Recently I set up a Matrix homeserver for my friend group. I considered whether I needed federation, and ultimately decided that I did. On top of that, I also had to set up a TURN server so that calls would work properly for everyone, since if someone is behind NAT, the connection typically doesn’t work reliably. I launched the container on a Hetzner cloud VPS running Debian 10.

 

You’ll need a running Docker service, if it’s not installed yet, you can easily install it using https://get.docker.com/. I recommend creating a git repository where you can push your docker-compose and nginx config files.

If docker compose isn’t installed yet, install it according to your distribution. (For Ubuntu: apt install docker-compose)

For Debian 10, download the latest version (which you can find here: https://github.com/docker/compose/releases):

curl -L https://github.com/docker/compose/releases/download/1.28.5/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose

chmod +x /usr/local/bin/docker-compose

For the nginx reverse proxy, you’ll need an SSL certificate, below we’ll use Let’s Encrypt’s certificate with certbot. If certbot isn’t installed yet, install it from the repository:

apt install certbot

Then register your domain name:

certbot certonly --standalone

Note the location of the SSL cert, or use the static path (I’ll use this from here on), which should be:

/etc/letsencrypt/archive/matrix.yourwebsite.hu/

Create the nginx configuration file that will act as a reverse proxy for the Matrix Synapse server and federation:

root@server:# vim /root/docker-config/nginx/conf.d/matrix.yourwebsite.hu.conf 
server {
    listen 80;
        server_name matrix.yourwebsite.hu;
        return 301 https://$server_name$request_uri;
}

server {
        listen 443 ssl;
	listen 8448 ssl;
        server_name matrix.yourwebsite.hu;

        access_log /var/log/nginx/matrix.yourwebsite.hu.access.log;
        error_log /var/log/nginx/matrix.yourwebsite.hu.error.log;

# if you use letsencrypt symlinks and have newly generated ssl certs, it's worth restarting the docker service, because it most likely won't see the links properly

        ssl on;
        ssl_certificate /etc/nginx/ssl/matrix.yourwebsite.hu/fullchain1.pem;
        ssl_certificate_key /etc/nginx/ssl/matrix.yourwebsite.hu/privkey1.pem;

	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_prefer_server_ciphers on; 
	ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
	ssl_ecdh_curve secp384r1;
	ssl_session_timeout  10m;
	ssl_session_cache shared:SSL:10m;
	resolver 1.1.1.1 valid=300s;
	resolver_timeout 5s; 
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
	add_header X-Frame-Options DENY;
	add_header X-Content-Type-Options nosniff;
	add_header X-XSS-Protection "1; mode=block";

	location ~* ^(\/_matrix|\/_synapse\/client) {  
		proxy_pass http://synapse:8008;
		proxy_set_header X-Forwarded-For $remote_addr;
        	proxy_set_header X-Forwarded-Proto $scheme;
	        proxy_set_header Host $host;
		client_max_body_size 50M;
	}
}

Create a docker-compose.yaml file in your favorite editor, and paste the following, then edit it to suit your needs:

version: '2'
services:
 web:
  image: nginx
  restart: unless-stopped
  container_name: nginx
  ports:
   - "80:80"
   - "443:443"
   - "8448:8448"
  volumes:
   - /root/docker-config/nginx/conf.d/:/etc/nginx/conf.d/
   - /etc/letsencrypt/archive/matrix.yourwebsite.hu/:/etc/nginx/ssl/matrix.zoliben.com
  links:
   - synapse

 synapse:
  image: matrixdotorg/synapse
  restart: unless-stopped
  volumes:
   - /data/matrix:/data

I store the Matrix configuration and other files (including uploaded images) in the /data/matrix folder in this example.

Create the configuration files:

docker run -it --rm -v /data/matrix:/data -e SYNAPSE_SERVER_NAME=matrix.yourwebsite.hu -e SYNAPSE_REPORT_STATS=yes matrixdotorg/synapse:latest generate

After that, you still need to configure federation in the configuration file: /data/matrix/homeserver.yaml
Find the „listeners:” section, and uncomment the part regarding port 8448 so it looks similar (since we’re using a reverse proxy, TLS is not needed at the application level):

listeners:
  # TLS-enabled listener: for when matrix traffic is sent directly to synapse.
  #
  # Disabled by default. To enable it, uncomment the following. (Note that you
  # will also need to give Synapse a TLS key and certificate: see the TLS section
  # below.)
  #
  - port: 8448
    type: http
    tls: false
    resources:
      - names: [client, federation]

  # Unsecure HTTP listener: for when matrix traffic passes through a reverse proxy
  # that unwraps TLS.
  #
  # If you plan to use a reverse proxy, please see
  # https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md.
  #
  - port: 8008
    tls: false
    type: http
    x_forwarded: true

    resources:
      - names: [client, federation]
        compress: false