Docker Matrix Synapse Traefik Federation

miotic · July 31, 2021 at 2:10 PM

Moin und Hallo an alle,

schon seit paar Tagen versuche ich bei "The Matrix Federation Tester" https://federationtester.matrix.org/ alles auf Success zu kriegen.

Dieser Fehler wird immer Angezeigt

Code

Connection Errors
Get "https://[homeip]:443/_matrix/key/v2/server": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

IPV6 wurde aktiviert:

/etc/docker/daemon.json<br>

Code

{  
  "ipv6": true,  "fixed-cidr-v6": "2001:db8:1::/64"
}

DNS Anpassung

Code

_matrix._tcp SRV 10 5 443 synapse.matrix.domain.de
matrix CNAME domain.ddnss.de
synapse CNAME domain.ddnss.de
element CNAME domain.ddnss.de
traefik CNAME domain.ddnss.de

Hier meine Config von meinen Container:

Traefik:

docker-compose.jml

Code

version: '3'

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - 80:80
      - 443:443
    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/config/traefik.yml:/traefik.yml:ro
      - ./data/config/dynamic_conf.yml:/dynamic_conf.yml
      - ./data/acme/acme.json:/acme.json
      - ./data/logs/traefik.log:/logs/traefik.log
      - ./data/logs/access.log:/logs/access.log
    environment:
      # Wildcard-Cert for Domain without DNS-API
      # - nodnsapi.com      - DNS hosted by Server without DNS-API
      # - netcuphosted.com  - DNS hosted by Netcup-Nameserver with DNS-API
      # Manual set the folowing DNS-CNAME Entry
      # _acme-challenge.nodnsapi.com CNAME acme.validation.netcuphosted.com
      - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER}
      - NETCUP_API_KEY=${NETCUP_API_KEY}
      - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD}
      - LEGO_EXPERIMENTAL_CNAME_SUPPORT=true
    labels:
      - "traefik.enable=true"
      # – ------------------------------------------------------
      # INCLUDE: dynamic_conf.yml
      # - redirect@file
      # - secHeaders@file
      - "providers.file.filename=/dynamic_conf.yml"
      # – ------------------------------------------------------
      # Middleware: traefik-auth
      # - generate Hash with: echo $(htpasswd -nb USER PASSWORD) | sed -e s/\\$/\\$\\$/g
      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_HTPASSWD}"
      # – ------------------------------------------------------
      # Router "traefik": http://traefik.nodnsapi.com -> Redirect
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN)`)"
      - "traefik.http.routers.traefik.middlewares=redirect@file"
      # – ------------------------------------------------------
      # Router "traefik-secure": https://traefik.nodnsapi.com -> Traefik Dashboard
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.${DOMAIN)`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth,secHeaders@file"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.service=api@internal"
      # – ------------------------------------------------------
      # Router "whoami-secure": To get Wildcard-Certs, no Service
      - "traefik.http.routers.whoami-secure.service=noop@internal"
      - "traefik.http.routers.whoami-secure.tls.certResolver=dns"
      - "traefik.http.routers.whoami-secure.tls.domains[0].main=*.${DOMAIN)"
      # - "traefik.http.routers.whoami-secure.tls.domains[0].sans=${DOMAIN)"
      # – ------------------------------------------------------

networks:
  proxy:
    external: true

Display More

traefik.yml

Code

global:
  checkNewVersion: true
  sendAnonymousUsage: false

log:
  filePath: "./logs/traefik.log"
  # DEBUG, PANIC, FATAL, ERROR, WARN, and INFO.
  level: DEBUG

accessLog:
  filePath: "./logs/access.log"
  bufferingSize: 100

api:
  dashboard: true

entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: proxy
  file:
    filename: "/dynamic_conf.yml"

certificatesResolvers:
  dns:
    acme:
      email: info@matulewski.de
      storage: acme.json
      keyType: RSA4096
      # Production
      caServer: https://acme-v02.api.letsencrypt.org/directory
      # Staging
      # caServer: https://acme-staging-v02.api.letsencrypt.org/directory
      dnschallenge:
        provider: netcup
        delaybeforecheck: 300
        resolvers:
        - root-dns.netcup.net:53
        - second-dns.netcup.net:53
        - 8.8.8.8:53
        - 1.1.1.1:53

Display More

dynamic_conf.yml

Code

tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
        - TLS_AES_256_GCM_SHA384
        - TLS_CHACHA20_POLY1305_SHA256
      curvePreferences:
        - CurveP521
        - CurveP384
      sniStrict: true

http:
  middlewares:
    # secHeaders@file
    # - Set Sameorigin
    # - Set HSTS
    # - enforce HTTPS
    secHeaders:
      headers:
        browserXssFilter: true
        contentTypeNosniff: true
        customFrameOptionsValue: "SAMEORIGIN"
        sslRedirect: true
        #HSTS Configuration
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 15552000

    # redirect@file: Redirect HTTP -> HTTPS
    redirect:
      redirectScheme:
        scheme: "https"

Display More

Falls Ihr weitere Informationen benötigt, sagt bescheid.

