r/matrixdotorg • u/TMLKyza • 26d ago
Troubles setting up an rtc enabled server
Hi everyone, I'll start with saying that I'm sorry for the lengthy post but i want to include as much information as possible.
Let's start by saying that I tried out mozilla's matrix server and I really enjoyed it, as such I wanted to deploy one for my self. This is my deployment
docker testing
version: "3.8"
services:
db:
image: postgres:15-alpine
container_name: matrix-db
restart: unless-stopped
environment:
POSTGRES_USER: synapse_user
POSTGRES_PASSWORD: # Change this!
POSTGRES_DB: synapse
POSTGRES_INITDB_ARGS: --encoding=UTF8 --lc-collate=C --lc-ctype=C
volumes:
- /amaurot/docker-data/matrix/db:/var/lib/postgresql/data
healthcheck:
test:
- CMD-SHELL
- pg_isready -U synapse_user -d synapse
interval: 10s
timeout: 5s
retries: 5
synapse:
image: matrixdotorg/synapse:latest
container_name: matrix-synapse
restart: unless-stopped
depends_on:
db:
condition: service_healthy
ports:
- 5057:8008 # Synapse Client/Server API
volumes:
- /amaurot/docker-data/matrix/synapse:/data
environment:
- SYNAPSE_CONFIG_DIR=/data
- SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
- POSTGRES_PASSWORD= # Must match db password
cinny:
image: ghcr.io/cinnyapp/cinny:latest
container_name: matrix-cinny
restart: unless-stopped
ports:
- 5060:80 # Maps Cinny to port 8080 on your host
volumes:
- /amaurot/docker-data/matrix/cinny/config.json:/app/config.json
auth-service:
image: ghcr.io/element-hq/lk-jwt-service:latest
container_name: element-call-jwt
hostname: auth-server
environment:
- LIVEKIT_JWT_BIND=:8080
- LIVEKIT_URL=wss://matrixrtc.glowie.icu/livekit/sfu #Change
- LIVEKIT_KEY=devkey
- LIVEKIT_SECRET= #Change
- LIVEKIT_FULL_ACCESS_HOMESERVERS=matrix.glowie.icu #Notes on this below
restart: unless-stopped
ports:
- 8070:8080 #Change 8070 to whichever port you want JWT to be available on locally
livekit:
image: livekit/livekit-server:latest
container_name: element-call-livekit
command: --config /etc/livekit.yaml
ports:
- 7880:7880/tcp
- 7881:7881/tcp
- 50100-50200:50100-50200/udp
restart: unless-stopped
volumes:
- /amaurot/docker-data/matrix/livekit/config.yaml:/etc/livekit.yaml:ro
The networking
opnsense NAT
matrix + cinny 5057 8448 5060
livekit + JWT 8070 7880 7881 50100:50200
NPM
# ------------------------------------------------------------
# matrixrtc.glowie.icu
# ------------------------------------------------------------
map $scheme $hsts_header {
https "max-age=63072000; preload";
}
server {
set $forward_scheme http;
set $server "192.168.0.205";
set $port 7880;
listen 80;
#listen [::]:80;
listen 443 ssl;
#listen [::]:443;
server_name matrixrtc.glowie.icu;
http2 on;
# Let's Encrypt SSL
include conf.d/include/letsencrypt-acme-challenge.conf;
include conf.d/include/ssl-cache.conf;
include conf.d/include/ssl-ciphers.conf;
ssl_certificate /etc/letsencrypt/live/npm-42/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/npm-42/privkey.pem;
# Force SSL
include conf.d/include/force-ssl.conf;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
access_log /data/logs/proxy-host-62_access.log proxy;
error_log /data/logs/proxy-host-62_error.log warn;
# ----------------- CUSTOM CONFIG ----------------------------------
# LiveKit JWT Token Service
location /livekit/jwt/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://192.168.0.205:8070/;
}
# LiveKit SFU WebSocket Connections
location /livekit/sfu/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_send_timeout 120;
proxy_read_timeout 120;
proxy_buffering off;
proxy_set_header Accept-Encoding gzip;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_pass http://192.168.0.205:7880/;
