mirrors/synapse
1
0
Fork 0
mirror of https://github.com/element-hq/synapse.git synced 2024-11-29 15:39:00 +03:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'master' into erikj/msc1711_faq

Browse source
This commit is contained in:
Richard van der Hoff 2019-02-07 19:27:42 +00:00
commit 188ad47e73
3 changed files with 17 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/4578.misc Normal file
View file

@ -0,0 +1 @@
Add port configuration information to ACME instructions.

26
docs/ACME.md
View file

@ -41,10 +41,10 @@ placed in Synapse's config directory without the need for any ACME setup.
The main steps for enabling ACME support in short summary are: The main steps for enabling ACME support in short summary are:
1. Allow Synapse to listen on port 80 with authbind, or forward it from a reverse-proxy. 1. Allow Synapse to listen for incoming ACME challenges.
1. Set `acme:enabled` to `true` in homeserver.yaml. 1. Enable ACME support in `homeserver.yaml`.
1. Move your old certificates (files `example.com.tls.crt` and `example.com.tls.key` out of the way if they currently exist at the paths specified in `homeserver.yaml`. 1. Move your old certificates (files `example.com.tls.crt` and `example.com.tls.key` out of the way if they currently exist at the paths specified in `homeserver.yaml`.
1. Restart Synapse 1. Restart Synapse.
Detailed instructions for each step are provided below. Detailed instructions for each step are provided below.
@ -71,7 +71,7 @@ location /.well-known/acme-challenge {
} }
``` ```
For Apache, add the following to your existing webserver config:: For Apache, add the following to your existing webserver config:
``` ```
ProxyPass /.well-known/acme-challenge http://localhost:8009/.well-known/acme-challenge ProxyPass /.well-known/acme-challenge http://localhost:8009/.well-known/acme-challenge
@ -79,6 +79,14 @@ ProxyPass /.well-known/acme-challenge http://localhost:8009/.well-known/acme-cha
Make sure to restart/reload your webserver after making changes. Make sure to restart/reload your webserver after making changes.
Now make the relevant changes in `homeserver.yaml` to enable ACME support:
```
acme:
enabled: true
port: 8009
```
#### Authbind #### Authbind
@ -102,24 +110,20 @@ sudo touch /etc/authbind/byport/80
sudo chmod 777 /etc/authbind/byport/80 sudo chmod 777 /etc/authbind/byport/80
``` ```
When Synapse is started, use the following syntax:: When Synapse is started, use the following syntax:
``` ```
authbind --deep <synapse start command> authbind --deep <synapse start command>
``` ```
### Config file editing Make the relevant changes in `homeserver.yaml` to enable ACME support:
Once Synapse is able to listen on port 80 for ACME challenge
requests, it must be told to perform ACME provisioning by setting `enabled`
to true under the `acme` section in `homeserver.yaml`:
``` ```
acme: acme:
enabled: true enabled: true
``` ```
### Starting synapse ### (Re)starting synapse
Ensure that the certificate paths specified in `homeserver.yaml` (`tls_certificate_path` and `tls_private_key_path`) do not currently point to any files. Synapse will not provision certificates if files exist, as it does not want to overwrite existing certificates. Ensure that the certificate paths specified in `homeserver.yaml` (`tls_certificate_path` and `tls_private_key_path`) do not currently point to any files. Synapse will not provision certificates if files exist, as it does not want to overwrite existing certificates.

2
docs/MSC1711_certificates_FAQ.md
View file

@ -112,7 +112,7 @@ _matrix._tcp.example.com. IN SRV 10 5 8000 customer.example.net.
In this situation, you have three choices for how to proceed: In this situation, you have three choices for how to proceed:
#### Option 1: give Synapse a certificate for your matrix domain #### Option 1: give Synapse (or a reverse-proxy) a certificate for your matrix domain
Synapse 1.0 will expect your server to present a TLS certificate for your Synapse 1.0 will expect your server to present a TLS certificate for your
`server_name` (`example.com` in the above example). You can achieve this by `server_name` (`example.com` in the above example). You can achieve this by