Für eure Unterstützung würde ich mich sehr freuen.

miotic · July 31, 2021 at 2:40 PM

Hier noch die Config vom Matrix-Container:

docker-compose.yml

Code

version: '3.3'

services:
  postgres:
    image: postgres
    container_name: synapse-postgres
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - synapse
    command: postgres -c config_file=/etc/postgresql/postgresql.conf
    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - ./data/postgres/db:/var/lib/postgresql/data
      - ./data/postgres/postgresql.conf:/etc/postgresql/postgresql.conf
    environment:
      TZ: "Europe/Berlin"
      POSTGRES_USER: "${PGUSER}"
      POSTGRES_PASSWORD: "${PGPW}"
      POSTGRES_DB: "${PGDB}"
      POSTGRES_INITDB_ARGS: "--encoding='UTF8' --lc-collate='C' --lc-ctype='C'"
    labels:
      - "traefik.enable=false"

  pgadmin:
    image: dpage/pgadmin4
    container_name: synapse-pgadmin
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - synapse
    ports:
      - 9003:80
    volumes:
      - ./data/pgadmin:/var/lib/pgadmin
    environment:
      PGADMIN_DEFAULT_EMAIL: "${PGADMAIL}"
      PGADMIN_DEFAULT_PASSWORD: "{${PGADPW}"
      PGADMIN_CONFIG_SERVER_MODE: "False"
      PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: "False"
    labels:
      - "traefik.enable=false"

  redis:
    image: redis
    container_name: synapse-redis
    command: redis-server --requirepass "${REDIS}"
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - synapse
    labels:
      - "traefik.enable=false"

  synapse:
    image: matrixdotorg/synapse:latest
    container_name: synapse-matrix
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - synapse
      - proxy
    environment:
      SYNAPSE_CONFIG_DIR: "/data"
      SYNAPSE_CONFIG_PATH: "/data/homeserver.yaml"
      UID: "1000"
      GID: "1000"
      TZ: "Europe/Berlin"
    volumes:
      - ./data/matrix:/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.synapse.entrypoints=http"
      - "traefik.http.routers.synapse.rule=Host(`synapse.${DOMAIN}`)"
      - "traefik.http.middlewares.synapse-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.synapse.middlewares=synapse-https-redirect"
      - "traefik.http.routers.synapse-secure.entrypoints=https"
      - "traefik.http.routers.synapse-secure.rule=Host(`synapse.${DOMAIN}`)"
      - "traefik.http.routers.synapse-secure.tls=true"
      - "traefik.http.routers.synapse-secure.service=synapse"
      - "traefik.http.services.synapse.loadbalancer.server.port=8008"

  nginx:
    image: nginx:latest
    container_name: synapse-nginx
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - synapse
      - proxy
    volumes:
      - ./data/nginx/matrix.conf:/etc/nginx/conf.d/matrix.conf
      - ./data/nginx/www:/var/www/
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.matrix.entrypoints=http"
      - "traefik.http.routers.matrix.rule=Host(`matrix.${DOMAIN}`)"
      - "traefik.http.middlewares.matrix-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.matrix.middlewares=matrix-https-redirect"
      - "traefik.http.routers.matrix-secure.entrypoints=https"
      - "traefik.http.routers.matrix-secure.rule=Host(`matrix.${DOMAIN}`)"
      - "traefik.http.routers.matrix-secure.tls=true"
      - "traefik.http.routers.matrix-secure.service=matrix"
      - "traefik.http.services.matrix.loadbalancer.server.port=80"

  element:
    image: nginx:1.12-alpine
    container_name: synapse-element
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - synapse
      - proxy
    volumes:
      - ./data/element/web:/usr/share/nginx/html/
      - ./data/element/config/config.json:/usr/share/nginx/html/config.json
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.element.entrypoints=http"
      - "traefik.http.routers.element.rule=Host(`element.${DOMAIN}`)"
      - "traefik.http.middlewares.element-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.element.middlewares=element-https-redirect"
      - "traefik.http.routers.element-secure.entrypoints=https"
      - "traefik.http.routers.element-secure.rule=Host(`element.${DOMAIN}`)"
      - "traefik.http.routers.element-secure.tls=true"
      - "traefik.http.routers.element-secure.service=element"
      - "traefik.http.services.element.loadbalancer.server.port=80"

networks:
  proxy:
    external: true
  synapse:
    external: true

Display More

matrix.conf vom NGINX-Container

Code

server {
  listen         80 default_server;
  server_name    matrix.domain.de;