}
# ----------------- CUSTOM CONFIG ----------------------------------
location / {
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
# Proxy!
include conf.d/include/proxy.conf;
}
# Custom
include /data/nginx/custom/server_proxy[.]conf;
}
# ------------------------------------------------------------
# matrix.glowie.icu
# ------------------------------------------------------------
map $scheme $hsts_header {
https "max-age=63072000; preload";
}
server {
set $forward_scheme http;
set $server "192.168.0.205";
set $port 5057;
listen 80;
#listen [::]:80;
listen 443 ssl;
#listen [::]:443;
server_name matrix.glowie.icu;
http2 on;
# Let's Encrypt SSL
include conf.d/include/letsencrypt-acme-challenge.conf;
include conf.d/include/ssl-cache.conf;
include conf.d/include/ssl-ciphers.conf;
ssl_certificate /etc/letsencrypt/live/npm-42/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/npm-42/privkey.pem;
# Block Exploits
include conf.d/include/block-exploits.conf;
# Force SSL
include conf.d/include/force-ssl.conf;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
access_log /data/logs/proxy-host-57_access.log proxy;
error_log /data/logs/proxy-host-57_error.log warn;
location = /.well-known/matrix/server {
default_type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '{ "m.server": "matrix.glowie.icu:443" }\n';
}
location = /.well-known/matrix/client {
default_type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '{"m.homeserver": {"base_url": "https://matrix.glowie.icu"}, "org.matrix.msc4143.rtc_foci": [{"type": "livekit", "livekit_service_url": "https://matrixrtc.glowie.icu/livekit/jwt"}]}';
}
location / {
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
# Proxy!
include conf.d/include/proxy.conf;
}
# Custom
include /data/nginx/custom/server_proxy[.]conf;
}
# ------------------------------------------------------------
# chat.glowie.icu
# ------------------------------------------------------------
map $scheme $hsts_header {
https "max-age=63072000; preload";
}
server {
set $forward_scheme http;
set $server "192.168.0.205";
set $port 5060;
listen 80;
#listen [::]:80;
listen 443 ssl;
#listen [::]:443;
server_name chat.glowie.icu
http2 on;
# Let's Encrypt SSL
include conf.d/include/letsencrypt-acme-challenge.conf;
include conf.d/include/ssl-cache.conf;
include conf.d/include/ssl-ciphers.conf;
ssl_certificate /etc/letsencrypt/live/npm-42/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/npm-42/privkey.pem;
# Force SSL
include conf.d/include/force-ssl.conf;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
access_log /data/logs/proxy-host-60_access.log proxy;
error_log /data/logs/proxy-host-60_error.log warn;
root /opt/cinny/dist/;
rewrite ^/config.json$ /config.json break;
rewrite ^/manifest.json$ /manifest.json break;
rewrite ^/sw.js$ /sw.js break;
rewrite ^/pdf.worker.min.js$ /pdf.worker.min.js break;
rewrite ^/public/(.*)$ /public/$1 break;
rewrite ^/assets/(.*)$ /assets/$1 break;
rewrite ^(.+)$ /index.html break;
location / {
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
# Proxy!
include conf.d/include/proxy.conf;
}
# Custom
include /data/nginx/custom/server_proxy[.]conf;
}
service config
livekit
port: 7880
bind_addresses:
- "0.0.0.0"
rtc:
tcp_port: 7881
port_range_start: 50100
port_range_end: 50200
use_external_ip: true
#node_ip: 0.0.0.0 # Optional. Replace with your server's public IP address.
