├── .github ├── ISSUE_TEMPLATE.md └── PULL_REQUEST_TEMPLATE.md ├── .gitignore ├── LICENSE ├── README.md ├── auto_update ├── auto_update.sh └── auto_update_config_example.sh ├── conf ├── default_coturn ├── f2b_filter.conf ├── f2b_jail.conf ├── homeserver.yaml ├── livekit.yml ├── lk-jwt.conf ├── log.yaml ├── nginx.conf ├── nginx.conf.inc ├── requirement_bookworm.txt ├── requirement_bullseye.txt ├── server_name.conf ├── synapse-coturn.service ├── synapse-livekit.service ├── synapse-lk-jwt.service ├── synapse.service └── turnserver.conf ├── config_panel.toml ├── doc ├── ADMIN.md ├── DESCRIPTION.md ├── POST_INSTALL.md ├── POST_UPGRADE.d │ └── 1.130.0~ynh1.md └── PRE_INSTALL.md ├── hooks └── post_cert_update ├── manifest.toml ├── scripts ├── _common.sh ├── backup ├── change_url ├── config ├── experimental_helper.sh ├── install ├── patch │ └── ldap_auth_filter_anonymous_user.patch ├── remove ├── restore └── upgrade ├── sources ├── Coturn_config_rotate.sh ├── cas_server.php ├── set_admin_user.sh └── update_synapse_for_appservice.sh └── tests.toml /.github/ISSUE_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: When creating a bug report, please use the following template to provide all the relevant information and help debugging efficiently. 4 | 5 | --- 6 | 7 | **How to post a meaningful bug report** 8 | 1. *Read this whole template first.* 9 | 2. *Determine if you are on the right place:* 10 | - *If you were performing an action on the app from the webadmin or the CLI (install, update, backup, restore, change_url...), you are on the right place!* 11 | - *Otherwise, the issue may be due to the app itself. Refer to its documentation or repository for help.* 12 | - *When in doubt, post here and we will figure it out together.* 13 | 3. *Delete the italic comments as you write over them below, and remove this guide.* 14 | --- 15 | 16 | ### Describe the bug 17 | 18 | *A clear and concise description of what the bug is.* 19 | 20 | ### Context 21 | 22 | - Hardware: *VPS bought online / Old laptop or computer / Raspberry Pi at home / Internet Cube with VPN / Other ARM board / ...* 23 | - YunoHost version: x.x.x 24 | - I have access to my server: *Through SSH | through the webadmin | direct access via keyboard / screen | ...* 25 | - Are you in a special context or did you perform some particular tweaking on your YunoHost instance?: *no / yes* 26 | - If yes, please explain: 27 | - Using, or trying to install package version/branch: 28 | - If upgrading, current package version: *can be found in the admin, or with `yunohost app info $app_id`* 29 | 30 | ### Steps to reproduce 31 | 32 | - *If you performed a command from the CLI, the command itself is enough. For example:* 33 | ```sh 34 | sudo yunohost app install the_app 35 | ``` 36 | - *If you used the webadmin, please perform the equivalent command from the CLI first.* 37 | - *If the error occurs in your browser, explain what you did:* 38 | 1. *Go to '...'* 39 | 2. *Click on '...'* 40 | 3. *Scroll down to '...'* 41 | 4. *See error* 42 | 43 | ### Expected behavior 44 | 45 | *A clear and concise description of what you expected to happen. You can remove this section if the command above is enough to understand your intent.* 46 | 47 | ### Logs 48 | 49 | *When an operation fails, YunoHost provides a simple way to share the logs.* 50 | - *In the webadmin, the error message contains a link to the relevant log page. On that page, you will be able to 'Share with Yunopaste'. If you missed it, the logs of previous operations are also available under Tools > Logs.* 51 | - *In command line, the command to share the logs is displayed at the end of the operation and looks like `yunohost log display [log name] --share`. If you missed it, you can find the log ID of a previous operation using `yunohost log list`.* 52 | 53 | *After sharing the log, please copypaste directly the link provided by YunoHost (to help readability, no need to copypaste the entire content of the log here, just the link is enough...)* 54 | 55 | *If applicable and useful, add screenshots to help explain your problem.* 56 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | ## Problem 2 | 3 | - *Description of why you made this PR* 4 | 5 | ## Solution 6 | 7 | - *And how do you fix that problem* 8 | 9 | ## PR Status 10 | 11 | - [ ] Code finished and ready to be reviewed/tested 12 | - [ ] The fix/enhancement were manually tested (if applicable) 13 | 14 | ## Automatic tests 15 | 16 | Automatic tests can be triggered on https://ci-apps-dev.yunohost.org/ *after creating the PR*, by commenting "!testme", "!gogogadgetoci" or "By the power of systemd, I invoke The Great App CI to test this Pull Request!". (N.B. : for this to work you need to be a member of the Yunohost-Apps organization) 17 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # From kateproject 2 | .kateproject 3 | .kateproject.d 4 | .directory 5 | 6 | *swp 7 | 8 | auto_update_config.sh 9 | auto_update/Synapse_build_*.log 10 | auto_update/synapse_build_temp.log 11 | *~ 12 | *.sw[op] 13 | .DS_Store 14 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | 635 | Copyright (C) 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | Copyright (C) 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 5 | 6 |

7 | Logo of Synapse 8 | Synapse, packaged for YunoHost 9 |

10 | 11 | Instant messaging server which uses Matrix 12 | 13 | [![🌐 Official app website](https://img.shields.io/badge/Official_app_website-darkgreen?style=for-the-badge)](https://matrix.org/) 14 | [![Version: 1.130.0~ynh1](https://img.shields.io/badge/Version-1.130.0~ynh1-rgba(0,150,0,1)?style=for-the-badge)](https://ci-apps.yunohost.org/ci/apps/synapse/) 15 | 16 |
17 | 18 | 19 |
20 | 21 | ## 📦 Developer info 22 | 23 | [![Automatic tests level](https://apps.yunohost.org/badge/cilevel/synapse)](https://ci-apps.yunohost.org/ci/apps/synapse/) 24 | 25 | 🛠️ Upstream Synapse repository: 26 | 27 | Pull request are welcome and should target the [`testing` branch](https://github.com/YunoHost-Apps/synapse_ynh/tree/testing). 28 | 29 | The `testing` branch can be tested using: 30 | ``` 31 | # fresh install: 32 | sudo yunohost app install https://github.com/YunoHost-Apps/synapse_ynh/tree/testing 33 | 34 | # upgrade an existing install: 35 | sudo yunohost app upgrade synapse -u https://github.com/YunoHost-Apps/synapse_ynh/tree/testing 36 | ``` 37 | 38 | ### 📚 App packaging documentation 39 | 40 | Please see for more information. -------------------------------------------------------------------------------- /auto_update/auto_update.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | set -eu 4 | 5 | readonly app_name=synapse 6 | 7 | source auto_update_config.sh 8 | 9 | readonly debian_version_name_1=bullseye 10 | readonly debian_version_name_2=bookworm 11 | 12 | get_from_manifest() { 13 | result=$(python3 <&1 | tee "${app_name}_build_temp.log" 101 | return ${PIPESTATUS[0]} 102 | } 103 | 104 | push_armv7_build() { 105 | ## Make a draft release json with a markdown body 106 | local release='"tag_name": "v'$app_version'", "target_commitish": "master", "name": "v'$app_version'", ' 107 | local body="$app_name prebuilt bin for ${app_name}_ynh\\n=========\\nPlease refer to upstream project for the change : https://github.com/element-hq/synapse/releases\\n\\nSha256sum for $debian_version_name_1 : $(cat $build_result_path_deb_1/${result_prefix_name_deb_1}-bin1_armv7l-sha256.txt)\\nSha256sum for $debian_version_name_2 : $(cat $build_result_path_deb_2/${result_prefix_name_deb_2}-bin1_armv7l-sha256.txt)" 108 | release+='"body": "'$body'",' 109 | release+='"draft": true, "prerelease": false' 110 | release='{'$release'}' 111 | local url="https://api.github.com/repos/$owner/$repo/releases" 112 | local succ=$(curl -H "Authorization: token $perstok" --data "$release" $url) 113 | 114 | ## In case of success, we upload a file 115 | local upload_generic=$(echo "$succ" | grep upload_url) 116 | if [[ $? -eq 0 ]]; then 117 | echo "Release created." 118 | else 119 | echo "Error creating release!" 120 | return 1 121 | fi 122 | 123 | local upload_prefix 124 | local upload_file 125 | local upload_ok 126 | local download 127 | for archive_name in $build_result_path_deb_1/${result_prefix_name_deb_1}-bin1_armv7l.tar.gz \ 128 | $build_result_path_deb_2/${result_prefix_name_deb_2}-bin1_armv7l.tar.gz 129 | do 130 | 131 | # $upload_generic is like: 132 | # "upload_url": "https://uploads.github.com/repos/:owner/:repo/releases/:ID/assets{?name,label}", 133 | upload_prefix=$(echo $upload_generic | cut -d "\"" -f4 | cut -d "{" -f1) 134 | upload_file="$upload_prefix?name=${archive_name##*/}" 135 | 136 | echo "Start uploading file" 137 | i=0 138 | upload_ok=false 139 | while [ $i -le 4 ]; do 140 | i=$((i+1)) 141 | # Download file 142 | set +e 143 | succ=$(curl -H "Authorization: token $perstok" \ 144 | -H "Content-Type: $(file -b --mime-type $archive_name)" \ 145 | -H "Accept: application/vnd.github.v3+json" \ 146 | --data-binary @$archive_name $upload_file) 147 | res=$? 148 | set -e 149 | if [ $res -ne 0 ]; then 150 | echo "Curl upload failled" 151 | continue 152 | fi 153 | echo "Upload done, check result" 154 | 155 | set +eu 156 | download=$(echo "$succ" | egrep -o "browser_download_url.+?") 157 | res=$? 158 | if [ $res -ne 0 ] || [ -z "$download" ]; then 159 | set -eu 160 | echo "Result upload error" 161 | continue 162 | fi 163 | set -eu 164 | echo "$download" | cut -d: -f2,3 | cut -d\" -f2 165 | echo "Upload OK" 166 | upload_ok=true 167 | break 168 | done 169 | 170 | if ! $upload_ok; then 171 | echo "Upload completely failed, exit" 172 | return 1 173 | fi 174 | done 175 | } 176 | 177 | app_version=$(get_from_manifest ".version" | cut -d'~' -f1) 178 | 179 | if check_app_version 180 | then 181 | set +eu 182 | upgrade_app 183 | res=$? 184 | set -eu 185 | if [ $res -eq 0 ]; then 186 | result="Success" 187 | else 188 | result="Failed" 189 | fi 190 | msg="Build: $app_name version $app_version" 191 | 192 | echo "$msg" | mail.mailutils --content-type="text/plain; charset=UTF-8" -A "${app_name}_build_temp.log" -s "Autoupgrade $app_name : $result" "$notify_email" 193 | fi 194 | -------------------------------------------------------------------------------- /auto_update/auto_update_config_example.sh: -------------------------------------------------------------------------------- 1 | 2 | build_cmd_deb_1() { 3 | pushd ~ 4 | sudo /root/build_synapse_bin.sh $1 $2 --chroot-yes 5 | popd 6 | sudo chown app_upgrader ~/$2* 7 | } 8 | build_cmd_deb_2() { 9 | local target_dir=~ 10 | sudo chroot /mnt/bookworm_build /root/build_synapse_bin.sh $1 $2 --chroot-yes 11 | sudo mv -t $target_dir /mnt/bookworm_build/$2* 12 | sudo chown app_upgrader $target_dir/$2* 13 | } 14 | 15 | 16 | build_result_path_deb_1=~ 17 | build_result_path_deb_2=~ 18 | 19 | notify_email="hello@world.tld" 20 | 21 | # For github arm release 22 | owner="YunoHost-Apps" 23 | repo="synapse_python_build" 24 | perstok="kkk" 25 | -------------------------------------------------------------------------------- /conf/default_coturn: -------------------------------------------------------------------------------- 1 | # 2 | # Uncomment it if you want to have the turnserver running as 3 | # an automatic system service daemon 4 | # 5 | TURNSERVER_ENABLED=1 6 | -------------------------------------------------------------------------------- /conf/f2b_filter.conf: -------------------------------------------------------------------------------- 1 | [INCLUDES] 2 | before = common.conf 3 | [Definition] 4 | 5 | # Part of regex definition (just used to make more easy to make the global regex) 6 | __synapse_start_line = .? \- synapse\..+ \- 7 | 8 | # Regex definition. 9 | failregex = ^%(__synapse_start_line)s INFO \- POST\-(\d+) \- \- \d+ \- Received request\: POST /_matrix/client/r0/login\??%(__synapse_start_line)s INFO \- POST\-\1\- Got login request with identifier: \{('type': 'm.id.user'(, )?|'user'\: '(.+?)'(, )?){2}\}, medium\: None, address: None, user\: '\7'%(__synapse_start_line)s WARNING \- \- (Attempted to login as @\7\:.+ but they do not exist|Failed password login for user @\7\:.+)$ 10 | ignoreregex = 11 | 12 | [Init] 13 | 14 | maxlines = 20 15 | -------------------------------------------------------------------------------- /conf/f2b_jail.conf: -------------------------------------------------------------------------------- 1 | [__APP__] 2 | enabled = true 3 | port = http,https 4 | filter = __APP__ 5 | logpath = /var/log/matrix-__APP__/homeserver.log 6 | maxretry = 3 7 | -------------------------------------------------------------------------------- /conf/livekit.yml: -------------------------------------------------------------------------------- 1 | # WARNING: Don't edit this file. All change will be removed after each app upgrade 2 | # 3 | # Copyright 2024 LiveKit, Inc. 4 | # 5 | # Licensed under the Apache License, Version 2.0 (the "License"); 6 | # you may not use this file except in compliance with the License. 7 | # You may obtain a copy of the License at 8 | # 9 | # http://www.apache.org/licenses/LICENSE-2.0 10 | # 11 | # Unless required by applicable law or agreed to in writing, software 12 | # distributed under the License is distributed on an "AS IS" BASIS, 13 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | # See the License for the specific language governing permissions and 15 | # limitations under the License. 16 | 17 | # main TCP port for RoomService and RTC endpoint 18 | # for production setups, this port should be placed behind a load balancer with TLS 19 | port: __PORT_LIVEKIT__ 20 | 21 | # when redis is set, LiveKit will automatically operate in a fully distributed fashion 22 | # clients could connect to any node and be routed to the same room 23 | # redis: 24 | # address: redis.host:6379 25 | # db: 0 26 | # username: myuser 27 | # password: mypassword 28 | # To use sentinel remove the address key above and add the following 29 | # sentinel_master_name: livekit 30 | # sentinel_addresses: 31 | # - livekit-redis-node-0.livekit-redis-headless:26379 32 | # - livekit-redis-node-1.livekit-redis-headless:26379 33 | # If you use a different set of credentials for sentinel add 34 | # sentinel_username: user 35 | # sentinel_password: pass 36 | # 37 | # To use TLS with redis 38 | # tls: 39 | # enabled: true 40 | # # when set to true, LiveKit will not verify the server's certificate, defaults to true 41 | # insecure: false 42 | # server_name: myserver.com 43 | # # file containing trusted root certificates for verification 44 | # ca_cert_file: /path/to/ca.crt 45 | # client_cert_file: /path/to/client.crt 46 | # client_key_file: /path/to/client.key 47 | # 48 | # To use cluster remove the address key above and add the following 49 | # cluster_addresses: 50 | # - livekit-redis-node-0.livekit-redis-headless:6379 51 | # - livekit-redis-node-1.livekit-redis-headless:6380 52 | # And it will use the password key above as cluster password 53 | # And the db key will not be used due to cluster mode not support it. 54 | 55 | # WebRTC configuration 56 | rtc: 57 | # UDP ports to use for client traffic. 58 | # this port range should be open for inbound traffic on the firewall 59 | port_range_start: 49153 60 | port_range_end: 49193 61 | # when set, LiveKit enable WebRTC ICE over TCP when UDP isn't available 62 | # this port *cannot* be behind load balancer or TLS, and must be exposed on the node 63 | # WebRTC transports are encrypted and do not require additional encryption 64 | # only 80/443 on public IP are allowed if less than 1024 65 | tcp_port: __PORT_LIVEKIT_RTC__ 66 | # when set to true, attempts to discover the host's public IP via STUN 67 | # this is useful for cloud environments such as AWS & Google where hosts have an internal IP 68 | # that maps to an external one 69 | use_external_ip: false 70 | # # when set, LiveKit will attempt to use a UDP mux so all UDP traffic goes through 71 | # # listed port(s). To maximize system performance, we recommend using a range of ports 72 | # # greater or equal to the number of vCPUs on the machine. 73 | # # port_range_start & end must not be set for this config to take effect 74 | # udp_port: 7882-7892 75 | # # when set to true, server will use a lite ice agent, that will speed up ice connection, but 76 | # # might cause connect issue if server running behind NAT. 77 | # use_ice_lite: true 78 | # # optional STUN servers for LiveKit clients to use. Clients will be configured to use these STUN servers automatically. 79 | # # by default LiveKit clients use Google's public STUN servers 80 | # stun_servers: 81 | # - server1 82 | # # optional TURN servers for clients. This isn't necessary if using embedded TURN server (see below). 83 | # turn_servers: 84 | # - host: myhost.com 85 | # port: 443 86 | # # tls, tcp, or udp 87 | # protocol: tls 88 | # username: "" 89 | # credential: "" 90 | # # allows LiveKit to monitor congestion when sending streams and automatically 91 | # # manage bandwidth utilization to avoid congestion/loss. Enabled by default 92 | # congestion_control: 93 | # enabled: true 94 | # # in the unlikely event of highly congested networks, SFU may choose to pause some tracks 95 | # # in order to allow others to stream smoothly. You can disable this behavior here 96 | # allow_pause: true 97 | # # allows automatic connection fallback to TCP and TURN/TLS (if configured) when UDP has been unstable, default true 98 | # allow_tcp_fallback: true 99 | # # number of packets to buffer in the SFU for video, defaults to 500 100 | # packet_buffer_size_video: 500 101 | # # number of packets to buffer in the SFU for audio, defaults to 200 102 | # packet_buffer_size_audio: 200 103 | # # minimum amount of time between pli/fir rtcp packets being sent to an individual 104 | # # producer. Increasing these times can lead to longer black screens when new participants join, 105 | # # while reducing them can lead to higher stream bitrate. 106 | # pli_throttle: 107 | # low_quality: 500ms 108 | # mid_quality: 1s 109 | # high_quality: 1s 110 | # # when set, Livekit will collect loopback candidates, it is useful for some VM have public address mapped to its loopback interface. 