable"
}

$SERVER["socket"] == "0.0.0.0:8448" {
    ssl.engine = "enable"
}

$SERVER["socket"] == "[::]:80" {
}

$SERVER["socket"] == "[::]:443" {
    ssl.engine = "enable"
}

$SERVER["socket"] == "[::]:8448" {
    ssl.engine = "enable"
}

# both lighttpd and synapse need permissions for socket r/w
$HTTP["url"] =~ "(/_matrix|/_synapse/client)" {
    proxy.balance = "hash"
    proxy.server = ( 
        "" => ( 
            "backend-socket" => (
                "host" => "/var/lib/synapse/main_public.sock",
                "port" => 0
            )
        )
    )
    proxy.forwarded = (
        "for" => 1,
        "proto" => 1,
        "host" => 1,
    )
}

# serve json files as urls. is there a better way?
$HTTP["url"] =~ "/.well-known/matrix/client" {
     setenv.add-response-header = ("Access-Control-Allow-Origin" => "*")
     mimetype.assign = ("" => "application/json")
     url.rewrite = (
     "^/.well-known/matrix/client" => "/.well-known/matrix/client.json"
     )
}
$HTTP["url"] =~ "/.well-known/matrix/server" {
     setenv.add-response-header = ("Access-Control-Allow-Origin" => "*")
     mimetype.assign = ("" => "application/json")
     url.rewrite = (
     "^/.well-known/matrix/server" => "/.well-known/matrix/server.json"
     )
}

PostgreSQL

Not to be forgotten, our backend database for Synapse is the popular open-source RDBMS PostgreSQL, which resides on the same server, and someday may be on its own sever, as we deploy other database dependent services. The main long-term administration outside of updates for Synapse will be in managing the size of our Matrix protocol homeserver database.