 # Traefik -> nginx -> synapse
 location /_matrix {
    proxy_pass http://synapse:8008;
    proxy_set_header X-Forwarded-For $remote_addr;
    client_max_body_size 128m;
  }

  location /.well-known/matrix/ {
    root /var/www/;
    default_type application/json;
    add_header Access-Control-Allow-Origin  *;
  }
}

Display More

client und server vom NGINX-Container

Code

Client
{
  "m.homeserver": {
    "base_url": "https://matrix.domain.de"
  }
}
Server
{
  "m.server": "synapse.domain.de:443"
}

miotic · August 1, 2021 at 1:30 PM

Info: Get "https://homeip:443 -> Get "https://ipv6:443

IPV4 OK und bei IPV6 tritt der Fehler auf.

AutoYaST · August 1, 2021 at 2:20 PM

Was ist denn "homeip"? Du musst da einen Domainnamen eintragen, der auf deinen Synapse Server zeigt und die IPv4 und IPv6 Adressen dessen respektive mit A und AAAA Records auflöst.

michaeleifel · August 1, 2021 at 9:17 PM

Quote from miotic

Info: Get "https://homeip:443 -> Get "https://ipv6:443

IPV4 OK und bei IPV6 tritt der Fehler auf.

Kannst du mal in den Container reinspringen und schauen ob der überhaupt grundsätzlich IPv6 macht?

Code

curl -I -6 https://www.google.com/

Mich würde auch interessieren ob der Host selbst IPv6 konfiguriert ist. Welches OS nutzt du denn? Hab Matrix selber am laufen, allerdings mit dem ananace/matrix-synapseDocker Image.

miotic · August 6, 2021 at 8:53 AM

AutoYaST

Ich überleg mit "https://github.com/b2un0/docker-netcup-dyndns" dies umzusetzten.

Respektiv die Einträge anzulegen und mit dem Container die A - IPv4 und AAAA - IPv6 aktuell zuhalten.

michaeleifel

Systeminformation

Code

Ubuntu 20.04.2 LTS
Linux 5.4.0-80-generic #90-Ubuntu SMP Fri Jul 9 22:49:44 UTC 2021 x86_64

Matrix-Container:

Code

"Networks": {
                "proxy": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": [
                        "nginx",
                        "e6d0a807cccc"
                    ],
                    "NetworkID": "8d7a6ad12a2ea46289972e1e8f87d116457765dc3c74beae57c795dc10dd93bd",
                    "EndpointID": "541c907b100037f9ea9611351803c4a4805ff2741f9f3a0bd59244df4e10d8c0",
                    "Gateway": "172.18.0.1",
                    "IPAddress": "172.18.0.4",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "2001:db8:2::1",
                    "GlobalIPv6Address": "2001:db8:2::4",
                    "GlobalIPv6PrefixLen": 64,
                    "MacAddress": "02:42:ac:12:00:04",
                    "DriverOpts": null
                },

Display More

Synapse-Container:

Code

"Networks": {
                "proxy": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": [
                        "0ffa71a1c67c",
                        "synapse"
                    ],
                    "NetworkID": "8d7a6ad12a2ea46289972e1e8f87d116457765dc3c74beae57c795dc10dd93bd",
                    "EndpointID": "67873a8f11693d5dc8a8bf90c1b636a1749a899f92664064f612da863b278e26",
                    "Gateway": "172.18.0.1",
                    "IPAddress": "172.18.0.3",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "2001:db8:2::1",
                    "GlobalIPv6Address": "2001:db8:2::3",
                    "GlobalIPv6PrefixLen": 64,
                    "MacAddress": "02:42:ac:12:00:03",
                    "DriverOpts": null
                },

Display More

H6G · August 6, 2021 at 10:08 AM

Drei Fragen:

a) wo läuft das ganze?

b) Warum DynDNS?

c) entsprechen die Configs der Realität?

michaeleifel · August 6, 2021 at 10:10 AM

miotic

Frage: Ist es Absicht, dass du ein extra IPv6 Netzwerk für Docker machst oder ist das nur der angepasste Output hier fürs Forum?

miotic · August 6, 2021 at 11:39 AM

H6G und michaeleifel:

Aktuell läuft das System in einer Testumgebung (VM), die nach dem Workshop abgerissen wird.

Nach der Testphase soll das Thema auf eine Stagingumgebung wechseln. Hier wurde der Root-Server RS 2000 G9 ausgesucht.

Ich muss mich für die Verwirrung entschuldigen.

H6G · August 6, 2021 at 12:15 PM

Quote from miotic

Aktuell läuft das System in einer Testumgebung (VM)

Und diese Testumgebung hat 2001:db8:1::/64 als funktionierendes IPv6 Subnetz?