111 | # enable_loopback_candidate: true 112 | # # network interface filter. If the machine has more than one network interface and you'd like it to use or skip specific interfaces 113 | # # both inclusion and exclusion filters can be used together. If neither is defined (default), all interfaces on the machine will be used. 114 | # # If both of them are set, then only include takes effect. 115 | # interfaces: 116 | # includes: 117 | # - en0 118 | # excludes: 119 | # - docker0 120 | # # ip address filter. If the machine has more than one ip address and you'd like it to use or skip specific ips, 121 | # # both inclusion and exclusion CIDR filters can be used together. If neither is defined (default), all ip on the machine will be used. 122 | # # If both of them are set, then only include takes effect. 123 | ips: 124 | # includes: 125 | # - 10.0.0.0/16 126 | excludes: 127 | - 0.0.0.0/8 128 | - 127.0.0.0/8 129 | # # Set to true to enable mDNS name candidate. This should be left disabled for most users. 130 | # # when enabled, it will impact performance since each PeerConnection will process the same mDNS message independently 131 | # use_mdns: true 132 | # # Set to false to disable strict ACKs for peer connections where LiveKit is the dialing side, 133 | # # ie. subscriber peer connections. Disabling strict ACKs will prevent clients that do not ACK 134 | # # peer connections from getting kicked out of rooms by the monitor. Note that if strict ACKs 135 | # # are disabled and clients don't ACK opened peer connections, only reliable, ordered delivery 136 | # # will be available. 137 | # strict_acks: true 138 | # # enable batch write to merge network write system calls to reduce cpu usage. Outgoing packets 139 | # # will be queued until length of queue equal to `batch_size` or time elapsed since last write exceeds `max_flush_interval`. 140 | # batch_io: 141 | # batch_size: 128 142 | # max_flush_interval: 2ms 143 | # # max number of bytes to buffer for data channel. 0 means unlimited. 144 | # # when this limit is breached, data messages will be dropped till the buffered amount drops below this limit. 145 | # data_channel_max_buffered_amount: 0 146 | 147 | # when enabled, LiveKit will expose prometheus metrics on :6789/metrics 148 | # prometheus_port: 6789 149 | 150 | # API key / secret pairs. 151 | # Keys are used for JWT authentication, server APIs would require a keypair in order to generate access tokens 152 | # and make calls to the server 153 | keys: 154 | element_call: __LIVEKIT_SECRET__ 155 | # Logging config 156 | logging: 157 | # log level, valid values: debug, info, warn, error 158 | level: warn 159 | # log level for pion, default error 160 | pion_level: error 161 | # when set to true, emit json fields 162 | json: false 163 | # for production setups, enables sampling algorithm 164 | # https://github.com/uber-go/zap/blob/master/FAQ.md#why-sample-application-logs 165 | sample: true 166 | 167 | # Default room config 168 | # Each room created will inherit these settings. If rooms are created explicitly with CreateRoom, they will take 169 | # precedence over defaults 170 | # room: 171 | # # allow rooms to be automatically created when participants join, defaults to true 172 | # # auto_create: false 173 | # # number of seconds to keep the room open if no one joins 174 | # empty_timeout: 300 175 | # # number of seconds to keep the room open after everyone leaves 176 | # departure_timeout: 20 177 | # # limit number of participants that can be in a room, 0 for no limit 178 | # max_participants: 0 179 | # # only accept specific codecs for clients publishing to this room 180 | # # this is useful to standardize codecs across clients 181 | # # other supported codecs are video/h264, video/vp9, video/av1, audio/red 182 | # enabled_codecs: 183 | # - mime: audio/opus 184 | # - mime: video/vp8 185 | # # allow tracks to be unmuted remotely, defaults to false 186 | # # tracks can always be muted from the Room Service APIs 187 | # enable_remote_unmute: true 188 | # # limit size of room and participant's metadata, 0 for no limit 189 | # max_metadata_size: 0 190 | # # control playout delay in ms of video track (and associated audio track) 191 | # playout_delay: 192 | # enabled: true 193 | # min: 100 194 | # max: 2000 195 | # # improves A/V sync when playout_delay set to a value larger than 200ms. It will disables transceiver re-use 196 | # # so not recommended for rooms with frequent subscription changes 197 | # sync_streams: true 198 | 199 | # Webhooks 200 | # when configured, LiveKit notifies your URL handler with room events 201 | # webhook: 202 | # # the API key to use in order to sign the message 203 | # # this must match one of the keys LiveKit is configured with 204 | # api_key: 205 | # # list of URLs to be notified of room events 206 | # urls: 207 | # - https://your-host.com/handler 208 | 209 | # Signal Relay 210 | # since v1.4.0, a more reliable, psrpc based signal relay is available 211 | # this gives us the ability to reliably proxy messages between a signal server and RTC node 212 | # signal_relay: 213 | # # amount of time a message delivery is tried before giving up 214 | # retry_timeout: 30s 215 | # # minimum amount of time to wait for RTC node to ack, 216 | # # retries use exponentially increasing wait on every subsequent try 217 | # # with an upper bound of max_retry_interval 218 | # min_retry_interval: 500ms 219 | # # maximum amount of time to wait for RTC node to ack 220 | # max_retry_interval: 5s 221 | # # number of messages to buffer before dropping 222 | # stream_buffer_size: 1000 223 | 224 | # PSRPC 225 | # since v1.5.1, a more reliable, psrpc based internal rpc 226 | # psrpc: 227 | # # maximum number of rpc attempts 228 | # max_attempts: 3 229 | # # initial time to wait for calls to complete 230 | # timeout: 500ms 231 | # # amount of time added to the timeout after each failure 232 | # backoff: 500ms 233 | # # number of messages to buffer before dropping 234 | # buffer_size: 1000 235 | 236 | # customize audio level sensitivity 237 | # audio: 238 | # # minimum level to be considered active, 0-127, where 0 is loudest 239 | # # defaults to 30 240 | # active_level: 30 241 | # # percentile to measure, a participant is considered active if it has exceeded the 242 | # # ActiveLevel more than MinPercentile% of the time 243 | # # defaults to 40 244 | # min_percentile: 40 245 | # # frequency in ms to notify changes to clients, defaults to 500 246 | # update_interval: 500 247 | # # to prevent speaker updates from too jumpy, smooth out values over N samples 248 | # smooth_intervals: 4 249 | # # enable red encoding downtrack for opus only audio up track 250 | # active_red_encoding: true 251 | 252 | # turn server 253 | turn: 254 | # Uses TLS. Requires cert and key pem files by either: 255 | # - using turn.secretName if deploying with our helm chart, or 256 | # - setting LIVEKIT_TURN_CERT and LIVEKIT_TURN_KEY env vars with file locations, or 257 | # - using cert_file and key_file below 258 | # defaults to false 259 | enabled: false 260 | # # defaults to 3478 - recommended to 443 if not running HTTP3/QUIC server 261 | # # only 53/80/443 are allowed if less than 1024 262 | # udp_port: 3478 263 | # # defaults to 5349 - if not using a load balancer, this must be set to 443 264 | # tls_port: 5349 265 | # # set UDP port range for TURN relay to connect to LiveKit SFU, by default it uses a any available port 266 | # relay_range_start: 1024 267 | # relay_range_end: 30000 268 | # # set external_tls to true if using a L4 load balancer to terminate TLS. when enabled, 269 | # # LiveKit expects unencrypted traffic on tls_port, and still advertise tls_port as a TURN/TLS candidate. 270 | # external_tls: true 271 | # # needs to match tls cert domain 272 | # domain: turn.myhost.com 273 | # # optional (set only if not using external TLS termination) 274 | # # cert_file: /path/to/cert.pem 275 | # # key_file: /path/to/key.pem 276 | 277 | # ingress server 278 | # ingress: 279 | # # Prefix used to generate RTMP URLs for RTMP ingress. 280 | # rtmp_base_url: "rtmp://my.domain.com/live" 281 | # # Prefix used to generate WHIP URLs for WHIP ingress. 282 | # whip_base_url: "http://my.domain.com/whip" 283 | 284 | # Region of the current node. Required if using regionaware node selector 285 | # region: us-west-2 286 | 287 | # # node selector 288 | # node_selector: 289 | # # default: any. valid values: any, sysload, cpuload, regionaware 290 | # kind: sysload 291 | # # priority used for selection of node when multiple are available 292 | # # default: random. valid values: random, sysload, cpuload, rooms, clients, tracks, bytespersec 293 | # sort_by: sysload 294 | # # used in sysload and regionaware 295 | # # do not assign room to node if load per CPU exceeds sysload_limit 296 | # sysload_limit: 0.7 297 | # # used in regionaware 298 | # # list of regions and their lat/lon coordinates 299 | # regions: 300 | # - name: us-west-2 301 | # lat: 44.19434095976287 302 | # lon: -123.0674908379146 303 | 304 | # # node limits 305 | # # set to -1 to disable a limit 306 | # limit: 307 | # # defaults to 400 tracks in & out per CPU, up to 8000 308 | # num_tracks: -1 309 | # # defaults to 1 GB/s, or just under 10 Gbps 310 | # bytes_per_sec: 1_000_000_000 311 | # # how many tracks (audio / video) that a single participant can subscribe at same time. 312 | # # if the limit is exceeded, subscriptions will be pending until any subscribed track has been unsubscribed. 313 | # # value less or equal than 0 means no limit. 314 | # subscription_limit_video: 0 315 | # subscription_limit_audio: 0 316 | -------------------------------------------------------------------------------- /conf/lk-jwt.conf: -------------------------------------------------------------------------------- 1 | LIVEKIT_URL=wss://__SFU_DOMAIN__/livekit/sfu 2 | LIVEKIT_KEY=element_call 3 | LIVEKIT_SECRET=__LIVEKIT_SECRET__ 4 | LIVEKIT_JWT_PORT=__PORT_LIVEKIT_JWT__ 5 | -------------------------------------------------------------------------------- /conf/log.yaml: -------------------------------------------------------------------------------- 1 | # WARNING: Don't edit this file. All change will be removed after each app upgrade 2 | 3 | version: 1 4 | 5 | formatters: 6 | precise: 7 | format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s' 8 | 9 | handlers: 10 | file: 11 | class: logging.handlers.TimedRotatingFileHandler 12 | formatter: precise 13 | filename: /var/log/matrix-__APP__/homeserver.log 14 | when: midnight 15 | backupCount: 3 # Does not include the current log file. 16 | encoding: utf8 17 | 18 | # Default to buffering writes to log file for efficiency. 19 | # WARNING/ERROR logs will still be flushed immediately, but there will be a 20 | # delay (of up to `period` seconds, or until the buffer is full with 21 | # `capacity` messages) before INFO/DEBUG logs get written. 22 | buffer: 23 | class: synapse.logging.handlers.PeriodicallyFlushingMemoryHandler 24 | target: file 25 | 26 | # The capacity is the maximum number of log lines that are buffered 27 | # before being written to disk. Increasing this will lead to better 28 | # performance, at the expensive of it taking longer for log lines to 29 | # be written to disk. 30 | # This parameter is required. 31 | capacity: 10 32 | 33 | # Logs with a level at or above the flush level will cause the buffer to 34 | # be flushed immediately. 35 | # Default value: 40 (ERROR) 36 | # Other values: 50 (CRITICAL), 30 (WARNING), 20 (INFO), 10 (DEBUG) 37 | flushLevel: 30 # Flush immediately for WARNING logs and higher 38 | 39 | # The period of time, in seconds, between forced flushes. 40 | # Messages will not be delayed for longer than this time. 41 | # Default value: 5 seconds 42 | period: 5 43 | 44 | # A handler that writes logs to stderr. Unused by default, but can be used 45 | # instead of "buffer" and "file" in the logger handlers. 46 | console: 47 | class: logging.StreamHandler 48 | formatter: precise 49 | 50 | loggers: 51 | synapse.storage.SQL: 52 | # beware: increasing this to DEBUG will make synapse log sensitive 53 | # information such as access tokens. 54 | level: INFO 55 | 56 | root: 57 | level: INFO 58 | 59 | # Write logs to the `buffer` handler, which will buffer them together in memory, 60 | # then write them to a file. 61 | # 62 | # Replace "buffer" with "console" to log to stderr instead. 63 | # 64 | handlers: [buffer] 65 | 66 | disable_existing_loggers: false 67 | -------------------------------------------------------------------------------- /conf/nginx.conf: -------------------------------------------------------------------------------- 1 | rewrite ^$ /; 2 | location ~ ^/$ { 3 | default_type text/plain; 4 | return 200 "This is where Synapse is installed."; 5 | } 6 | 7 | location ~ ^(/_matrix|/client) { 8 | proxy_pass http://localhost:__PORT_SYNAPSE__; 9 | proxy_set_header X-Forwarded-For $remote_addr; 10 | proxy_set_header X-Forwarded-Proto $scheme; 11 | proxy_set_header Host $host; 12 | 13 | client_max_body_size __MAX_UPLOAD_SIZE__; 14 | } 15 | 16 | # Use the specific path for the php file. It's more secure than global php path 17 | location ^~ /_matrix/cas_server.php/ { 18 | alias /var/www/__APP__/cas/; 19 | fastcgi_split_path_info ^(.+?\.php)(/.*)$; 20 | fastcgi_pass unix:/run/php/php__PHP_VERSION__-fpm-__APP__.sock; 21 | include fastcgi_params; 22 | fastcgi_param REMOTE_USER $remote_user; 23 | fastcgi_param PATH_INFO $fastcgi_path_info; 24 | fastcgi_param SCRIPT_FILENAME cas_server.php; 25 | } 26 | 27 | location /_synapse/ { 28 | proxy_pass http://localhost:__PORT_SYNAPSE__; 29 | proxy_set_header X-Forwarded-For $remote_addr; 30 | proxy_set_header X-Forwarded-Proto $scheme; 31 | proxy_set_header Host $host; 32 | 33 | client_max_body_size 10M; 34 | } 35 | 36 | location /livekit/jwt/ { 37 | proxy_pass http://127.0.0.1:__PORT_LIVEKIT_JWT__/; 38 | more_set_headers "Access-Control-Allow-Origin: *"; 39 | } 40 | 41 | location /livekit/sfu/ { 42 | proxy_pass http://127.0.0.1:__PORT_LIVEKIT__/; 43 | proxy_http_version 1.1; 44 | proxy_set_header Upgrade $http_upgrade; 45 | proxy_set_header Connection $connection_upgrade; 46 | 47 | proxy_set_header Host $host; 48 | proxy_set_header X-Forwarded-Server $host; 49 | proxy_set_header X-Real-IP $remote_addr; 50 | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 51 | proxy_set_header X-Forwarded-Proto $scheme; 52 | } 53 | include /etc/nginx/conf.d/__DOMAIN__.d/__APP__.conf.inc; 54 | -------------------------------------------------------------------------------- /conf/nginx.conf.inc: -------------------------------------------------------------------------------- 1 | location = /.well-known/matrix/server { 2 | return 200 '{"m.server": "{{ domain }}:{{ port_synapse_tls }}"}'; 3 | default_type application/json; 4 | more_set_headers "Access-Control-Allow-Origin: *"; 5 | } 6 | 7 | location = /.well-known/matrix/client { 8 | return 200 '{ 9 | "m.homeserver": { "base_url": "https://{{ domain }}" }, 10 | "im.vector.riot.jitsi": {"preferredDomain": "{{ jitsi_server }}"}, 11 | "im.vector.riot.e2ee": {"default": {{ e2e_enabled_by_default_client_config }} }, 12 | "org.matrix.msc4143.rtc_foci": [ 13 | { 14 | "type": "livekit", 15 | "livekit_service_url": "https://{{ domain }}/livekit/jwt" 16 | }, 17 | { 18 | "type": "nextgen_new_foci_type", 19 | "props_for_nextgen_foci": "val" 20 | } 21 | ] 22 | }'; 23 | default_type application/json; 24 | more_set_headers "Access-Control-Allow-Origin: *"; 25 | } 26 | 27 | location = /.well-known/matrix/support { 28 | return 200 '{ 29 | "contacts": [ 30 | {%- if contact_admin_matrix_id | length > 0 or contact_admin_email | length > 0 %} 31 | { 32 | {%- if contact_admin_matrix_id | length > 0 %} 33 | "matrix_id": "{{ contact_admin_matrix_id }}", 34 | {%- endif %} 35 | {%- if contact_admin_email | length > 0 %} 36 | "email_address": "{{ contact_admin_email }}", 37 | {%- endif %} 38 | "role": "m.role.admin" 39 | } 40 | {%- endif %} 41 | ] 42 | {%- if contact_support_page | length > 0 %}, 43 | "support_page": "{{ contact_support_page }}" 44 | {%- endif %} 45 | }'; 46 | } 47 | -------------------------------------------------------------------------------- /conf/requirement_bookworm.txt: -------------------------------------------------------------------------------- 1 | annotated-types==0.7.0 2 | attrs==25.3.0 3 | Automat==25.4.16 4 | bcrypt==4.3.0 5 | bleach==6.2.0 6 | canonicaljson==2.0.0 7 | certifi==2025.4.26 8 | cffi==1.17.1 9 | charset-normalizer==3.4.2 10 | constantly==23.10.4 11 | cryptography==45.0.2 12 | hyperlink==21.0.0 13 | idna==3.10 14 | ijson==3.4.0 15 | immutabledict==4.2.1 16 | incremental==24.7.2 17 | Jinja2==3.1.6 18 | jsonschema==4.23.0 19 | jsonschema-specifications==2025.4.1 20 | ldap3==2.9.1 21 | lxml==5.4.0 22 | MarkupSafe==3.0.2 23 | matrix-common==1.3.0 24 | matrix-synapse==1.130.0 25 | matrix-synapse-ldap3==0.3.0 26 | msgpack==1.1.0 27 | ndg-httpsclient==0.5.1 28 | netaddr==1.3.0 29 | packaging==25.0 30 | phonenumbers==9.0.5 31 | pillow==11.2.1 32 | prometheus_client==0.22.0 33 | psycopg2==2.9.10 34 | pyasn1==0.6.1 35 | pyasn1_modules==0.4.2 36 | pycparser==2.22 37 | pydantic==2.11.4 38 | pydantic_core==2.33.2 39 | pymacaroons==0.13.0 40 | PyNaCl==1.5.0 41 | pyOpenSSL==25.1.0 42 | python-multipart==0.0.20 43 | PyYAML==6.0.2 44 | referencing==0.36.2 45 | requests==2.32.3 46 | rpds-py==0.25.0 47 | semantic-version==2.10.0 48 | service-identity==24.2.0 49 | setuptools-rust==1.11.1 50 | signedjson==1.1.4 51 | six==1.17.0 52 | sortedcontainers==2.4.0 53 | treq==24.9.1 54 | Twisted==24.11.0 55 | typing-inspection==0.4.0 56 | typing_extensions==4.13.2 57 | unpaddedbase64==2.1.0 58 | urllib3==2.4.0 59 | webencodings==0.5.1 60 | zope.interface==7.2 61 | -------------------------------------------------------------------------------- /conf/requirement_bullseye.txt: -------------------------------------------------------------------------------- 1 | annotated-types==0.7.0 2 | attrs==25.3.0 3 | Automat==25.4.16 4 | bcrypt==4.3.0 5 | bleach==6.2.0 6 | canonicaljson==2.0.0 7 | certifi==2025.4.26 8 | cffi==1.17.1 9 | charset-normalizer==3.4.2 10 | constantly==23.10.4 11 | cryptography==45.0.2 12 | hyperlink==21.0.0 13 | idna==3.10 14 | ijson==3.4.0 15 | immutabledict==4.2.1 16 | incremental==24.7.2 17 | Jinja2==3.1.6 18 | jsonschema==4.23.0 19 | jsonschema-specifications==2025.4.1 20 | ldap3==2.9.1 21 | lxml==5.4.0 22 | MarkupSafe==3.0.2 23 | matrix-common==1.3.0 24 | matrix-synapse==1.130.0 25 | matrix-synapse-ldap3==0.3.0 26 | msgpack==1.1.0 27 | ndg-httpsclient==0.5.1 28 | netaddr==1.3.0 29 | packaging==25.0 30 | phonenumbers==9.0.5 31 | pillow==11.2.1 32 | prometheus_client==0.22.0 33 | psycopg2==2.9.10 34 | pyasn1==0.6.1 35 | pyasn1_modules==0.4.2 36 | pycparser==2.22 37 | pydantic==2.11.4 38 | pydantic_core==2.33.2 39 | pymacaroons==0.13.0 40 | PyNaCl==1.5.0 41 | pyOpenSSL==25.1.0 42 | python-multipart==0.0.20 43 | PyYAML==6.0.2 44 | referencing==0.36.2 45 | requests==2.32.3 46 | rpds-py==0.25.0 47 | semantic-version==2.10.0 48 | service-identity==24.2.0 49 | setuptools-rust==1.11.1 50 | signedjson==1.1.4 51 | six==1.17.0 52 | sortedcontainers==2.4.0 53 | tomli==2.2.1 54 | treq==24.9.1 55 | Twisted==24.11.0 56 | typing-inspection==0.4.0 57 | typing_extensions==4.13.2 58 | unpaddedbase64==2.1.0 59 | urllib3==2.4.0 60 | webencodings==0.5.1 61 | zope.interface==7.2 62 | -------------------------------------------------------------------------------- /conf/server_name.conf: -------------------------------------------------------------------------------- 1 | include /etc/nginx/conf.d/__DOMAIN__.d/__APP__.conf.inc; 2 | -------------------------------------------------------------------------------- /conf/synapse-coturn.