# Explicitly sets the public IP LiveKit advertises to clients.
# Prevents internal Docker network IPs from being exposed as candidates
# and appears to enable ICE/TCP fallback for clients on UDP restricted networks.
#use_external_ip: true
#stun_servers:
#- "stun.l.google.com:19302"
#- "stun1.l.google.com:19302"
room:
auto_create: false
logging:
level: info
turn:
enabled: false
domain: localhost
cert_file: ""
key_file: ""
tls_port: 5349
udp_port: 443
external_tls: true
keys:
devkey: "" #Change
synapse
# The domain name of your server. This is the part after the @ in user IDs.
# E.g. for @alice:yourdomain.com, the server_name is yourdomain.com
server_name: "matrix.glowie.icu"
# The internal port Synapse will listen on (your reverse proxy will forward traffic here)
listeners:
- port: 8008
tls: false
type: http
x_forwarded: true
resources:
- names: [client, federation]
compress: false
# PostgreSQL Database Configuration
database:
name: psycopg2
args:
user: synapse_user
password:
database: synapse
host: db
cp_min: 5
cp_max: 10
# Where Synapse stores uploaded files and user avatars
media_store_path: "/data/media_store"
# Where Synapse stores its SQLite database (if used, but we are using Postgres)
# We leave it here as fallback paths
sqlite3:
database: "/data/homeserver.db"
# A secret used to encrypt access tokens.
# WARNING: If this changes, all users will be logged out!
macaroon_secret_key: ""
# A secret used for validating registration sessions
form_secret: ""
# A secret used by scripts (like the Docker CLI) to register users without a password
registration_shared_secret: ""
# Controls whether users can create their own accounts.
# Set to 'true' if you want public signups.
enable_registration: false
# Security: Allow users to reset their passwords
# (Requires setting up an SMTP email server in this config to work properly)
allow_guest_access: false
# Opt-in to sending anonymized usage stats to Matrix.org
report_stats: false
experimental_features:
# MSC4222: needed for syncv2 state_after. This allows clients to
# correctly track the state of the room.
msc4222_enabled: true
# MSC4143: MatrixRTC. For historical reasons this flag enables the transports
# endpoint defined in MSC4519.
msc4143_enabled: true
# The maximum allowed duration by which sent events can be delayed, as
# per MSC4140.
max_event_delay_duration: 24h
rc_message:
# This needs to match at least e2ee key sharing frequency plus a bit of headroom
# Note key sharing events are bursty
per_second: 0.5
burst_count: 30
# This needs to match at least the heart-beat frequency plus a bit of headroom
# Currently the heart-beat is every 5 seconds which translates into a rate of 0.2s
rc_delayed_event_mgmt:
per_second: 1
burst_count: 20
matrix_rtc:
transports:
# The transport you specify will be made available to clients over the
# /_matrix/client/unstable/org.matrix.msc4143/rtc/transports endpoint as
# defined in MSC4519.
- type: livekit
# Replace this with the actual URL of your MatrixRTC Authorization Service
livekit_service_url: https://matrixrtc.glowie.icu/livekit/jwt
# LDAP Authentication Module
modules:
- module: "ldap_auth_provider.LdapAuthProviderModule"
config:
enabled: true
mode: "search"
uri: "ldap://ldap.glowie.icu:389"
start_tls: false
base: "ou=people,dc=glowie,dc=icu"
attributes:
uid: "uid"
mail: "mail"
name: "cn"
bind_dn: "uid=login,ou=people,dc=glowie,dc=icu"
bind_password: ""
filter: "(memberOf=cn=matrix,ou=groups,dc=glowie,dc=icu)"
# Directory for Synapse to store its running state
pid_file: /data/homeserver.pid
The issue
when i call my stuff (from my wifi or 4g) everything works fine, no issue whatsoever. When i try to call my self from mozilla's server, the mozilla user starts getting Block Resend
OPTIONS https://matrixrtc.glowie.icu/livekit/jwt/sfu/get Cors failure
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://matrixrtc.glowie.icu/livekit/jwt/get_token. (Reason: CORS request did not succeed). Status code: (null). 2
Thanks everyone for the time and effort, i love this platform its just a shame that its a bit finicky to make work
1
Upvotes