Matrix cloudflare tunnels setup

3 years ago by Elegast to c/selfhosted

Hey all, I decided to try setting up matrix/synapse via cloudflare tunnels.

I was following this guide

http://192.168.1.2:8009/_matrix/static/ shows

It works! Synapse is running

as does https://matrix.example.com/_matrix/static/

https://matrix.example.com/...

comes up with 404. Is anything ever truly *well* known?

and matrix/synapse container shows 401 unauthorized when trying to access public rooms

synapse.http.matrixfederationclient - 676 - INFO - POST-87644 - {POST-O-3} [matrix.org] Got response headers: 401 Unauthorized

federation tester is showing

Hosts

_dc-srv.959fd81029a5._matrix._tcp.matrix.example.com.
Addresses

Errors

SRV record target _dc-srv.959fd81029a5._matrix._tcp.matrix.example.com. is a CNAME record, which is forbidden (as per RFC2782)

can anyone point me in the right direction?

I'm assuming this is still an issue with ./well-known or something.

cheers

manwichmakesameal 4 points 3 years ago

How exactly is your Matrix server running? Behind an nginx reverse proxy or are you using the cloudflare tunnel directly to it? Personally, I have mine behind a reverse proxy and just point the tunnel at my proxy.

save

path: 0 608989, hotness: undefined, score: 4, children: 3

Elegast 1 point 3 years ago

Since I just migrated to cf tunnels I set it up to directly point to my matrix instance. I was planning on implementing the rproxy back in once I got it working.

My old setup was way over convoluted with a double reverse proxy, ec2 instance, and vpn lmao.

save

path: 0 608989 609073, hotness: undefined, score: 1, children: 2

manwichmakesameal 1 point 3 years ago

To add more, I think you're right in suspecting your ./well-known setting. I'm not sure where you would set that in a direct to Matrix setup like you have but it's pretty easy using nginx. I just ran mine through the federation checker and my hosts section came back as exactly what I set in my location /.well-known/matrix/server directive in my nginx config.

save

path: 0 608989 609073 609400, hotness: undefined, score: 1, children: 0

manwichmakesameal 1 point 3 years ago

So, my setup is this: Nginx reverse proxy using LE wildcard certs for my domain. I put my Matrix on a subdomain on my domain. Then I just point the CF tunnel to the reverse proxy using the subdomain for my public hostname. Everything works for me. Federation, local chat, etc. I have Home Assistant notifying me via Matrix now too.

save

path: 0 608989 609073 609173, hotness: undefined, score: 1, children: 0

outcide 1 point 3 years ago

Do it in stages. First get it running without any reverse proxies, just connecting directly to the exposed ports. Once that's working, add in your proxy. Then finally add cloudflare tunnels.

save

path: 0 609889, hotness: undefined, score: 1, children: 0

StateDeadTrip 1 point 3 years ago

I’ve recently done the same thing. I setup both dendrite and synapse.

For both I tried the srv record and could not get it to pass the federation testers. In the end as mines behind a nginx proxy I served the wellknows frommnginx rather than letting synapse/dendrite serve it. Federated correctly afterwards.

As such I would suggest serving the json well know using whatever reverse proxy you are using.

save

path: 0 609987, hotness: undefined, score: 1, children: 0

ellwoodb 1 point 3 years ago

Hey, I recently accomplished this.

You have to host the .well-known via a reverse proxy and then point CT to the reverse proxy, like @manwichmakesameal@lemmy.world said. Personally, followed this guide and here they talk about how to serve the .well-known. You don't have to follow it exactly, if you already have a working Synapse server.

I hope I could help you and if you have any more questions feel free to ask.

Edit: formatting

save

path: 0 610403, hotness: undefined, score: 1, children: 0