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Coturn 3 | Documentation=man:coturn(1) man:turnadmin(1) man:turnserver(1) 4 | After=syslog.target network-online.target 5 | 6 | [Service] 7 | User=turnserver 8 | Group=turnserver 9 | Type=notify 10 | EnvironmentFile=/etc/matrix-__APP__/coturn_env 11 | ExecStart=/usr/bin/turnserver -c /etc/matrix-__APP__/coturn.conf $EXTRA_OPTIONS --pidfile= 12 | Restart=on-failure 13 | InaccessibleDirectories=/home 14 | PrivateTmp=yes 15 | 16 | LimitCORE=infinity 17 | LimitNOFILE=999999 18 | LimitNPROC=60000 19 | LimitRTPRIO=infinity 20 | LimitRTTIME=7000000 21 | CPUSchedulingPolicy=other 22 | UMask=0007 23 | 24 | # Sandboxing options to harden security 25 | # Depending on specificities of your service/app, you may need to tweak these 26 | # .. but this should be a good baseline 27 | # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html 28 | NoNewPrivileges=yes 29 | PrivateTmp=yes 30 | PrivateDevices=yes 31 | RestrictNamespaces=yes 32 | RestrictRealtime=yes 33 | DevicePolicy=closed 34 | ProtectSystem=full 35 | ProtectControlGroups=yes 36 | ProtectKernelModules=yes 37 | ProtectKernelTunables=yes 38 | LockPersonality=yes 39 | SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @swap 40 | 41 | # Denying access to capabilities that should not be relevant for webapps 42 | # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html 43 | CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD 44 | CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE 45 | CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT 46 | CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK 47 | CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM 48 | CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG 49 | CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE 50 | CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW 51 | CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 52 | 53 | [Install] 54 | WantedBy=multi-user.target 55 | -------------------------------------------------------------------------------- /conf/synapse-livekit.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Synapse livekit RTC backend 3 | After=network.target 4 | 5 | [Service] 6 | Type=simple 7 | User=__APP__ 8 | Group=__APP__ 9 | WorkingDirectory=__INSTALL_DIR__/livekit 10 | ExecStart=__INSTALL_DIR__/livekit/livekit-server --config /etc/matrix-__APP__/livekit.yml __LK_NODE_IP__ 11 | 12 | ### Depending on specificities of your service/app, you may need to tweak these 13 | ### .. but this should be a good baseline 14 | # Sandboxing options to harden security 15 | # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html 16 | NoNewPrivileges=yes 17 | PrivateTmp=yes 18 | PrivateDevices=yes 19 | RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK 20 | RestrictNamespaces=yes 21 | RestrictRealtime=yes 22 | DevicePolicy=closed 23 | ProtectClock=yes 24 | ProtectHostname=yes 25 | ProtectProc=invisible 26 | ProtectSystem=full 27 | ProtectControlGroups=yes 28 | ProtectKernelModules=yes 29 | ProtectKernelTunables=yes 30 | LockPersonality=yes 31 | SystemCallArchitectures=native 32 | SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged 33 | 34 | # Denying access to capabilities that should not be relevant for webapps 35 | # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html 36 | CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD 37 | CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE 38 | CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT 39 | CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK 40 | CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM 41 | CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG 42 | CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE 43 | CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW 44 | CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 45 | 46 | [Install] 47 | WantedBy=multi-user.target 48 | -------------------------------------------------------------------------------- /conf/synapse-lk-jwt.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Synapse RTC JWT livekit backend 3 | After=network.target 4 | 5 | [Service] 6 | Type=simple 7 | User=__APP__ 8 | Group=__APP__ 9 | WorkingDirectory=__INSTALL_DIR__/lk_jwt 10 | EnvironmentFile=/etc/matrix-__APP__/lk-jwt.conf 11 | ExecStart=__INSTALL_DIR__/lk_jwt/lk-jwt-service 12 | 13 | ### Depending on specificities of your service/app, you may need to tweak these 14 | ### .. but this should be a good baseline 15 | # Sandboxing options to harden security 16 | # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html 17 | NoNewPrivileges=yes 18 | PrivateTmp=yes 19 | PrivateDevices=yes 20 | RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK 21 | RestrictNamespaces=yes 22 | RestrictRealtime=yes 23 | DevicePolicy=closed 24 | ProtectClock=yes 25 | ProtectHostname=yes 26 | ProtectProc=invisible 27 | ProtectSystem=full 28 | ProtectControlGroups=yes 29 | ProtectKernelModules=yes 30 | ProtectKernelTunables=yes 31 | LockPersonality=yes 32 | SystemCallArchitectures=native 33 | SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged 34 | 35 | # Denying access to capabilities that should not be relevant for webapps 36 | # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html 37 | CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD 38 | CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE 39 | CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT 40 | CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK 41 | CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM 42 | CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG 43 | CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE 44 | CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW 45 | CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 46 | 47 | [Install] 48 | WantedBy=multi-user.target 49 | -------------------------------------------------------------------------------- /conf/synapse.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Synapse Matrix homeserver 3 | After=network.target postgresql.service 4 | 5 | [Service] 6 | Type=simple 7 | User=__APP__ 8 | WorkingDirectory=__INSTALL_DIR__ 9 | BindPaths=/etc/matrix-__APP__ 10 | ExecStartPre=__INSTALL_DIR__/venv/bin/python -m synapse.app.homeserver --config-path=/etc/matrix-__APP__/homeserver.yaml --config-path=/etc/matrix-__APP__/conf.d/ --generate-keys 11 | ExecStart=__INSTALL_DIR__/venv/bin/python -m synapse.app.homeserver --config-path=/etc/matrix-__APP__/homeserver.yaml --config-path=/etc/matrix-__APP__/conf.d/ 12 | Restart=always 13 | RestartSec=3 14 | 15 | # Sandboxing options to harden security 16 | # Depending on specificities of your service/app, you may need to tweak these 17 | # .. but this should be a good baseline 18 | # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html 19 | NoNewPrivileges=yes 20 | PrivateTmp=yes 21 | PrivateDevices=yes 22 | RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 23 | RestrictNamespaces=yes 24 | RestrictRealtime=yes 25 | DevicePolicy=closed 26 | ProtectSystem=full 27 | ProtectControlGroups=yes 28 | ProtectKernelModules=yes 29 | ProtectKernelTunables=yes 30 | LockPersonality=yes 31 | SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap 32 | 33 | # Denying access to capabilities that should not be relevant for webapps 34 | # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html 35 | CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD 36 | CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE 37 | CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT 38 | CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK 39 | CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM 40 | CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG 41 | CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE 42 | CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW 43 | CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 44 | 45 | [Install] 46 | WantedBy=multi-user.target 47 | -------------------------------------------------------------------------------- /conf/turnserver.conf: -------------------------------------------------------------------------------- 1 | # WARNING: Don't edit this file. All change will be removed after each app upgrade 2 | 3 | use-auth-secret 4 | static-auth-secret={{ turnserver_pwd }} 5 | cli-password={{ turnserver_cli_pwd }} 6 | realm={{ domain }} 7 | 8 | tls-listening-port={{ port_turnserver_tls }} 9 | alt-tls-listening-port={{ port_turnserver_alt_tls }} 10 | min-port=49153 11 | max-port=49193 12 | cli-port={{ port_cli }} 13 | 14 | cert=/etc/yunohost/certs/{{ domain }}/crt.pem 15 | pkey=/etc/yunohost/certs/{{ domain }}/key.pem 16 | dh-file=/etc/ssl/private/dh2048.pem 17 | 18 | {% if enable_dtls_for_audio_video_turn_call == 'true' %} 19 | # Block clear communication 20 | no-udp 21 | no-tcp 22 | {% endif %} 23 | 24 | # Block old protocols 25 | no-sslv2 26 | no-sslv3 27 | no-tlsv1 28 | no-tlsv1_1 29 | 30 | log-file=/var/log/matrix-{{ app }}/turnserver.log 31 | pidfile=/run/coturn-{{ app }}/turnserver.pid 32 | simple-log 33 | 34 | # consider whether you want to limit the quota of relayed streams per user (or total) to avoid risk of DoS. 35 | user-quota=12 # 4 streams per video call, so 12 streams = 3 simultaneous relayed calls per user. 36 | total-quota=1200 37 | 38 | # recommended additional local peers to block, to mitigate external access to internal services. 39 | # https://www.rtcsec.com/article/slack-webrtc-turn-compromise-and-bug-bounty/#how-to-fix-an-open-turn-relay-to-address-this-vulnerability 40 | no-multicast-peers 41 | denied-peer-ip=0.0.0.0-0.255.255.255 42 | denied-peer-ip=127.0.0.0-127.255.255.255 43 | 44 | # Max time 12h 45 | max-allocate-lifetime=43200 46 | 47 | {%- for ip in turn_external_ip.strip(',').split(',') %} 48 | external-ip={{ ip }} 49 | {%- endfor %} 50 | -------------------------------------------------------------------------------- /config_panel.toml: -------------------------------------------------------------------------------- 1 | version = "1.0" 2 | 3 | [main] 4 | name = "Main Settings" 5 | services = ["__APP__"] 6 | 7 | [main.welcome] 8 | name = "Experience for new Users" 9 | 10 | [main.welcome.enable_registration] 11 | ask = "Enable Registration for new users" 12 | type = "boolean" 13 | yes = "true" 14 | no = "false" 15 | help = "Defaults to 'false'. If 'true', it is highly recommended to use either captcha, email, or token-based verification to avoid SPAM." 16 | 17 | # Disabled for matrix V2 because some client like Element X don't support cas and so require to have password authentication enabled 18 | # [main.welcome.password_enabled] 19 | # ask = "Enable Password Login" 20 | # type = "boolean" 21 | # yes = "true" 22 | # no = "false" 23 | # help = "If disabled, Login with Non-YunoHost Users impossible. But it simplies Login process if your Matrix server only has YunoHost SSO Users." 24 | # visible = "! enable_registration" 25 | 26 | [main.welcome.registrations_require_3pid] 27 | ask = "Registration requires all following 3PID personal identifier" 28 | type = "select" 29 | choices = ["email", "msisdn", "email&msisdn"] 30 | help = "! Warning msisdn (Phone number) registration require a third party service which send confirmation token by SMS.\nDo not select msisdn if you don't know what to do. And don't select user msisdn if you don't understand privacy flow\nDefaults to: 'email'." 31 | visible = "enable_registration" 32 | 33 | [main.welcome.allowed_local_3pids_email] 34 | ask = "Register only with given email formats" 35 | type = "tags" 36 | help = '( e.g. ^[^@]+@matrix\\.org$ )' 37 | 38 | [main.welcome.allowed_local_3pids_msisdn] 39 | ask = "Register only with given phone number formats" 40 | type = "tags" 41 | help = '( e.g. \\+33 )' 42 | 43 | [main.welcome.disable_msisdn_registration] 44 | ask = "Disable asking Phone Number in Registration flow" 45 | type = "boolean" 46 | yes = "true" 47 | no = "false" 48 | help = "Overrides 3PID settings if MSISDNs are set as required." 49 | visible = "enable_registration" 50 | 51 | [main.welcome.account_threepid_delegates_msisdn] 52 | ask = "Specify a third party server to send confirmation code by SMS" 53 | type = "string" 54 | help = "That should be an URL with port or API." 55 | visible = 'enable_registration && (registrations_require_3pid == "email&msisdn" || registrations_require_3pid == "msisdn")' 56 | 57 | [main.welcome.auto_join_rooms] 58 | ask = "Auto Join new Users in following Rooms" 59 | type = "tags" 60 | help = "( e.g. #example:example.com ) Users who register on this homeserver will automatically be joined to these rooms. If the room already exists, the join rule must be set to 'public'. See also next setting." 61 | 62 | [main.welcome.autocreate_auto_join_rooms] 63 | ask = "Auto-Create room for Auto Join if not existing" 64 | type = "boolean" 65 | yes = "true" 66 | no = "false" 67 | help = "Setting to false means that if the rooms are not manually created, users cannot be auto-joined. Auto-created rooms will be public and federated by default, this can be customised in CLI with the settings auto_join_*." 68 | 69 | [main.privacy] 70 | name = "Data Privacy" 71 | 72 | [main.privacy.text] 73 | ask = ''' 74 | * "all": any locally-created room 75 | * "invite": any room created with the "private_chat" or "trusted_private_chat" room creation presets 76 | * "off": No encryption by default 77 | ''' 78 | type = "markdown" 79 | 80 | [main.privacy.e2e_enabled_by_default] 81 | ask = "End-to-End Encryption by default for locally-created Rooms" 82 | type = "select" 83 | choices = ["all", "invite", "off"] 84 | help = "Note that encryption can always be turned on manually, even after creation." 85 | 86 | [main.privacy.allow_public_rooms_over_federation] 87 | ask = "Access Public Rooms Directory over Federation" 88 | type = "boolean" 89 | yes = "true" 90 | no = "false" 91 | help = "Disabled by default. If disabled, users on other homeserver will not be able to look for a public room on your homeserver. They will have to type the ID of the room to join." 92 | 93 | [main.privacy.push_include_content] 94 | ask = "Disable content sharing inside push notification" 95 | type = "boolean" 96 | yes = "true" 97 | no = "false" 98 | help = "Send content message and sender information in push notification. Set to false increase privacy when GAFAM notification service is used (ie: when element client is downloaded thrue Gplay store)." 99 | 100 | [main.experience] 101 | name = "User Experience" 102 | 103 | [main.experience.web_client_location] 104 | ask = "Element instance your HomeServer should redirect to" 105 | type = "url" 106 | help = "URL to the web client which / will redirect to." 107 | 108 | [main.experience.enable_group_creation] 109 | ask = "Allow non-server-admin Users to create Spaces" 110 | type = "boolean" 111 | yes = "true" 112 | no = "false" 113 | help = "Disabled by default: only server admins can create Spaces" 114 | 115 | [main.experience.enable_notifs] 116 | ask = "Enable sending emails for messages the user missed" 117 | type = "boolean" 118 | yes = "true" 119 | no = "false" 120 | help = "Defaults to 'false'." 121 | 122 | [main.experience.notif_for_new_users] 123 | ask = "Enable email notifications for new users" 124 | type = "boolean" 125 | yes = "true" 126 | no = "false" 127 | help = "Defaults to 'true'." 128 | visible = "enable_notifs" 129 | 130 | [main.experience.client_base_url] 131 | ask = "URL for client links within the email notifications" 132 | type = "url" 133 | help = "Used to be called 'riot_base_url', still supported" 134 | visible = "enable_notifs" 135 | 136 | [main.contacts] 137 | name.en = "Contact for the administrator of the synapse instance" 138 | help.en = "Related to the Matrix [MSC 1929](https://github.com/matrix-org/matrix-spec-proposals/blob/hs/proposal-admin-contact-1/proposals/1929-admin-contact.md) used to provide an administrator contact in case of abuse on the instance." 139 | 140 | [main.contacts.contact_admin_email] 141 | ask = "Email contact of the instance admin" 142 | help = '( e.g. admin@hello.example )' 143 | type = "email" 144 | 145 | [main.contacts.contact_admin_matrix_id] 146 | ask = "Matrix ID of the instance admin" 147 | help = '( e.g. @admin:hello.example )' 148 | type = "string" 149 | 150 | [main.contacts.contact_support_page] 151 | ask = "Contact page for the instance" 152 | help = '( e.g. https://domain.tld/support.html )' 153 | type = "url" 154 | 155 | [main.admin_users] 156 | name = "Add admin user" 157 | 158 | [main.admin_users.add_admin_user_username] 159 | type = "user" 160 | bind = "null" 161 | ask = "Give the username to set as admin" 162 | 163 | [main.admin_users.add_admin_user] 164 | type = "button" 165 | ask = "Set user as admin" 166 | enabled = "add_admin_user_username" 167 | 168 | [resources] 169 | name = "Resource Usage" 170 | services = ["__APP__"] 171 | 172 | [resources.media] 173 | name = "Manage Media growth and clean-up" 174 | 175 | [resources.media.max_upload_size] 176 | ask = "Largest allowed media upload size in bytes" 177 | type = "string" 178 | help = "Defaults to: '10M' . Format : <[GMK]?>" 179 | 180 | [advanced] 181 | name = "Advanced Settings" 182 | services = ["__APP__"] 183 | 184 | [advanced.others] 185 | name = "Others" 186 | 187 | [advanced.others.report_stats] 188 | ask = "Server statistics" 189 | type = "boolean" 190 | yes = "true" 191 | no = "false" 192 | help = "Enable to send anonymous statistics to Synapse Developers to improve performance." 193 | 194 | [advanced.guests] 195 | name = "Experience for Guests / Anonymous" 196 | 197 | [advanced.guests.invite_client_location] 198 | ask = "Web client location to direct users to during an invite" 199 | type = "url" 200 | help = "This is passed to the identity server as the org.matrix.web_client_location key. Defaults to unset, giving no guidance to the identity server." 201 | 202 | [advanced.guests.allow_guest_access] 203 | ask = "Allow Users to Register as Guests" 204 | type = "boolean" 205 | yes = "true" 206 | no = "false" 207 | help = "Guests can participate on this server in rooms with guest access enabled, without a password/email/etc." 208 | 209 | [advanced.guests.auto_join_rooms_for_guests] 210 | ask = "Enable Auto Join Room for Guests" 211 | type = "boolean" 212 | yes = "true" 213 | no = "false" 214 | help = "Defaults to 'true'." 215 | visible = "allow_guest_access" 216 | 217 | [advanced.privacy] 218 | name = "Data Privacy" 219 | 220 | [advanced.privacy.enable_3pid_lookup] 221 | ask = "Allow discovering friends with phone number or email" 222 | type = "boolean" 223 | yes = "true" 224 | no = "false" 225 | help = "Enable 3PIDs lookup requests to identity servers from this server. See Settings->General->Discovery in Element." 226 | 227 | [advanced.privacy.default_identity_server] 228 | ask = "Identity server suggested to clients" 229 | type = "url" 230 | help = "Identity server allows to discover, be discovered and invite people you know with phone number or email. If not set, users will probably chose centralized vector.im. See Settings->General->Discovery in Element." 231 | 232 | [advanced.privacy.allow_public_rooms_without_auth] 233 | ask = "Access Public Rooms Directory without authentification" 234 | type = "boolean" 235 | yes = "true" 236 | no = "false" 237 | help = "Disabled by default. If enabled, anyone can query the Public Rooms Directory (access through the client API). This only makes sense if you want everyone to be able to scroll your public room to see what's interesting on your Homeserver" 238 | 239 | [advanced.registration] 240 | name = "Account Registration" 241 | 242 | [advanced.registration.registration_shared_secret] 243 | ask = "Shared Secret for Registration" 244 | type = "string" 245 | help = "Allows registration of standard or admin accounts, even if Registration disabled." 246 | 247 | [advanced.security] 248 | name = "Security" 249 | 250 | [advanced.security.enable_dtls_for_audio_video_turn_call] 251 | ask = "Enable TLS/DTLS on Audio/Video call" 252 | type = "boolean" 253 | yes = "true" 254 | no = "false" 255 | help = "Enabling TLS/DTLS is really recommanded but it could bring some issues depending of the server certificate. There are some known issues with let's encrypt (https://github.com/element-hq/element-android/issues/1533), so if you have issues it could be better to disable this feature." 256 | 257 | [advanced.security.allow_to_send_request_to_localhost] 258 | ask = "Allow synapse to send request to localhost" 259 | type = "boolean" 260 | yes = "true" 261 | no = "false" 262 | help = "This could be needed by example if you self host on the same Yunohost instance a ntfy server for notifications. In this case to allow synapse to contact the ntfy server you will need to enable this settings." 263 | -------------------------------------------------------------------------------- /doc/ADMIN.md: -------------------------------------------------------------------------------- 1 | ## Web client 2 | 3 | The most well-known Matrix web client is Element, which is available in the YunoHost app catalog: . 4 | 5 | ### Important Security Note 6 | 7 | We do not recommend running Element from the same domain name as your Matrix homeserver (synapse). The reason is the risk of XSS (cross-site-scripting) vulnerabilities that could occur if someone caused Element to load and render malicious user generated content from a Matrix API which then had trusted access to Element (or other apps) due to sharing the same domain. 8 | 9 | We have put some coarse mitigations into place to try to protect against this situation, but it's still not a good practice to do it in the first place. See https://github.com/vector-im/element-web/issues/1977 for more details. 10 | 11 | ## Admin UI 12 | 13 | You may be interested in the synapse-admin app, which provides an administration interface for synapse: . 14 | 15 | Then, to log in the API with your admin credentials (cf next section) 16 | 17 | ### Set user as admin 18 | 19 | Currently, the client interface doesn't allow to grant admin rights. 20 | So you can follow this process to set the user as admin: 21 | 1. Login with any client as a standards user (like Element). This will create the user in synapse. 22 | 2. You have theses 2 solution: 23 | - On the Yunohost Webadmin, go on: Applications > Synapse > Main Settings > On the "Add admin user" section you can select the user to set as admin. 24 | - You can run this following script: 25 | ```bash 26 | __INSTALL_DIR__/set_admin_user.sh '@:' 27 | ``` 28 | 29 | ## Access by federation 30 | 31 | If your server name is identical to the domain on which synapse is installed, and the default port 8448 is used, your server is normally already accessible by the federation. 32 | 33 | If not, you can add the following line in the dns configuration but you normally don't need it as a `.well-known` file is edited during the install to declare your server name and port to the federation. 34 | 35 | ``` 36 | _matrix._tcp. IN SRV 10 0 37 | ``` 38 | for example 39 | ``` 40 | _matrix._tcp.example.com. 3600 IN SRV 10 0 synapse.example.com. 41 | ``` 42 | You need to replace `` by the real port. This port can be obtained by the command: `yunohost app setting __APP__ port_synapse_tls` 43 | 44 | For more details, see : https://github.com/element-hq/synapse/blob/master/docs/federate.md 45 | 46 | If it is not automatically done, you need to open this in your ISP box. 47 | 48 | You also need a valid TLS certificate for the domain used by synapse. To do that you can refer to the documentation here : https://yunohost.org/#/certificate_en 49 | 50 | https://federationtester.matrix.org/ can be used to easily debug federation issues 51 | 52 | ## Voip / Video conferencing 53 | 54 | There are 2 version of call. The second version is also named "Element call". Depending of the client the version 1 or the version 2 will be selected. This following table resume the support of the clients: 55 | 56 | |Client name|Platform|Call version supported|Comments| 57 | |-----------|--------|----------------------|--------| 58 | |Element web|Multiplatform|Version 1 and 2 |The version 1 and 2 can be enabled/disabled with in [the config panel](https://github.com/YunoHost-Apps/element_ynh/blob/34cd7e4c6c8e27263baa58f53353c223ee13d3e8/config_panel.toml#L81-L110) into the section "Element configuration" > "Audio and video call"| 59 | |Element |Android |1 only|| 60 | |Element X |Android |2 only|| 61 | |Element desktop|Linux, Windows, Mac|Version 1 and 2|Can be selected when starting the call| 62 | 63 | In matrix v1 the audio and video call for 1 to 1 is handled by the turnserver which is installed and configured. For the video call with more than 2 person the call is handled by an external Jitsi server. If needed this can be changed with the app settings key `jitsi_server`. 64 | 65 | In matrix v2 only video call is supported. The call is handled by the Livekit backend which is also installed and configured. This cover the call from 2 person to a unlimited number of persons (the limitation will depends on the resource provided by the server). 66 | 67 | For both version of call some ports will need to be opened to have everything working correctly. 68 | 69 | The turnserver listens on two UDP and TCP ports. You can get them with these commands: 70 | ```bash 71 | yunohost app setting __APP__ port_turnserver_tls 72 | yunohost app setting __APP__ port_turnserver_alt_tls 73 | ``` 74 | 75 | Livekit will listen on the TCP port (by default 7881). You can get the default port with this command: 76 | ```bash 77 | yunohost app setting __APP__ port_livekit_rtc 78 | ``` 79 | 80 | The turnserver and livekit will also choose a port dynamically when a new call starts. The range is between 49153 - 49193. 81 | 82 | For some security reason the ports range (49153 - 49193) isn't automatically open by default. If you want to use the synapse server for voip or conferencing you will need to open this port range manually. To do this just run this command: 83 | 84 | ```bash 85 | yunohost firewall allow Both 49153:49193 86 | ``` 87 | 88 | You might also need to open these ports (if it is not automatically done) on your ISP box. 89 | 90 | To prevent the situation when the server is behind a NAT, the public IP is written in the turnserver config. By this the turnserver can send its real public IP to the client. For more information see [the coturn example config file](https://github.com/coturn/coturn/blob/master/examples/etc/turnserver.conf#L102-L120).So if your IP changes, you could run the script `/opt/yunohost/matrix-/Coturn_config_rotate.sh` to update your config. 91 | 92 | If you have a dynamic IP address, you also might need to update this config automatically. To do that just edit a file named `/etc/cron.d/coturn_config_rotate` and add the following content. 93 | 94 | ``` 95 | */15 * * * * root bash __INSTALL_DIR__/Coturn_config_rotate.sh; 96 | ``` 97 | 98 | ### OpenVPN 99 | 100 | If your server is behind a VPN, you may want `__APP__-coturn` to automatically restart when the VPN restarts. To do this, create a file named `/usr/local/bin/openvpn_up_script.sh` with this content: 101 | ```bash 102 | #!/bin/bash 103 | 104 | ( 105 | sleep 5 106 | sudo systemctl restart __APP__-coturn.service 107 | ) & 108 | exit 0 109 | ``` 110 | 111 | Add this line in you sudo config file `/etc/sudoers` 112 | ``` 113 | openvpn ALL=(ALL) NOPASSWD: /bin/systemctl restart __APP__-coturn.service 114 | ``` 115 | 116 | And add this line in your OpenVPN config file 117 | ``` 118 | ipchange /usr/local/bin/openvpn_up_script.sh 119 | ``` 120 | 121 | ## Push notification for Android 122 | 123 | [A dedicated post on the forum](https://forum.yunohost.org/t/how-to-setup-push-notification-with-synapse-and-element-or-element-x-android/36897/6) was made to document how to setup ntfy with synapse. 124 | 125 | ## Backup 126 | 127 | Before any major maintenance action, it is recommended to backup the app. 128 | 129 | To ensure the integrity of the data, it is recommended to explictly stop the server during the backup: 130 | 131 | - Stop synapse service with theses following command: 132 | ```bash 133 | systemctl stop __APP__.service 134 | ``` 135 | 136 | - Launch the backup of synapse with this following command: 137 | ```bash 138 | yunohost backup create --app __APP__ 139 | ``` 140 | 141 | - Do a backup of your data with your specific strategy (could be with rsync, borg backup or just cp). The data is generally stored in `/home/yunohost.app/__APP__`. 142 | - Restart the synapse service with these command: 143 | ```bash 144 | systemctl start __APP__.service 145 | ``` 146 | 147 | ## Changing the server URL 148 | 149 | **All documentation of this section is not warranted. A bad use of command could break the app and all the data. So use these commands at your own risk.** 150 | 151 | Synapse give the possibility to change the domain of the instance. Note that this will only change the domain on which the synapse server will run. **This won't change the domain name of the account which is an other thing.** 152 | 153 | The advantage of this is that you can put the app on a specific domain without impacting the domain name of the accounts. For instance you can have the synapse app on `matrix.yolo.net` and the user account will be something like that `@michu:yolo.net`. Note that it's the main difference between the domain of the app (which is `matrix.yolo.net`) and the "server name" which is `yolo.net`. 154 | 155 | **Note that this change will have some important implications:** 156 | - **This will break the connection from all previous connected clients. So all client connected before this change won't be able to communicate with the server until users will do a logout and login (which can also be problematic for e2e keys).** [There are a workaround which are described below](#avoid-the-need-to-reconnect-all-client-after-change-url-operation). 157 | - In some case the client configuration will need to be updated. By example on element we can configure a default matrix server, this settings by example will need to be updated to the new domain to work correctly. 158 | - In case of the "server name" domain are not on the same server than the synapse domain, you will need to update the `.well-known` or your DNS. 159 | 160 | To do the change url of synapse you can do it by this following command or with the webadmin. 161 | 162 | ```bash 163 | yunohost app change-url __APP__ 164 | ``` 165 | 166 | ### Avoid the need to reconnect all client after change-url operation 167 | 168 | If you did change the url of synapse and you don't wan't to reconnect all client, this workaround should solve the issue. 169 | 170 | The idea is to setup again a minimal configuration on the previous domain so the client configurated with the previous domain will still work correctly. 171 | 172 | #### Nginx config 173 | 174 | Retrive the server port with this command: 175 | ```bash 176 | yunohost app setting __APP__ port_synapse 177 | ``` 178 | 179 | Edit the file `/etc/nginx/conf.d/.d/synapse.conf` and add this text: 180 | ``` 181 | location /_matrix/ { 182 | proxy_pass http://localhost:; 183 | proxy_set_header X-Forwarded-For $remote_addr; 184 | proxy_set_header X-Forwarded-Proto $scheme; 185 | proxy_set_header Host $host; 186 | 187 | client_max_body_size 200M; 188 | } 189 | ``` 190 | 191 | Then reload nginx config: 192 | ```bash 193 | systemctl reload nginx.service 194 | ``` 195 | 196 | #### Add permanent rule on SSOWAT 197 | 198 | - Edit the file `/etc/ssowat/conf.json.persistent` 199 | - Add `"/_matrix"` into the list in: `permissions` > `custom_skipped` > `uris` 200 | 201 | Now the configured client before the change-url should work again. 202 | 203 | ## Removing the app 204 | 205 | The YunoHost policy is to not remove the data when removing an app (stored in `__DATA_DIR__`). Use the `--purge` flag during the removal of the app to remove those, or just manually delete the folder after the app is deleted. 206 | -------------------------------------------------------------------------------- /doc/DESCRIPTION.md: -------------------------------------------------------------------------------- 1 | Instant messaging server matrix network. 2 | 3 | Yunohost chatroom with matrix : [https://matrix.to/#/#yunohost:matrix.org](https://matrix.to/#/#yunohost:matrix.org) 4 | -------------------------------------------------------------------------------- /doc/POST_INSTALL.md: -------------------------------------------------------------------------------- 1 | If your server name is identical to the domain on which synapse is installed, and the default port 8448 is used, your server is normally already accessible by the federation. 2 | 3 | If not, you may need to put the following line in the dns configuration: 4 | 5 | ```text 6 | _matrix._tcp.__DOMAIN__. 3600 IN SRV 10 0 __PORT_SYNAPSE_TLS__ __DOMAIN__. 7 | ``` 8 | 9 | For more details, see : https://github.com/element-hq/synapse#setting-up-federation 10 | 11 | You also need to open the TCP port __PORT_SYNAPSE_TLS__ on your ISP box if it's not automatically done. 12 | 13 | Your synapse server also implements a turnserver (for VoIP), to have this fully functional please read [the 'Turnserver' section in here](https://github.com/YunoHost-Apps/synapse_ynh/blob/master/doc/ADMIN.md#turnserver). 14 | 15 | If you're facing an issue or want to improve this app, please open a new issue in this project: https://github.com/YunoHost-Apps/synapse_ynh 16 | 17 | You also need a valid TLS certificate for the domain used by synapse. To do that you can refer to the documentation here : https://yunohost.org/#/certificate_en 18 | -------------------------------------------------------------------------------- /doc/POST_UPGRADE.d/1.130.0~ynh1.md: -------------------------------------------------------------------------------- 1 | This new update provide some internal changes. Mainly: 2 | 3 | - All code are moved in `/var/www` instead of `/opt/yunohost`. This imply that the `Coturn_config_rotate.sh` script is moved into `/var/www`. Some matrix briges might be broken because of this and will need to be updated. 4 | - The support for element call was added. To use this new feature some port need to be open in addition to the previous ports dedicated to turnserver. 5 | - A settings was added into the config panel to provide an admin contact in case of abuse or technical issue. So it's highly recommended set a admin contact (email or/and matrix ID) from the config panel in 'Main settings' > 'Contact for the administrator of the synapse instance' 6 | -------------------------------------------------------------------------------- /doc/PRE_INSTALL.md: -------------------------------------------------------------------------------- 1 | - Synapse consumes a significant amount of resources (both CPU and RAM), and therefore is not recommended for "small" setups such as small ARM boards 2 | - During the install, the generation of Diffie-Hellman parameters may take a significant amount of time. You can speed things up by manually initializing them before running the install: `openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -dsaparam 2048` 3 | - The package uses a prebuilt python virtual environnement. The binary are taken from this repository: . The script to build the binary is also available. 4 | -------------------------------------------------------------------------------- /hooks/post_cert_update: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | if [ $1 == __DOMAIN__ ]; then 4 | systemctl restart __APP__.service 5 | fi 6 | -------------------------------------------------------------------------------- /manifest.toml: -------------------------------------------------------------------------------- 1 | packaging_format = 2 2 | 3 | id = "synapse" 4 | name = "Synapse" 5 | description.en = "Instant messaging server which uses Matrix" 6 | description.fr = "Serveur de messagerie instantané basé sur Matrix" 7 | 8 | version = "1.130.0~ynh1" 9 | 10 | maintainers = ["Josué Tille"] 11 | 12 | [upstream] 13 | license = "AGPL-3.0,Apache-2.0" 14 | website = "https://matrix.org/" 15 | code = "https://github.com/element-hq/synapse" 16 | admindoc = "https://matrix-org.github.io/synapse/latest/welcome_and_overview.html" 17 | cpe = "cpe:2.3:a:matrix:synapse" 18 | fund = "https://matrix.org/support/#" 19 | 20 | [integration] 21 | yunohost = ">= 11.2.30" 22 | helpers_version = "2.1" 23 | architectures = [ 24 | "amd64", 25 | "armhf", 26 | "arm64" 27 | ] 28 | multi_instance = true 29 | ldap = true 30 | sso = "not_relevant" 31 | disk = "250M" 32 | ram.build = "500M" 33 | ram.runtime = "1G" 34 | 35 | [install] 36 | [install.domain] 37 | # this is a generic question - ask strings are automatically handled by Yunohost's core 38 | type = "domain" 39 | 40 | [install.server_name] 41 | ask.en = "Chose a server name if (optional)" 42 | ask.fr = "Choissez un nom de serveur (optionnel)" 43 | help.en = "If your Synapse domain is a subdomain, you can choose a name for your Synapse server to have your Matrix user-ids looking like @user:domain.org instead of @user:synapse.domain.org. Leave the value empty to use the same value than the domain." 44 | help.fr = "Si votre domaine pour Synapse est un sous-domaine, vous pouvez choisir un nom pour votre serveur Synapse afin que vos identifiants Matrix soient @utilisateur:domain.org plutôt que @utilisateur:synapse.domain.org. Laissez la valeur vide afin d'utiliser le même nom que le domaine." 45 | type = "string" 46 | example = "domain.org" 47 | default = "" 48 | optional = true 49 | 50 | [install.is_free_registration] 51 | ask.en = "Is it a server with free registration?" 52 | ask.fr = "Est-ce un serveur avec création de compte libre ?" 53 | help.en = "A public server means that anybody will be able to register on this server." 54 | help.fr = "Un serveur public signifie que n'importe qui pourra s'enregistrer sur ce serveur." 55 | type = "boolean" 56 | default = false 57 | 58 | [install.init_main_permission] 59 | help.en = "Define the users allowed to access to synapse. Setting this to 'visitors' don't make sens in this case." 60 | type = "group" 61 | example = "all_users" 62 | default = "all_users" 63 | 64 | [resources] 65 | [resources.sources.synapse_prebuilt_armv7_bookworm] 66 | prefetch = false 67 | armhf.url = "https://github.com/YunoHost-Apps/synapse_python_build/releases/download/v1.130.0/matrix-synapse_1.130.0-bookworm-bin1_armv7l.tar.gz" 68 | armhf.sha256 = "c646aa244e2e57164cc4a333c602cfa1ba99be36b7e2b5902b41d1cd65c91dab" 69 | 70 | [resources.sources.synapse_prebuilt_armv7_bullseye] 71 | prefetch = false 72 | armhf.url = "https://github.com/YunoHost-Apps/synapse_python_build/releases/download/v1.130.0/matrix-synapse_1.130.0-bullseye-bin1_armv7l.tar.gz" 73 | armhf.sha256 = "14b352295b8744f3daa07643825e2efe7adcff498b678650363bd61f143845af" 74 | 75 | [resources.sources.lk_jwt] 76 | prefetch = true 77 | extract = true 78 | 79 | url = "https://github.com/element-hq/lk-jwt-service/archive/refs/tags/v0.2.3.tar.gz" 80 | sha256 = "68d33629d4aebc12a3bc1bdfc667d052a20f7cc74b44d650abe8f4d8f6a24119" 81 | 82 | [resources.sources.livekit] 83 | prefetch = true 84 | extract = true 85 | in_subdir = false 86 | 87 | amd64.url = "https://github.com/livekit/livekit/releases/download/v1.8.4/livekit_1.8.4_linux_amd64.tar.gz" 88 | amd64.sha256 = "b660f4a72fe493e7c2a27861c403fba3d8c8fec4ce5e223515b26850c24d2dae" 89 | arm64.url = "https://github.com/livekit/livekit/releases/download/v1.8.4/livekit_1.8.4_linux_arm64.tar.gz" 90 | arm64.sha256 = "02f7a7b252d9bd1298e5bc3e301a138cc7d1bc00dc6855fd4c566ff61fb06324" 91 | armhf.url = "https://github.com/livekit/livekit/releases/download/v1.8.4/livekit_1.8.4_linux_armv7.tar.gz" 92 | armhf.sha256 = "" 93 | 94 | [resources.system_user] 95 | allow_email = true 96 | home = "/var/www/__APP__" 97 | 98 | [resources.install_dir] 99 | dir = "/var/www/__APP__" 100 | owner = "__APP__:rwx" 101 | group = "www-data:r-x" 102 | 103 | [resources.data_dir] 104 | dir = "/home/yunohost.app/__APP__" 105 | 106 | [resources.permissions] 107 | main.url = "/" 108 | main.additional_urls = ["/_matrix/cas_server.php/login"] 109 | main.label = "Server SSO" 110 | main.auth_header = true 111 | main.show_tile = false 112 | main.protected = true 113 | 114 | server_api.url = "/_matrix" 115 | server_api.additional_urls = ["/client"] 116 | server_api.label = "Server access for client apps" 117 | server_api.allowed = "visitors" 118 | server_api.auth_header = false 119 | server_api.show_tile = false 120 | server_api.protected = true 121 | 122 | admin_api.url = "/_synapse" 123 | admin_api.label = "Admin API" 124 | admin_api.allowed = "visitors" 125 | admin_api.auth_header = false 126 | admin_api.show_tile = false 127 | admin_api.protected = true 128 | 129 | server_client_infos.url = "/.well-known/matrix" 130 | server_client_infos.allowed = "visitors" 131 | server_client_infos.auth_header = false 132 | server_client_infos.show_tile = false 133 | server_client_infos.protected = true 134 | 135 | livekit.url = "/livekit" 136 | livekit.label = "Element call backend" 137 | livekit.allowed = "visitors" 138 | livekit.auth_header = false 139 | livekit.show_tile = false 140 | livekit.protected = true 141 | 142 | [resources.ports] 143 | synapse_tls.default = 8448 144 | synapse_tls.exposed = "TCP" 145 | synapse.default = 8008 146 | turnserver_tls.default = 5349 147 | turnserver_tls.exposed = "Both" 148 | turnserver_alt_tls.default = 5350 149 | turnserver_alt_tls.exposed = "Both" 150 | cli.default = 5766 151 | livekit.default = 7880 152 | livekit_rtc.default = 7881 153 | livekit_rtc.exposed = "TCP" 154 | livekit_jwt.default = 8080 155 | 156 | [resources.apt] 157 | packages = ["coturn", "acl", "postgresql", "php8.3-fpm", 158 | "python3-dev", "python3-venv", "python3-pip", "python3-setuptools", "python3-lxml", 159 | "build-essential", "libffi-dev", "libssl-dev", "libxml2-dev", "libxslt1-dev", "zlib1g-dev", "libjpeg-dev", "libpq-dev"] 160 | 161 | [resources.database] 162 | type = "postgresql" 163 | -------------------------------------------------------------------------------- /scripts/_common.sh: -------------------------------------------------------------------------------- 1 | readonly python_version="$(python3 -V | cut -d' ' -f2 | cut -d. -f1-2)" 2 | go_version=1.24.2 3 | readonly domains_list="$(yunohost --output-as json domain list | jq -r '.domains | .[]')" 4 | # 5 | # TODO Ideally we must have a dedicated domain for this but for now it's not supported 6 | # so we just use the main app domain 7 | # Since Yunohost support multiple domain for the same app we should move it to sfu.$domain 8 | # 9 | readonly sfu_domain="$domain" 10 | 11 | install_sources() { 12 | # Install/upgrade synapse in virtualenv 13 | 14 | # Clean venv is it was on python2.7 or python3 with old version in case major upgrade of debian 15 | if [ ! -e "$install_dir/venv"/bin/python3 ] || [ ! -e "$install_dir/venv/lib/python$python_version" ]; then 16 | ynh_safe_rm "$install_dir/venv"/bin 17 | ynh_safe_rm "$install_dir/venv"/lib 18 | ynh_safe_rm "$install_dir/venv"/lib64 19 | ynh_safe_rm "$install_dir/venv"/include 20 | ynh_safe_rm "$install_dir/venv"/share 21 | ynh_safe_rm "$install_dir/venv"/pyvenv.cfg 22 | fi 23 | 24 | mkdir -p "$install_dir/venv" 25 | chown "$app":root -R "$install_dir/venv" 26 | 27 | if [ -n "$(uname -m | grep arm)" ] 28 | then 29 | # Clean old file, sometimes it could make some big issues if we don't do this!! 30 | ynh_safe_rm "$install_dir/venv"/bin 31 | ynh_safe_rm "$install_dir/venv"/lib 32 | ynh_safe_rm "$install_dir/venv"/include 33 | ynh_safe_rm "$install_dir/venv"/share 34 | 35 | ynh_setup_source --dest_dir="$install_dir/venv"/ --source_id="synapse_prebuilt_armv7_$(lsb_release --codename --short)" 36 | 37 | # Fix multi-instance support 38 | for f in "$install_dir/venv"/bin/*; do 39 | ynh_replace_regex --match='#!/opt/yunohost/matrix-synapse' --replace='#!'"$install_dir/venv" --file="$f" 40 | done 41 | else 42 | 43 | # Install virtualenv if it don't exist 44 | test -e "$install_dir/venv"/bin/python3 || python3 -m venv "$install_dir/venv" 45 | 46 | # Install synapse in virtualenv 47 | local pip3="$install_dir/venv"/bin/pip3 48 | 49 | $pip3 install --upgrade setuptools wheel pip cffi 50 | $pip3 install --upgrade -r "$YNH_APP_BASEDIR/conf/requirement_$(lsb_release --codename --short).txt" 51 | fi 52 | 53 | # Apply patch for LDAP auth if needed 54 | # Note that we put patch into scripts dir because /source are not stored and can't be used on restore 55 | if ! grep -F -q '# LDAP Filter anonymous user Applied' "$install_dir/venv/lib/python$python_version/site-packages/ldap_auth_provider.py"; then 56 | pushd "$install_dir/venv/lib/python$python_version/site-packages" 57 | patch < "$YNH_APP_BASEDIR"/scripts/patch/ldap_auth_filter_anonymous_user.patch 58 | popd 59 | fi 60 | 61 | # Install livekit jwt 62 | ynh_setup_source --source_id=lk_jwt --dest_dir="$install_dir/lk_jwt" 63 | 64 | ynh_hide_warnings ynh_go_install 65 | chown "$app" -R "$install_dir" 66 | 67 | pushd "$install_dir/lk_jwt" 68 | ynh_hide_warnings ynh_exec_as_app go build -o lk-jwt-service . 69 | popd 70 | 71 | # Install livekit server for element-call 72 | ynh_setup_source --source_id=livekit --dest_dir="$install_dir/livekit" 73 | } 74 | 75 | get_lk_node_ip() { 76 | local public_ip4 77 | public_ip4="$(curl -s https://ip.yunohost.org)" || true 78 | 79 | lk_node_ip="" 80 | if [ -n "$public_ip4" ] && ynh_validate_ip --family=4 --ip_address="$public_ip4" 81 | then 82 | lk_node_ip="--node-ip $public_ip4" 83 | fi 84 | } 85 | 86 | configure_coturn() { 87 | # Get public IP and set as external IP for coturn 88 | # note : '|| true' is used to ignore the errors if we can't get the public ipv4 or ipv6 89 | local public_ip4 90 | local public_ip6 91 | public_ip4="$(curl -s https://ip.yunohost.org)" || true 92 | public_ip6="$(curl -s https://ipv6.yunohost.org)" || true 93 | 94 | local turn_external_ip="" 95 | if [ -n "$public_ip4" ] && ynh_validate_ip --family=4 --ip_address="$public_ip4" 96 | then 97 | turn_external_ip+="$public_ip4," 98 | fi 99 | if [ -n "$public_ip6" ] && ynh_validate_ip --family=6 --ip_address="$public_ip6" 100 | then 101 | turn_external_ip+="$public_ip6" 102 | fi 103 | ynh_config_add --jinja --template="turnserver.conf" --destination="/etc/matrix-$app/coturn.conf" 104 | } 105 | 106 | configure_nginx() { 107 | local e2e_enabled_by_default_client_config 108 | if [ "$e2e_enabled_by_default" == "off" ]; then 109 | e2e_enabled_by_default_client_config=false 110 | else 111 | e2e_enabled_by_default_client_config=true 112 | fi 113 | 114 | # Create .well-known redirection for access by federation 115 | if yunohost --output-as plain domain list | grep -q "^$server_name$" && [ "$server_name" != "$domain" ] 116 | then 117 | ynh_config_add --template="server_name.conf" --destination="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" 118 | fi 119 | if [ -z "$contact_admin_email" ] && [ -z "$contact_admin_matrix_id" ]; then 120 | ynh_print_warn "It seem that you didn't set a admin contact. Please set a admin contact (email or/and matrix ID) from the config panel in 'Main settings' > 'Contact for the administrator of the synapse instance'" 121 | fi 122 | 123 | ynh_config_add --jinja --template='nginx.conf.inc' --destination="/etc/nginx/conf.d/${domain}.d/${app}.conf.inc" 124 | 125 | # Create a dedicated NGINX config 126 | ynh_config_add_nginx 127 | } 128 | 129 | configure_php() { 130 | ynh_config_add_phpfpm 131 | ynh_replace --match="chdir = $install_dir" \ 132 | --replace="chdir = $install_dir/cas" \ 133 | --file="/etc/php/$php_version/fpm/pool.d/$app.conf" 134 | ynh_store_file_checksum "/etc/php/$php_version/fpm/pool.d/$app.conf" 135 | ynh_systemctl --service="php$php_version-fpm" --action=reload 136 | } 137 | 138 | ensure_vars_set() { 139 | ynh_app_setting_set_default --key=report_stats --value=false 140 | ynh_app_setting_set_default --key=e2e_enabled_by_default --value=invite 141 | ynh_app_setting_set_default --key=turnserver_pwd --value="$(ynh_string_random --length=30)" 142 | ynh_app_setting_set_default --key=turnserver_cli_pwd --value="$(ynh_string_random --length=30)" 143 | 144 | if [ -z "${web_client_location:-}" ] 145 | then 146 | web_client_location="https://matrix.to/" 147 | 148 | element_instance=element 149 | if yunohost --output-as plain app list | grep -q "^$element_instance"'$'; then 150 | element_domain=$(ynh_app_setting_get --app=$element_instance --key=domain) 151 | element_path=$(ynh_app_setting_get --app=$element_instance --key=path) 152 | web_client_location="https://""$element_domain""$element_path" 153 | fi 154 | ynh_app_setting_set --key=web_client_location --value="$web_client_location" 155 | fi 156 | 157 | ynh_app_setting_set_default --key=jitsi_server --value=jitsi.riot.im 158 | 159 | ynh_app_setting_set_default --key=client_base_url --value="$web_client_location" 160 | ynh_app_setting_set_default --key=invite_client_location --value="$web_client_location" 161 | 162 | ynh_app_setting_set_default --key=allow_public_rooms_without_auth --value="${allow_public_rooms:-false}" 163 | ynh_app_setting_set_default --key=allow_public_rooms_over_federation --value="${allow_public_rooms:-false}" 164 | ynh_app_setting_set_default --key=max_upload_size --value=100M 165 | ynh_app_setting_set_default --key=disable_msisdn_registration --value=true 166 | ynh_app_setting_set_default --key=account_threepid_delegates_msisdn --value='' 167 | ynh_app_setting_set_default --key=registrations_require_3pid --value=email 168 | ynh_app_setting_set_default --key=allowed_local_3pids_email --value='' 169 | ynh_app_setting_set_default --key=allowed_local_3pids_msisdn --value='' 170 | ynh_app_setting_set_default --key=account_threepid_delegates_msisdn --value='' 171 | ynh_app_setting_set_default --key=allow_guest_access --value=false 172 | ynh_app_setting_set_default --key=default_identity_server --value='https://matrix.org' 173 | ynh_app_setting_set_default --key=auto_join_rooms --value='' 174 | ynh_app_setting_set_default --key=autocreate_auto_join_rooms --value=false 175 | ynh_app_setting_set_default --key=auto_join_rooms_for_guests --value=true 176 | ynh_app_setting_set_default --key=enable_notifs --value=true 177 | ynh_app_setting_set_default --key=notif_for_new_users --value=true 178 | ynh_app_setting_set_default --key=enable_group_creation --value=true 179 | ynh_app_setting_set_default --key=enable_3pid_lookup --value=false 180 | ynh_app_setting_set_default --key=push_include_content --value=true 181 | ynh_app_setting_set_default --key=enable_dtls_for_audio_video_turn_call --value=true 182 | ynh_app_setting_set_default --key=allow_to_send_request_to_localhost --value=false 183 | 184 | ynh_app_setting_set_default --key=livekit_secret --value="$(ynh_string_random --length=40)" 185 | 186 | ynh_app_setting_set_default --key=contact_admin_email --value='' 187 | ynh_app_setting_set_default --key=contact_admin_matrix_id --value='' 188 | ynh_app_setting_set_default --key=contact_support_page --value='' 189 | } 190 | 191 | set_permissions() { 192 | chown -R "$app:$app" "$install_dir" 193 | chmod -R u+rwX,g+rX-w,o= "$install_dir" 194 | 195 | chmod 750 "$install_dir"/Coturn_config_rotate.sh 196 | chmod 700 "$install_dir"/update_synapse_for_appservice.sh 197 | chmod 700 "$install_dir"/set_admin_user.sh 198 | 199 | chmod 640 "$install_dir"/cas/cas_server.php 200 | chown "$app":www-data "$install_dir" "$install_dir"/cas "$install_dir"/cas/cas_server.php 201 | 202 | if [ "${1:-}" == data ]; then 203 | chmod 750 "$data_dir" 204 | find "$data_dir" \( \! -perm -o= \ 205 | -o \! -user "$app" \ 206 | -o \! -group "$app" \) \ 207 | -exec chown "$app:$app" {} \; \ 208 | -exec chmod o= {} \; 209 | fi 210 | 211 | chown "$app:$app" -R /etc/matrix-"$app" 212 | chmod u=rwX,g=rX,o= -R /etc/matrix-"$app" 213 | setfacl -R -m user:turnserver:rX /etc/matrix-"$app" 214 | 215 | chmod 600 /etc/matrix-"$app"/"$server_name".signing.key 216 | 217 | chown "$app":root -R /var/log/matrix-"$app" 218 | chmod u=rwX,g=rX,o= -R /var/log/matrix-"$app" 219 | setfacl -R -m user:turnserver:rwX /var/log/matrix-"$app" 220 | } 221 | -------------------------------------------------------------------------------- /scripts/backup: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | source ../settings/scripts/_common.sh 4 | source ../settings/scripts/experimental_helper.sh 5 | source /usr/share/yunohost/helpers 6 | 7 | #================================================= 8 | # MANAGE SCRIPT FAILURE 9 | #================================================= 10 | 11 | if systemctl is-active "$app".service --quiet; then 12 | ynh_print_warn "It's hightly recommended to make your backup when the service is stopped. Please stop $app service with this command before to run the backup 'systemctl stop $app.service'" 13 | fi 14 | 15 | ynh_print_info "Declaring files to be backed up..." 16 | 17 | #================================================= 18 | # STANDARD BACKUP STEPS 19 | #================================================= 20 | # BACKUP THE APP MAIN DIR 21 | #================================================= 22 | 23 | ynh_backup "$install_dir" 24 | 25 | #================================================= 26 | # BACKUP THE NGINX CONFIGURATION 27 | #================================================= 28 | 29 | # BACKUP THE PHP-FPM CONFIGURATION 30 | ynh_backup "/etc/php/$php_version/fpm/pool.d/$app.conf" 31 | 32 | ynh_backup "/etc/nginx/conf.d/$domain.d/$app.conf" 33 | ynh_backup "/etc/nginx/conf.d/${domain}.d/${app}.conf.inc" 34 | 35 | # Backup only server name config if it exist 36 | if [ -e "/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" ]; then 37 | ynh_backup "/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" 38 | fi 39 | 40 | #================================================= 41 | # BACKUP THE POSTGRESQL DATABASE 42 | #================================================= 43 | 44 | ynh_psql_dump_db > ${YNH_CWD}/dump.sql 45 | 46 | #================================================= 47 | # BACKUP FAIL2BAN CONFIGURATION 48 | #================================================= 49 | 50 | ynh_backup "/etc/fail2ban/jail.d/$app.conf" 51 | ynh_backup "/etc/fail2ban/filter.d/$app.conf" 52 | 53 | #================================================= 54 | # SPECIFIC BACKUP 55 | #================================================= 56 | # BACKUP SYNAPSE CONFIG 57 | #================================================= 58 | 59 | ynh_backup "/etc/matrix-$app" 60 | 61 | #================================================= 62 | # BACKUP SYSTEMD 63 | #================================================= 64 | 65 | ynh_backup "/etc/systemd/system/$app.service" 66 | ynh_backup "/etc/systemd/system/$app-coturn.service" 67 | ynh_backup /etc/systemd/system/"$app"-livekit.service 68 | ynh_backup /etc/systemd/system/"$app"-lk-jwt.service 69 | 70 | #================================================= 71 | # BACKUP SYNAPSE DATA 72 | #================================================= 73 | 74 | ynh_backup "$data_dir" 75 | 76 | #================================================= 77 | # BACKUP SYNAPSE LOG 78 | #================================================= 79 | 80 | ynh_backup "/var/log/matrix-$app" 81 | 82 | #================================================= 83 | # BACKUP HOOKS 84 | #================================================= 85 | 86 | # Copy hook 87 | ynh_backup "/etc/yunohost/hooks.d/post_cert_update/50-$app" 88 | 89 | #================================================= 90 | # END OF SCRIPT 91 | #================================================= 92 | 93 | ynh_print_info "Backup script completed for $app. (YunoHost will then actually copy those files to the archive)." 94 | -------------------------------------------------------------------------------- /scripts/change_url: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | #================================================= 4 | # GENERIC START 5 | #================================================= 6 | 7 | # IMPORT GENERIC HELPERS 8 | source ./experimental_helper.sh 9 | source ./_common.sh 10 | source /usr/share/yunohost/helpers 11 | 12 | # We stop the service 13 | ynh_systemctl --service="$app".service --action=stop 14 | 15 | #================================================= 16 | # NGINX CONFIGURATION 17 | #================================================= 18 | 19 | ynh_script_progression "Updating NGINX configuration..." 20 | 21 | ynh_config_change_url_nginx 22 | if [ "$domain" != "$old_domain" ]; then 23 | mv "/etc/nginx/conf.d/${old_domain}.d/${app}.conf.inc" "/etc/nginx/conf.d/${domain}.d/${app}.conf.inc" 24 | fi 25 | configure_nginx 26 | 27 | #================================================= 28 | # UPDATE SYNAPSE CONFIG 29 | #================================================= 30 | 31 | ynh_script_progression "Updating Synapse config..." 32 | 33 | # Force enable it because some client like Element X don't support CAS and so require to have password authentication enabled 34 | password_enabled=true 35 | 36 | ynh_config_add --jinja --template="homeserver.yaml" --destination="/etc/matrix-$app/homeserver.yaml" 37 | ynh_config_add --template="log.yaml" --destination="/etc/matrix-$app/log.yaml" 38 | 39 | #================================================= 40 | # SECURE FILES AND DIRECTORIES 41 | #================================================= 42 | 43 | ynh_script_progression "Protecting directories..." 44 | set_permissions 45 | 46 | #================================================= 47 | # RELOAD SERVICES 48 | #================================================= 49 | ynh_script_progression "Restarting Synapse services..." 50 | 51 | ynh_systemctl --service="$app"-coturn.service --action=restart 52 | ynh_systemctl --service="$app".service --action=restart --wait_until="Synapse now listening on TCP port $port_synapse_tls" --log_path="/var/log/matrix-$app/homeserver.log" --timeout=300 53 | 54 | if ! yunohost --output-as plain domain list | grep -q "^$server_name"'$'; then 55 | ynh_print_warn "Note yunohost won't be able to manage the required config for $server_name. So please add the needed DNS config as described on the documentation" 56 | fi 57 | 58 | ynh_script_progression "Change of URL completed for $app" 59 | -------------------------------------------------------------------------------- /scripts/config: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | source ./experimental_helper.sh 4 | source ./_common.sh 5 | source /usr/share/yunohost/helpers 6 | 7 | ynh_app_config_validate() { 8 | # Depending of the status of the $enable_registration we should default value of the hidden fields 9 | if [ "$enable_registration" == 'true' ]; then 10 | # Must enable password authentication when free registration is enabled as any user must be able to authenticate 11 | password_enabled=true 12 | else 13 | registrations_require_3pid=email 14 | disable_msisdn_registration=true 15 | fi 16 | if [ "$enable_notifs" != 'true' ]; then 17 | notif_for_new_users=false 18 | fi 19 | _ynh_app_config_validate 20 | } 21 | 22 | ynh_app_config_apply() { 23 | _ynh_app_config_apply 24 | configure_nginx 25 | 26 | # Force enable it because some client like Element X don't support CAS and so require to have password authentication enabled 27 | password_enabled=true 28 | 29 | ynh_config_add --jinja --template="homeserver.yaml" --destination="/etc/matrix-$app/homeserver.yaml" 30 | ynh_config_add --template="log.yaml" --destination="/etc/matrix-$app/log.yaml" 31 | set_permissions 32 | } 33 | 34 | run__add_admin_user() { 35 | ynh_print_info "Settings '$add_admin_user_username' as admin." 36 | ynh_psql_db_shell <<< "UPDATE users SET admin = 1 WHERE name = '@$add_admin_user_username:$server_name'" 37 | } 38 | 39 | #================================================= 40 | # SELECT THE ACTION FOLLOWING THE GIVEN ARGUMENT 41 | #================================================= 42 | ynh_app_config_run "$1" 43 | -------------------------------------------------------------------------------- /scripts/experimental_helper.sh: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/YunoHost-Apps/synapse_ynh/19f27656c1bfea0921bcab8ed60c6351b0f1b876/scripts/experimental_helper.sh -------------------------------------------------------------------------------- /scripts/install: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | #================================================= 4 | # IMPORT GENERIC HELPERS 5 | #================================================= 6 | 7 | source _common.sh 8 | source experimental_helper.sh 9 | source /usr/share/yunohost/helpers 10 | 11 | ynh_app_setting_set --key=php_upload_max_filesize --value=100M 12 | 13 | #================================================= 14 | # RETRIEVE ARGUMENTS FROM THE MANIFEST 15 | #================================================= 16 | 17 | if [ -z "$server_name" ]; then 18 | server_name="$domain" 19 | ynh_app_setting_set --key=server_name --value="$server_name" 20 | fi 21 | 22 | #================================================= 23 | ## SET STANDARD SETTINGS FROM DEFAULT CONFIG 24 | #================================================= 25 | 26 | ynh_script_progression "Storing installation settings..." 27 | 28 | ensure_vars_set 29 | 30 | mkdir -p "$install_dir"/{cas,venv} 31 | 32 | if [ "$is_free_registration" -eq 0 ] 33 | then 34 | enable_registration=false 35 | password_enabled=false 36 | else 37 | enable_registration=true 38 | password_enabled=true 39 | fi 40 | 41 | ynh_app_setting_set --key=password_enabled --value="$password_enabled" 42 | ynh_app_setting_set --key=enable_registration --value="$enable_registration" 43 | 44 | #================================================= 45 | # Check datadir empty 46 | #================================================= 47 | 48 | if [ -n "$(ls -A "$data_dir")" ]; then 49 | old_data_dir_path="${data_dir}_$(date '+%Y%m%d.%H%M%S')" 50 | ynh_print_warn "Data directory was not empty. Data was moved to $old_data_dir_path" 51 | mkdir -p "$old_data_dir_path" 52 | mv -t "$old_data_dir_path" "$data_dir"/* 53 | fi 54 | 55 | #================================================= 56 | # CREATE A DH FILE 57 | #================================================= 58 | ynh_script_progression "Creating a dh file..." 59 | 60 | # WARNING : theses command are used in INSTALL, UPGRADE, RESTORE 61 | # For any update do it in all files 62 | 63 | # Make dh cert for synapse if it doesn't exist 64 | if [ ! -e /etc/ssl/private/dh2048.pem ] 65 | then 66 | ynh_hide_warnings openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -dsaparam 2048 67 | chown root:ssl-cert /etc/ssl/private/dh2048.pem 68 | chmod 640 /etc/ssl/private/dh2048.pem 69 | fi 70 | 71 | #================================================= 72 | # CREATE DEDICATED USER 73 | #================================================= 74 | ynh_script_progression 'Configuring system groups' 75 | 76 | adduser "$app" ssl-cert 77 | adduser turnserver ssl-cert 78 | 79 | #================================================= 80 | # FIX DB CONFIG 81 | #================================================= 82 | ynh_script_progression "Fixing database type..." 83 | 84 | ynh_psql_db_shell \ 85 | <<< "update pg_database set datcollate='C', datctype='C' where datname='$db_name';" 86 | 87 | #================================================= 88 | # DOWNLOAD, CHECK AND UNPACK SOURCE 89 | #================================================= 90 | ynh_script_progression "Setting up source files..." 91 | 92 | # Create empty dir for synapse 93 | 94 | # WARNING : theses command are used in INSTALL, UPGRADE 95 | # For any update do it in all files 96 | mkdir -p /var/log/matrix-"$app" 97 | mkdir -p /etc/matrix-"$app"/conf.d 98 | mkdir -p /etc/matrix-"$app"/app-service 99 | touch /etc/matrix-"$app"/conf.d/app_service.yaml 100 | 101 | # Install synapse in virtualenv 102 | install_sources 103 | 104 | #================================================= 105 | # CREATE SMALL CAS SERVER 106 | #================================================= 107 | # WARNING : theses command are used in INSTALL, UPGRADE 108 | # For any update do it in all files 109 | 110 | cp ../sources/cas_server.php "$install_dir"/cas/ 111 | 112 | #================================================= 113 | # CREATE SYNAPSE CONFIG 114 | #================================================= 115 | 116 | ynh_script_progression "Creating Synapse config..." 117 | 118 | # Generate config 119 | "$install_dir/venv"/bin/python -m synapse.app.homeserver --keys-directory /etc/matrix-"$app"/ --generate-config --server-name "$server_name" --report-stats=no -c homeserver.yml 120 | 121 | # Get random values from config 122 | registration_shared_secret="$(grep -E "^registration_shared_secret:" homeserver.yml | cut -d'"' -f2)" 123 | form_secret="$(grep -E "^form_secret:" homeserver.yml | cut -d'"' -f2)" 124 | macaroon_secret_key="$(grep -E "^macaroon_secret_key:" homeserver.yml | cut -d'"' -f2)" 125 | 126 | # store in yunohost settings 127 | ynh_app_setting_set --key=registration_shared_secret --value="$registration_shared_secret" 128 | ynh_app_setting_set --key=form_secret --value="$form_secret" 129 | ynh_app_setting_set --key=macaroon_secret_key --value="$macaroon_secret_key" 130 | 131 | #================================================= 132 | # SETUP SYSTEMD 133 | #================================================= 134 | ynh_script_progression "Configuring $app's systemd service..." 135 | 136 | # Create systemd service for synapse and turnserver 137 | ynh_config_add_systemd --template=synapse.service 138 | 139 | cp ../conf/default_coturn /etc/matrix-"$app"/coturn_env 140 | ynh_config_add_systemd --service="$app"-coturn --template=synapse-coturn.service 141 | get_lk_node_ip 142 | ynh_config_add_systemd --service="$app"-livekit --template=synapse-livekit.service 143 | ynh_config_add_systemd --service="$app"-lk-jwt --template=synapse-lk-jwt.service 144 | 145 | #================================================= 146 | # NGINX CONFIGURATION 147 | #================================================= 148 | ynh_script_progression "Configuring NGINX web server..." 149 | 150 | # Create a dedicated php-fpm config 151 | ynh_script_progression "Configuring application..." 152 | 153 | configure_php 154 | 155 | configure_nginx 156 | 157 | #================================================= 158 | # SET SYNAPSE CONFIG 159 | #================================================= 160 | ynh_script_progression "Configuring Synapse..." 161 | 162 | # Force enable it because some client like Element X don't support CAS and so require to have password authentication enabled 163 | password_enabled=true 164 | 165 | ynh_config_add --jinja --template="homeserver.yaml" --destination="/etc/matrix-$app/homeserver.yaml" 166 | ynh_config_add --template="log.yaml" --destination="/etc/matrix-$app/log.yaml" 167 | 168 | #================================================= 169 | # SET COTURN CONFIG 170 | #================================================= 171 | ynh_script_progression "Configuring Coturn..." 172 | 173 | configure_coturn 174 | 175 | #================================================= 176 | # SET Element call CONFIG 177 | #================================================= 178 | ynh_script_progression "Configuring Element call backend..." --weight=1 179 | 180 | ynh_config_add --template=livekit.yml --destination=/etc/matrix-"$app"/livekit.yml 181 | ynh_config_add --template=lk-jwt.conf --destination=/etc/matrix-"$app"/lk-jwt.conf 182 | 183 | #================================================= 184 | # SETUP LOGROTATE 185 | #================================================= 186 | ynh_script_progression "Configuring log rotation..." 187 | 188 | ynh_config_add_logrotate "/var/log/matrix-$app" 189 | 190 | #================================================= 191 | # ADD SCRIPT FOR COTURN CRON AND APP SERVICE 192 | #================================================= 193 | 194 | # WARNING : theses command are used in INSTALL, UPGRADE 195 | # For any update do it in all files 196 | 197 | ynh_config_add --template="../sources/Coturn_config_rotate.sh" --destination="$install_dir/Coturn_config_rotate.sh" 198 | ynh_config_add --template="../sources/update_synapse_for_appservice.sh" --destination="$install_dir/update_synapse_for_appservice.sh" 199 | ynh_config_add --template=../sources/set_admin_user.sh --destination="$install_dir"/set_admin_user.sh 200 | 201 | #================================================= 202 | # SETUP PERMISSIONS 203 | #================================================= 204 | 205 | ynh_script_progression "Configuring permissions..." 206 | 207 | if yunohost --output-as plain domain list | grep -q "^$server_name$"; then 208 | ynh_""permission_url --permission=server_client_infos --add_url="$server_name"/.well-known/matrix 209 | else 210 | ynh_print_warn "Note yunohost won't be able to manage the required config for $server_name. So please add the needed DNS config as described on the documentation" 211 | fi 212 | 213 | #================================================= 214 | # UPDATE HOOKS 215 | #================================================= 216 | 217 | # WARNING : theses command are used in INSTALL, UPGRADE 218 | # For any update do it in all files 219 | ynh_replace --match=__APP__ --replace="$app" --file=../hooks/post_cert_update 220 | ynh_replace --match=__DOMAIN__ --replace="$domain" --file=../hooks/post_cert_update 221 | 222 | #================================================= 223 | # SECURE FILES AND DIRECTORIES 224 | #================================================= 225 | 226 | ynh_script_progression "Protecting directories..." 227 | set_permissions data 228 | 229 | #================================================= 230 | # ADVERTISE SERVICE IN ADMIN PANEL 231 | #================================================= 232 | 233 | yunohost service add "$app" --log "/var/log/matrix-$app/homeserver.log" --needs_exposed_ports "$port_synapse_tls" --description 'Main matrix server service.' 234 | yunohost service add "$app"-coturn --needs_exposed_ports "$port_turnserver_tls" --description 'Turn server for matrix server. Used for audio and video call.' 235 | yunohost service add "$app"-livekit --description 'Livekit server for element call.' 236 | yunohost service add "$app"-lk-jwt --description 'RTC Livekit JWT service for element call.' 237 | 238 | #================================================= 239 | # RELOAD SERVICES 240 | #================================================= 241 | ynh_script_progression "Restarting Synapse services..." 242 | 243 | ynh_systemctl --service="$app"-coturn.service --action=restart 244 | ynh_systemctl --service="$app".service --action=restart --wait_until="Synapse now listening on TCP port $port_synapse_tls" --log_path="/var/log/matrix-$app/homeserver.log" --timeout=300 245 | ynh_systemctl --service="$app"-livekit.service --action=restart 246 | ynh_systemctl --service="$app"-lk-jwt.service --action=restart 247 | 248 | #================================================= 249 | # SETUP FAIL2BAN 250 | #================================================= 251 | ynh_script_progression "Configuring Fail2Ban..." 252 | 253 | ynh_config_add_fail2ban --logpath=/var/log/matrix-"$app"/homeserver.log 254 | 255 | #================================================= 256 | # END OF SCRIPT 257 | #================================================= 258 | 259 | ynh_script_progression "Installation of $app completed" 260 | -------------------------------------------------------------------------------- /scripts/patch/ldap_auth_filter_anonymous_user.patch: -------------------------------------------------------------------------------- 1 | diff --git a/ldap_auth_provider.py b/ldap_auth_provider.py 2 | index 3646948..96296b6 100644 3 | --- a/ldap_auth_provider.py 4 | +++ b/ldap_auth_provider.py 5 | @@ -373,9 +373,12 @@ class LdapAuthProvider: 6 | ], 7 | ) 8 | 9 | + # LDAP Filter anonymous user Applied 10 | ldap_config = _LdapConfig( 11 | enabled=config.get("enabled", False), 12 | - mode=LDAPMode.SIMPLE, 13 | + mode=LDAPMode.SEARCH 14 | + if config.get("mode", "simple") == "search" 15 | + else LDAPMode.SIMPLE, 16 | uri=config["uri"], 17 | start_tls=config.get("start_tls", False), 18 | tls_options=config.get("tls_options"), 19 | @@ -403,6 +406,8 @@ class LdapAuthProvider: 20 | raise ValueError( 21 | "Either bind_password or bind_password_file must be set!" 22 | ) 23 | + 24 | + if ldap_config.mode == LDAPMode.SEARCH: 25 | ldap_config.filter = config.get("filter", None) 26 | 27 | # verify attribute lookup 28 | @@ -461,13 +466,16 @@ class LdapAuthProvider: 29 | server = self._get_server(get_info=ldap3.DSA) 30 | 31 | if self.ldap_bind_dn is None or self.ldap_bind_password is None: 32 | - raise ValueError("Missing bind DN or bind password") 33 | - 34 | - result, conn = await self._ldap_simple_bind( 35 | - server=server, 36 | - bind_dn=self.ldap_bind_dn, 37 | - password=self.ldap_bind_password, 38 | - ) 39 | + result, conn = await self._ldap_simple_bind( 40 | + server=server, 41 | + auth_type=ldap3.ANONYMOUS, 42 | + ) 43 | + else: 44 | + result, conn = await self._ldap_simple_bind( 45 | + server=server, 46 | + bind_dn=self.ldap_bind_dn, 47 | + password=self.ldap_bind_password, 48 | + ) 49 | 50 | if not result: 51 | logger.warning("Unable to get root domain due to failed LDAP bind") 52 | @@ -503,7 +511,11 @@ class LdapAuthProvider: 53 | return self.ldap_root_domain 54 | 55 | async def _ldap_simple_bind( 56 | - self, server: ldap3.ServerPool, bind_dn: str, password: str 57 | + self, 58 | + server: ldap3.ServerPool, 59 | + bind_dn: Optional[str] = None, 60 | + password: Optional[str] = None, 61 | + auth_type: str = ldap3.SIMPLE, 62 | ) -> Tuple[bool, Optional[ldap3.Connection]]: 63 | """Attempt a simple bind with the credentials given by the user against 64 | the LDAP server. 65 | @@ -513,6 +525,8 @@ class LdapAuthProvider: 66 | Returns False, None 67 | if an error occured 68 | """ 69 | + if (bind_dn is None or password is None) and auth_type == ldap3.SIMPLE: 70 | + raise ValueError("Missing bind DN or bind password") 71 | 72 | try: 73 | # bind with the the local user's ldap credentials 74 | @@ -521,7 +535,7 @@ class LdapAuthProvider: 75 | server, 76 | bind_dn, 77 | password, 78 | - authentication=ldap3.SIMPLE, 79 | + authentication=auth_type, 80 | read_only=True, 81 | ) 82 | logger.debug("Established LDAP connection in simple bind mode: %s", conn) 83 | @@ -578,13 +592,16 @@ class LdapAuthProvider: 84 | 85 | try: 86 | if self.ldap_bind_dn is None or self.ldap_bind_password is None: 87 | - raise ValueError("Missing bind DN or bind password") 88 | - 89 | - result, conn = await self._ldap_simple_bind( 90 | - server=server, 91 | - bind_dn=self.ldap_bind_dn, 92 | - password=self.ldap_bind_password, 93 | - ) 94 | + result, conn = await self._ldap_simple_bind( 95 | + server=server, 96 | + auth_type=ldap3.ANONYMOUS, 97 | + ) 98 | + else: 99 | + result, conn = await self._ldap_simple_bind( 100 | + server=server, 101 | + bind_dn=self.ldap_bind_dn, 102 | + password=self.ldap_bind_password, 103 | + ) 104 | 105 | if not result: 106 | return (False, None, None) 107 | -------------------------------------------------------------------------------- /scripts/remove: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | source _common.sh 4 | source experimental_helper.sh 5 | source /usr/share/yunohost/helpers 6 | 7 | #================================================= 8 | # STANDARD REMOVE 9 | #================================================= 10 | # REMOVE SERVICE FROM ADMIN PANEL 11 | #================================================= 12 | 13 | # Remove a service from the admin panel, added by `yunohost service add` 14 | yunohost service remove "$app" 15 | yunohost service remove "$app"-coturn 16 | yunohost service remove "$app"-livekit 17 | yunohost service remove "$app"-lk-jwt 18 | 19 | #================================================= 20 | # STOP AND REMOVE SERVICE 21 | #================================================= 22 | ynh_script_progression "Stopping and removing the systemd service" 23 | 24 | ynh_config_remove_systemd 25 | ynh_config_remove_systemd "$app"-coturn 26 | ynh_config_remove_systemd "$app"-livekit 27 | ynh_config_remove_systemd "$app"-lk-jwt 28 | 29 | #================================================= 30 | # REMOVE APP MAIN DIR 31 | #================================================= 32 | ynh_script_progression "Removing app main directory" 33 | 34 | ynh_safe_rm /etc/matrix-"$app" 35 | ynh_safe_rm "/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" 36 | ynh_safe_rm "/etc/nginx/conf.d/${domain}.d/${app}.conf.inc" 37 | 38 | #================================================= 39 | # REMOVE NGINX CONFIGURATION 40 | #================================================= 41 | ynh_script_progression "Removing NGINX web server configuration" 42 | 43 | # Remove the dedicated nginx config 44 | ynh_config_remove_nginx 45 | 46 | # Remove the dedicated php-fpm config 47 | ynh_config_remove_phpfpm 48 | 49 | #================================================= 50 | # REMOVE LOGROTATE CONFIGURATION 51 | #================================================= 52 | ynh_script_progression "Removing logrotate configuration" 53 | 54 | # Remove the app-specific logrotate config 55 | ynh_config_remove_logrotate 56 | 57 | #================================================= 58 | # REMOVE FAIL2BAN CONFIGURATION 59 | #================================================= 60 | ynh_script_progression "Removing Fail2Ban configuration..." 61 | 62 | # Remove the dedicated fail2ban config 63 | ynh_config_remove_fail2ban 64 | 65 | #================================================= 66 | 67 | ynh_script_progression "Removal of $app completed" 68 | 69 | sleep 1 70 | -------------------------------------------------------------------------------- /scripts/restore: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | #Keep this path for calling _common.sh inside the execution's context of backup and restore scripts 4 | source ../settings/scripts/_common.sh 5 | source ../settings/scripts/experimental_helper.sh 6 | source /usr/share/yunohost/helpers 7 | 8 | #================================================= 9 | # LOAD SETTINGS 10 | #================================================= 11 | ynh_script_progression "Loading settings..." 12 | 13 | #================================================= 14 | # RECREATE THE DEDICATED USER 15 | #================================================= 16 | ynh_script_progression 'Configuring system groups' 17 | 18 | # Create the dedicated user (if not existing) 19 | adduser "$app" ssl-cert 20 | adduser turnserver ssl-cert 21 | 22 | #================================================= 23 | # FIX DB CONFIG 24 | #================================================= 25 | ynh_script_progression "Fixing database type..." 26 | 27 | ynh_psql_db_shell \ 28 | <<< "update pg_database set datcollate='C', datctype='C' where datname='$db_name';" 29 | 30 | #================================================= 31 | # RESTORE ALL CONFIG AND DATA 32 | #================================================= 33 | 34 | ynh_script_progression "Restoring directory and configuration..." 35 | ynh_restore_everything 36 | mkdir -p /etc/matrix-"$app"/app-service 37 | 38 | # Check that the good python version is installed 39 | # If not upgrade the source 40 | ynh_script_progression "Check for source up to date..." 41 | install_sources 42 | 43 | #================================================= 44 | # RESTORE FAIL2BAN CONFIGURATION 45 | #================================================= 46 | ynh_script_progression "Reload Fail2Ban..." 47 | 48 | ynh_systemctl --action=restart --service=fail2ban 49 | 50 | #================================================= 51 | # RESTORE THE POSTGRESQL DATABASE 52 | #================================================= 53 | ynh_script_progression "Restoring the PostgreSQL database..." 54 | 55 | ynh_psql_db_shell < "${YNH_CWD}/dump.sql" 56 | 57 | #================================================= 58 | # RESTORE SYSTEMD 59 | #================================================= 60 | ynh_script_progression "Enable systemd services" 61 | 62 | # systemctl daemon-reload 63 | systemctl enable "$app".service --quiet 64 | systemctl enable "$app"-coturn.service --quiet 65 | systemctl enable "$app"-livekit.service --quiet 66 | systemctl enable "$app"-lk-jwt.service --quiet 67 | 68 | #================================================= 69 | # ADVERTISE SERVICE IN ADMIN PANEL 70 | #================================================= 71 | 72 | yunohost service add "$app" --log "/var/log/matrix-$app/homeserver.log" --needs_exposed_ports $port_synapse_tls --description 'Main matrix server service.' 73 | yunohost service add "$app-coturn" --needs_exposed_ports "$port_turnserver_tls" --description 'Turn server for matrix server. Used for audio and video call.' 74 | yunohost service add "$app"-livekit --description 'Livekit server for element call.' 75 | yunohost service add "$app"-lk-jwt --description 'RTC Livekit JWT service for element call.' 76 | 77 | #================================================= 78 | # CREATE A DH FILE 79 | #================================================= 80 | ynh_script_progression "Creating a dh file..." 81 | 82 | # WARNING : theses command are used in INSTALL, UPGRADE, RESTORE 83 | # For any update do it in all files 84 | 85 | # Make dh cert for synapse if it doesn't exist 86 | if [ ! -e /etc/ssl/private/dh2048.pem ] 87 | then 88 | ynh_hide_warnings openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -dsaparam 2048 89 | chown root:ssl-cert /etc/ssl/private/dh2048.pem 90 | chmod 640 /etc/ssl/private/dh2048.pem 91 | fi 92 | 93 | #================================================= 94 | # RECONFIGURE THE TURNSERVER 95 | #================================================= 96 | ynh_script_progression "Reconfiguring Coturn..." 97 | 98 | configure_coturn 99 | 100 | #================================================= 101 | # SETUP LOGROTATE 102 | #================================================= 103 | ynh_script_progression "Configuring log rotation..." 104 | 105 | ynh_config_add_logrotate /var/log/matrix-"$app" 106 | 107 | #================================================= 108 | # SECURE FILES AND DIRECTORIES 109 | #================================================= 110 | 111 | ynh_script_progression "Protecting directories..." 112 | set_permissions data 113 | 114 | #================================================= 115 | # RELOAD NGINX, SYNAPSE AND COTURN 116 | #================================================= 117 | ynh_script_progression "Restarting Synapse services..." 118 | 119 | ynh_systemctl --service="$app"-coturn.service --action=restart 120 | ynh_systemctl --service="$app".service --action=restart --wait_until="Synapse now listening on TCP port $port_synapse_tls" --log_path="/var/log/matrix-$app/homeserver.log" --timeout=300 121 | ynh_systemctl --service="$app"-livekit.service --action=restart 122 | ynh_systemctl --service="$app"-lk-jwt.service --action=restart 123 | 124 | #================================================= 125 | # RELOAD NGINX 126 | #================================================= 127 | ynh_script_progression "Reloading NGINX web server..." 128 | 129 | ynh_systemctl --service=php"$php_version"-fpm --action=reload 130 | ynh_systemctl --service=nginx --action=reload 131 | 132 | #================================================= 133 | # END OF SCRIPT 134 | #================================================= 135 | 136 | ynh_script_progression "Restoration completed for $app" 137 | -------------------------------------------------------------------------------- /scripts/upgrade: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | source _common.sh 4 | source experimental_helper.sh 5 | source /usr/share/yunohost/helpers 6 | 7 | ynh_app_setting_set_default --key=php_upload_max_filesize --value=100M 8 | 9 | #================================================= 10 | # SET ALL CONSTANT 11 | #================================================= 12 | 13 | #================================================= 14 | # MIGRATION 5 : Manage old settings 15 | #================================================= 16 | 17 | # Migrate from settings 'special_domain' to 'domain' and 'special_path' to 'path' 18 | if [ -z "${domain:-}" ]; then 19 | domain=$(ynh_app_setting_get --key=special_domain) 20 | path=$(ynh_app_setting_get --key=special_path) 21 | ynh_app_setting_set --key=domain --value=$domain 22 | ynh_app_setting_set --key=path --value=$path 23 | ynh_app_setting_delete --key=special_domain 24 | ynh_app_setting_delete --key=special_path 25 | ynh_app_setting_set --key=no_sso --value=true 26 | fi 27 | 28 | ensure_vars_set 29 | mkdir -p "$install_dir"/{cas,venv} 30 | 31 | # Define $server_name if not already defined 32 | ynh_app_setting_set_default --app="$app" --key=server_name --value="$domain" 33 | 34 | # Define $jitsi_server if not already defined 35 | ynh_app_setting_set_default --app="$app" --key=jitsi_server --value='jitsi.riot.im' 36 | 37 | if [ "$e2e_enabled_by_default" = "true" ] ; then 38 | e2e_enabled_by_default="all" 39 | ynh_app_setting_set --key=e2e_enabled_by_default --value=$e2e_enabled_by_default 40 | fi 41 | if [ "$e2e_enabled_by_default" = "false" ]; then 42 | e2e_enabled_by_default="off" 43 | ynh_app_setting_set --key=e2e_enabled_by_default --value=$e2e_enabled_by_default 44 | fi 45 | 46 | if [ "${registrations_require_3pid}" == none ] 47 | then 48 | registrations_require_3pid=email 49 | ynh_app_setting_set --key=registrations_require_3pid --value=$registrations_require_3pid 50 | fi 51 | if [[ "${allowed_local_3pids_email}" =~ \'.*\' ]] # Also remove shit value from previous config panel 52 | then 53 | allowed_local_3pids_email='' 54 | ynh_app_setting_set --key=allowed_local_3pids_email --value=$allowed_local_3pids_email 55 | fi 56 | if [[ "${allowed_local_3pids_msisdn}" =~ \'.*\' ]] # Also remove shit value from previous config panel 57 | then 58 | allowed_local_3pids_msisdn='' 59 | ynh_app_setting_set --key=allowed_local_3pids_msisdn --value=$allowed_local_3pids_msisdn 60 | fi 61 | 62 | if [ -z "${enable_registration:-}" ] 63 | then 64 | if [ -z "${is_free_registration:-}" ]; then 65 | is_free_registration=$(ynh_app_setting_get --key=is_""public) 66 | fi 67 | 68 | if [ "$is_free_registration" -eq "0" ] 69 | then 70 | enable_registration="false" 71 | password_enabled="false" 72 | 73 | else 74 | enable_registration="true" 75 | password_enabled="true" 76 | fi 77 | ynh_app_setting_set --key=enable_registration --value=$enable_registration 78 | ynh_app_setting_set --key=password_enabled --value=$password_enabled 79 | fi 80 | 81 | # remove legacy env file into /etc/default 82 | ynh_safe_rm /etc/default/coturn-"$app" 83 | 84 | #================================================= 85 | # MIGRATION 7 : STANDARDIZE SYSTEMD UNIT 86 | #================================================= 87 | 88 | if [ -e /etc/systemd/system/matrix-"$app".service ] 89 | then 90 | ynh_script_progression 'Migrating systemd unit to standard name...' 91 | 92 | systemctl stop matrix-$app.service || true 93 | systemctl stop coturn-$app.service || true 94 | 95 | yunohost service remove matrix-$app || true 96 | yunohost service remove coturn-$app || true 97 | 98 | ynh_safe_rm /etc/systemd/system/matrix-$app.service 99 | ynh_safe_rm /etc/systemd/system/coturn-$app.service 100 | 101 | touch /etc/systemd/system/$app.service 102 | systemctl daemon-reload || true 103 | fi 104 | 105 | #================================================= 106 | # STOP SERVICES 107 | #================================================= 108 | 109 | # We stop the service 110 | ynh_systemctl --service="$app".service --action=stop 111 | ynh_systemctl --service="$app"-coturn.service --action=stop 112 | ynh_systemctl --service="$app"-livekit.service --action=stop 113 | ynh_systemctl --service="$app"-lk-jwt.service --action=stop 114 | 115 | ynh_script_progression 'Managing migrations...' 116 | 117 | #================================================= 118 | # MIGRATION 6 : Migrate data directory 119 | #================================================= 120 | 121 | if [ -e "/var/lib/matrix-$app" ]; then 122 | ynh_script_progression "Moving data directory to $data_dir..." 123 | if [ -e "$data_dir" ]; then 124 | old_data_dir_path="$data_dir$(date '+%Y%m%d.%H%M%S')" 125 | ynh_print_warn "A data directory already exist. Data was renamed to $old_data_dir_path" 126 | mv "$data_dir" "$old_data_dir_path" 127 | fi 128 | mv "/var/lib/matrix-$app" "$data_dir" 129 | fi 130 | 131 | #================================================= 132 | # MIGRATION 3 : USE STANDARD ACCESS FOR CERTIFCATE 133 | #================================================= 134 | 135 | # Fix issue about certificates access 136 | if [ ! $(grep "ssl-cert:x:[0-9]*:.*$app" /etc/group) ] 137 | then 138 | ynh_script_progression "Use standard access for certificate..." 139 | 140 | adduser $app ssl-cert 141 | adduser turnserver ssl-cert 142 | fi 143 | 144 | #================================================= 145 | # MIGRATION 4 : CREATE A DH FILE 146 | #================================================= 147 | 148 | # WARNING : theses command are used in INSTALL, UPGRADE, RESTORE 149 | # For any update do it in all files 150 | 151 | # Make dh cert for synapse if it doesn't exist 152 | if [ ! -e /etc/ssl/private/dh2048.pem ] 153 | then 154 | ynh_script_progression "Creating a dh file..." 155 | 156 | ynh_hide_warnings openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -dsaparam 2048 157 | chown root:ssl-cert /etc/ssl/private/dh2048.pem 158 | chmod 640 /etc/ssl/private/dh2048.pem 159 | fi 160 | 161 | #================================================= 162 | # MIGRATION 2 : MULTINSTANCE SUPPORT 163 | #================================================= 164 | 165 | if [ ! -e /etc/matrix-$app/coturn.conf ] 166 | then 167 | ynh_script_progression "Creating an independant service for coturn..." 168 | 169 | #================================================= 170 | # CREATE AN INDEPENDANT SERVICE FOR COTURN 171 | #================================================= 172 | 173 | # Disable default config for turnserver and create a new service 174 | systemctl stop coturn.service 175 | 176 | #================================================= 177 | # MAKE A CLEAN LOGROTATE CONFIG 178 | #================================================= 179 | 180 | ynh_config_add_logrotate /var/log/matrix-$app 181 | fi 182 | 183 | #================================================= 184 | # MIGRATION 8 : Migrate database to managed database (Migrate db name from matrix_$app to $app) 185 | #================================================= 186 | 187 | if ynh_psql_db_shell <<< '\list' | grep matrix_$app; then 188 | ynh_psql_drop_db "$db_name" 189 | sudo --login --user=postgres psql <<< "ALTER DATABASE matrix_$app RENAME TO $db_name;" 190 | ynh_psql_db_shell <<< "REASSIGN OWNED BY matrix_$app TO $db_user;" 191 | ynh_psql_db_shell <<< "UPDATE pg_database SET datcollate='C', datctype='C' WHERE datname='$db_name';" 192 | ynh_psql_db_shell <<< "DROP USER matrix_$app;" 193 | # for unknown reason we need to set again the password for synapse user. Without this synapse can't authenticate to postgresql 194 | ynh_psql_db_shell <<< "ALTER USER $db_user WITH ENCRYPTED PASSWORD '$db_pwd';" 195 | fi 196 | 197 | #================================================= 198 | # MIGRATION 9 : migrate data path (from matrix-$app to $app) 199 | #================================================= 200 | 201 | if [ -e /home/yunohost.app/matrix-"$app" ]; then 202 | mv -t "$data_dir" /home/yunohost.app/matrix-"$app"/* 203 | ynh_safe_rm /home/yunohost.app/matrix-"$app" 204 | fi 205 | 206 | #================================================= 207 | # MIGRATION 11 : make this app using full domain 208 | #================================================= 209 | 210 | ynh_app_setting_set --key=path --value=/ 211 | 212 | if yunohost app map -r --output-as json | jq -r '."'$domain'" | select( . != null ) | .[] | .id' | grep -v "$app" -q; then 213 | ynh_print_warn 'An other app is installed on this domain. Now synapse require to be alone on the domain.' 214 | ynh_print_warn 'To solve this you can:' 215 | ynh_print_warn " - Remove or move all other app which use '$domain'" 216 | ynh_print_warn ' - Change the domain of synapse. You can find more informations here: https://github.com/YunoHost-Apps/synapse_ynh/tree/testing/doc/ADMIN.md#change-url' 217 | ynh_print_warn 'For more information you can see this issue: https://github.com/YunoHost-Apps/synapse_ynh/issues/443' 218 | fi 219 | 220 | #================================================= 221 | # MIGRATION 12 : update system user and drop yunohost user 222 | #================================================= 223 | 224 | if grep -q "^matrix-$app" /etc/passwd; then 225 | # Must stop php before remove user as user is used by php 226 | systemctl stop php7.4-fpm.service || true 227 | systemctl stop php8.2-fpm.service || true 228 | systemctl stop php8.3-fpm.service || true 229 | 230 | ynh_''system_user_delete --username=matrix-"$app" || true 231 | yunohost user delete "$app" || true 232 | ynh_''system_user_create --username="$app" --home_dir="$install_dir"/venv 233 | adduser "$app" ssl-cert 234 | 235 | systemctl start php7.4-fpm.service || true 236 | systemctl start php8.2-fpm.service || true 237 | systemctl start php8.3-fpm.service || true 238 | fi 239 | 240 | #================================================= 241 | # MIGRATION : some cleanup ... 242 | #================================================= 243 | 244 | ynh_safe_rm /opt/yunohost/matrix-"$app" 245 | 246 | # Clean old server_name config if $server_name == $domain because now it's provided by the main nginx config 247 | ynh_safe_rm "/etc/nginx/conf.d/${domain}.d/${app}_server_name.conf" 248 | 249 | #================================================= 250 | # DOWNLOAD, CHECK AND UNPACK SOURCE 251 | #================================================= 252 | 253 | ynh_script_progression "Upgrading source files..." 254 | install_sources 255 | 256 | #================================================= 257 | # MIGRATION 1 : GENERATE SYNAPSE SECRET 258 | #================================================= 259 | 260 | if [ -z "${registration_shared_secret:-}" ] || [ "$form_secret" == "form_secret: " ] 261 | then 262 | ynh_script_progression "Generating synapse secret..." 263 | 264 | # Generate config and keys 265 | "$install_dir/venv"/bin/python -m synapse.app.homeserver --keys-directory /etc/matrix-"$app"/ --generate-config --generate-keys --server-name "$server_name" --report-stats=no -c homeserver.yml 266 | 267 | # Get random values from config 268 | registration_shared_secret=$(egrep "^registration_shared_secret:" homeserver.yml | cut -d'"' -f2) 269 | form_secret=$(egrep "^form_secret:" homeserver.yml | cut -d'"' -f2) 270 | 271 | # store in yunohost settings 272 | ynh_app_setting_set --key=registration_shared_secret --value="$registration_shared_secret" 273 | ynh_app_setting_set --key=form_secret --value="$form_secret" 274 | fi 275 | 276 | #================================================= 277 | # MIGRATION 13 : REMOVE SLIDING SYNC PROXY COMPONENTS 278 | #================================================= 279 | ynh_script_progression "Cleaning sliding sync proxy components..." 280 | 281 | if ynh_''psql_database_exists "${db_name}"_slidingproxy; then 282 | ynh_''psql_drop_db "${db_name}"_slidingproxy 283 | fi 284 | 285 | ynh_safe_rm /etc/matrix-"$app"/sliding_proxy.conf 286 | 287 | test -e /etc/systemd/system/"$app"-sliding-proxy.service && (yunohost service remove "$app"-sliding-proxy || true) 288 | ynh_config_remove_systemd "$app"-sliding-proxy 289 | 290 | #================================================= 291 | # STANDARD UPGRADE STEPS 292 | #================================================= 293 | 294 | #================================================= 295 | # UPDATE SYNAPSE CONFIG 296 | #================================================= 297 | ynh_script_progression "Updating synapse config..." 298 | 299 | # Force enable it because some client like Element X don't support CAS and so require to have password authentication enabled 300 | password_enabled=true 301 | 302 | ynh_config_add --jinja --template="homeserver.yaml" --destination="/etc/matrix-$app/homeserver.yaml" 303 | ynh_config_add --template="log.yaml" --destination="/etc/matrix-$app/log.yaml" 304 | 305 | #================================================= 306 | # CREATE SMALL CAS SERVER 307 | #================================================= 308 | # WARNING : theses command are used in INSTALL, UPGRADE 309 | # For any update do it in all files 310 | 311 | cp ../sources/cas_server.php "$install_dir"/cas/ 312 | 313 | #================================================= 314 | # NGINX CONFIGURATION 315 | #================================================= 316 | ynh_script_progression "Upgrading NGINX web server configuration..." 317 | 318 | # Create a dedicated php-fpm config 319 | ynh_script_progression "Configuring application..." 320 | 321 | configure_php 322 | 323 | configure_nginx 324 | 325 | #================================================= 326 | # UPDATE COTURN CONFIG 327 | #================================================= 328 | ynh_script_progression "Updating Coturn config..." 329 | 330 | configure_coturn 331 | 332 | #================================================= 333 | # SET Element call CONFIG 334 | #================================================= 335 | ynh_script_progression "Configuring Element call..." --weight=1 336 | 337 | ynh_config_add --template=livekit.yml --destination=/etc/matrix-"$app"/livekit.yml 338 | ynh_config_add --template=lk-jwt.conf --destination=/etc/matrix-"$app"/lk-jwt.conf 339 | 340 | #================================================= 341 | # ADD SCRIPT FOR COTURN CRON AND APP SERVICE 342 | #================================================= 343 | 344 | # WARNING : theses command are used in INSTALL, UPGRADE 345 | # For any update do it in all files 346 | 347 | ynh_config_add --template="../sources/Coturn_config_rotate.sh" --destination="$install_dir/Coturn_config_rotate.sh" 348 | ynh_config_add --template="../sources/update_synapse_for_appservice.sh" --destination="$install_dir/update_synapse_for_appservice.sh" 349 | ynh_config_add --template=../sources/set_admin_user.sh --destination="$install_dir"/set_admin_user.sh 350 | 351 | # Ensure app-service folder has exists and the config file exit (Migration) 352 | mkdir -p /etc/matrix-$app/app-service 353 | if [ -e /etc/matrix-$app/conf.d/app_service.yaml ]; then 354 | # ensure that the file is empty if no app service are installed (fix issue #385) 355 | if [ ! "$(ls -A /etc/matrix-$app/app-service)" ]; then 356 | echo "" > /etc/matrix-$app/conf.d/app_service.yaml 357 | fi 358 | else 359 | touch /etc/matrix-$app/conf.d/app_service.yaml 360 | fi 361 | 362 | #================================================= 363 | # ADVERTISE SERVICE IN ADMIN PANEL 364 | #================================================= 365 | 366 | yunohost service add "$app" --log "/var/log/matrix-$app/homeserver.log" --needs_exposed_ports "$port_synapse_tls" --description 'Main matrix server service.' 367 | yunohost service add "$app"-coturn --needs_exposed_ports "$port_turnserver_tls" --description 'Turn server for matrix server. Used for audio and video call.' 368 | yunohost service add "$app"-livekit --description 'Livekit server for element call.' 369 | yunohost service add "$app"-lk-jwt --description 'RTC Livekit JWT service for element call.' 370 | 371 | #================================================= 372 | # UPDATE SYSTEMD 373 | #================================================= 374 | ynh_script_progression "Upgrading systemd configuration..." 375 | 376 | # Create systemd service for synapse and turnserver 377 | ynh_config_add_systemd --template=synapse.service 378 | 379 | cp ../conf/default_coturn /etc/matrix-"$app"/coturn_env 380 | ynh_config_add_systemd --service="$app"-coturn --template=synapse-coturn.service 381 | get_lk_node_ip 382 | ynh_config_add_systemd --service="$app"-livekit --template=synapse-livekit.service 383 | ynh_config_add_systemd --service="$app"-lk-jwt --template=synapse-lk-jwt.service 384 | 385 | #================================================= 386 | # UPGRADE FAIL2BAN 387 | #================================================= 388 | ynh_script_progression "Reconfiguring Fail2Ban..." 389 | 390 | ynh_config_add_fail2ban --logpath=/var/log/matrix-"$app"/homeserver.log 391 | 392 | #================================================= 393 | # SETUP PERMISSIONS 394 | #================================================= 395 | 396 | ynh_script_progression "Configuring permissions..." 397 | 398 | if yunohost --output-as plain domain list | grep -q "^$server_name"'$'; then 399 | ynh_""permission_url --permission=server_client_infos --add_url="$server_name"/.well-known/matrix 400 | fi 401 | 402 | #================================================= 403 | # SECURE FILES AND DIRECTORIES 404 | #================================================= 405 | 406 | ynh_script_progression "Protecting directories... (note that it could take a long time depending of your install size)" 407 | set_permissions data 408 | 409 | #================================================= 410 | # UPDATE HOOKS 411 | #================================================= 412 | 413 | # WARNING : theses command are used in INSTALL, UPGRADE 414 | # For any update do it in all files 415 | ynh_replace --match=__APP__ --replace="$app" --file=../hooks/post_cert_update 416 | ynh_replace --match=__DOMAIN__ --replace="$domain" --file=../hooks/post_cert_update 417 | 418 | #================================================= 419 | # RELOAD SERVICES 420 | #================================================= 421 | ynh_script_progression "Restarting Synapse services..." 422 | 423 | ynh_systemctl --service="$app"-coturn.service --action=restart 424 | ynh_systemctl --service="$app".service --action=restart --wait_until="Synapse now listening on TCP port $port_synapse_tls" --log_path="/var/log/matrix-$app/homeserver.log" --timeout=300 425 | ynh_systemctl --service="$app"-livekit.service --action=restart 426 | ynh_systemctl --service="$app"-lk-jwt.service --action=restart 427 | 428 | #================================================= 429 | # END OF SCRIPT 430 | #================================================= 431 | 432 | ynh_script_progression "Upgrade of $app completed" 433 | -------------------------------------------------------------------------------- /sources/Coturn_config_rotate.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | set -eu 4 | 5 | app=__APP__ 6 | YNH_APP_BASEDIR=/etc/yunohost/apps/"$app" 7 | YNH_HELPERS_VERSION=2.1 8 | YNH_APP_ACTION='' 9 | 10 | pushd /etc/yunohost/apps/$app/conf 11 | 12 | source /usr/share/yunohost/helpers 13 | 14 | # Must load db_name var to load _common.sh 15 | db_name=$(ynh_app_setting_get --key=db_name) 16 | source ../scripts/_common.sh 17 | 18 | domain=$(ynh_app_setting_get --key=domain) 19 | port_cli=$(ynh_app_setting_get --key=port_cli) 20 | turnserver_pwd=$(ynh_app_setting_get --key=turnserver_pwd) 21 | turnserver_cli_pwd=$(ynh_app_setting_get --key=turnserver_cli_pwd) 22 | port_turnserver_tls=$(ynh_app_setting_get --key=port_turnserver_tls) 23 | port_turnserver_alt_tls=$(ynh_app_setting_get --key=port_turnserver_alt_tls) 24 | enable_dtls_for_audio_video_turn_call=$(ynh_app_setting_get --key=enable_dtls_for_audio_video_turn_call) 25 | 26 | previous_checksum=$(ynh_app_setting_get --key=checksum__etc_matrix-synapse_coturn.conf) 27 | configure_coturn 28 | new_checksum=$(ynh_app_setting_get --key=checksum__etc_matrix-synapse_coturn.conf) 29 | 30 | setfacl -R -m user:turnserver:rX /etc/matrix-$app 31 | 32 | if [ "$previous_checksum" != "$new_checksum" ] 33 | then 34 | systemctl restart "$app"-coturn.service 35 | fi 36 | 37 | exit 0 38 | -------------------------------------------------------------------------------- /sources/cas_server.php: -------------------------------------------------------------------------------- 1 | 30 | 31 | 32 | 33 | PGTIOU-84678-8a9d... 34 | 35 | 36 | 39 | 40 | 41 | ticket PT-1856376-1HMgO86Z2ZKeByc5XdYD not recognized 42 | 43 | 44 | 0) { 60 | $_SESSION['user_authenticated'] = true; 61 | $_SESSION['user'] = $_SERVER['REMOTE_USER']; 62 | 63 | header('Status: 302 Moved Temporarily', false, 302); 64 | header('Location: ' . $_GET['service'] . '&ticket=' . $ticket); 65 | } else { 66 | echo "Authentication Fail."; 67 | } 68 | session_commit(); 69 | break; 70 | 71 | case $base_url: 72 | header('Status: 302 Moved Temporarily', false, 302); 73 | header('Location: ' . $_GET['redirectUrl']); 74 | 75 | break; 76 | 77 | default: 78 | echo "Bad URL"; 79 | } 80 | ?> 81 | -------------------------------------------------------------------------------- /sources/set_admin_user.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | set -eu 4 | 5 | YNH_HELPERS_VERSION=2.1 6 | app=__APP__ 7 | YNH_APP_BASEDIR=/etc/yunohost/apps/"$app" 8 | YNH_APP_ACTION='' 9 | 10 | source /usr/share/yunohost/helpers 11 | 12 | db_name=$(ynh_app_setting_get --key=db_name) 13 | db_user=$(ynh_app_setting_get --key=db_user) 14 | db_pwd=$(ynh_app_setting_get --key=db_pwd) 15 | server_name=$(ynh_app_setting_get --key=server_name) 16 | 17 | if [ -z ${1:-} ]; then 18 | echo "Usage: set_admin_user.sh user_to_set_as_admin" 19 | exit 1 20 | fi 21 | 22 | ynh_psql_db_shell <<< "UPDATE users SET admin = 1 WHERE name = '@$1:$server_name'" 23 | 24 | exit 0 25 | -------------------------------------------------------------------------------- /sources/update_synapse_for_appservice.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | set -eu 4 | 5 | app=__APP__ 6 | service_config_file=/etc/matrix-$app/conf.d/app_service.yaml 7 | 8 | # Backup the previous config file 9 | cp $service_config_file /tmp/app_service_backup.yaml 10 | 11 | if [ -n "$(ls /etc/matrix-$app/app-service/)" ]; then 12 | echo "app_service_config_files:" > $service_config_file 13 | else 14 | echo "" > $service_config_file 15 | fi 16 | for f in $(ls /etc/matrix-$app/app-service/); do 17 | echo " - /etc/matrix-$app/app-service/$f" >> $service_config_file 18 | done 19 | 20 | # Set permissions 21 | chown $app $service_config_file 22 | chown $app /etc/matrix-$app/app-service/* 23 | chmod 600 $service_config_file 24 | chmod 600 /etc/matrix-$app/app-service/* 25 | 26 | systemctl restart $app.service 27 | 28 | if [ $? -eq 0 ]; then 29 | rm /tmp/app_service_backup.yaml 30 | exit 0 31 | else 32 | echo "Failed to restart synapse with the new config file. Restore the old config file !!" 33 | cp /tmp/app_service_backup.yaml $service_config_file 34 | fi 35 | -------------------------------------------------------------------------------- /tests.toml: -------------------------------------------------------------------------------- 1 | #:schema https://raw.githubusercontent.com/YunoHost/apps/master/schemas/tests.v1.schema.json 2 | 3 | test_format = 1.0 4 | 5 | [default] 6 | 7 | test_upgrade_from.3b5a58e5d8b83f292c6160e8908ac662360aa03e.name = "Before packaging v2 (branch old_version_for_CI_6)" 8 | 9 | test_upgrade_from.9431fd9bb466f02b883ef7cce9c0a62c919dd2fb.name = "Before Matrix v2 implementation (branch old_version_for_CI_8)" 10 | 11 | test_upgrade_from.70b585b595bfe63ebf4ef82f11acc7e243740764.name = "Before sliding sync proxy removal" 12 | 13 | test_upgrade_from.8ab6186bede11c5856886a8978428a0f09b6d08d.name = "Before helper 2.1" 14 | 15 | test_upgrade_from.92e630366e39aca49dbeb66c9d1b3c3bc2e03b31.name = "Before element call backend" 16 | --------------------------------------------------------------------------------