搭建Riot支持的Matrix Synapse

前言

  1. 已购买域名，如x.com
  2. 已购买服务器，如vps
  3. 已掌握ssh登陆服务器vps
  4. 采用BT宝塔面板，安装/设置Nginx、SSL

一、安装Matrix Synapse

1、域名解析

  • 可添加x.com或*.x.com，如a.x.com
  • 在DNS添加以下记录，本文采用二级域名a.x.com
    • A记录：a 服务器IP
    • SRV记录：_matrix._tcp.a.x.com 10 0 8448 a.x.com

2、安装BT宝塔，并设置服务器url、nginx、ssl

a、登陆ssh安装bt宝塔
  • Centos安装命令：
yum install -y wget && wget -O install.sh http://download.bt.cn/install/install.sh && sh install.sh
  • Ubuntu/Deepin安装命令：
wget -O install.sh http://download.bt.cn/install/install-ubuntu.sh && sudo bash install.sh
  • Debian安装命令：
wget -O install.sh http://download.bt.cn/install/install-ubuntu.sh && bash install.sh
  • Fedora安装命令:
wget -O install.sh http://download.bt.cn/install/install.sh && bash install.sh
安装完毕，使用浏览器进入bt后台，极速安装nginx最新版本，安装完毕后进行如下操作：
b、添加服务器url
  • 网站，添加站点：a.x.com
c、设置nginx
  • 点击a.x.com的设置
    • 选择SSL，点击Let's Encrypt，勾选域名，点击申请，ssl申请成功后，
    • 选择配置文件，在最后一个{前添加代码后，保存：
location /_matrix {
        proxy_pass http://localhost:8008;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
  • 重启/重载nginx

3、搭建安装环境

  • ubuntu/debian
apt-get update && apt get upgrade -y
apt-get install build-essential python2.7-dev libffi-dev python-pip python-setuptools sqlite3 libssl-dev python-virtualenv libjpeg-dev libxslt1-dev
  • CentOS7/Fedora25
yum update -y
yum install libtiff-devel libjpeg-devel libzip-devel freetype-devel lcms2-devel libwebp-devel tcl-devel tk-devel redhat-rpm-config python-virtualenv libffi-devel openssl-devel
yum groupinstall "Development Tools"
  • ArchLinux
pacman -S base-devel python2 python-pip python-setuptools python-virtualenv sqlite3
  • openSUSE
zypper in -t pattern devel_basis
zypper in python-pip python-setuptools sqlite3 python-virtualenv python-devel libffi-devel libopenssl-devel libjpeg62-devel
b、安装 Matrix Synapse homeserver 
virtualenv -p python2.7 ~/.synapse
source ~/.synapse/bin/activate
pip install --upgrade pip
pip install --upgrade setuptools
pip install https://github.com/matrix-org/synapse/tarball/master

4、配置 Matrix Synapse

a、生成配置文件 homeserver.yaml
cd ~/.synapse
python -m synapse.app.homeserver --generate-config -H a.x.com -c homeserver.yaml --report-stats=no
b、修改配置 homeserver.yaml
apt-get install vim   # 安装vim编辑器，若没有
vi homeserver.yaml

输入i，进行编辑
enable_registration: true # 默认为false，true为允许注册
enable_registration: false # 就需要登陆ssh进行添加用户
按esc键，shift+:，输入wq，保存退出

5、添加新用户

source ~/.synapse/bin/activate
synctl start
register_new_matrix_user -c homeserver.yaml https://localhost
根据以下提示，填入
New user root: youlike # 用户名
Password:              # 密码
Confirm password:      # 再次输入密码
Make admin [no]:       # 是否设置为管理员
Success!               # 显示设置成功

6a、手动启动 Matrix Synapse

cd ~/.synapse
source ./bin/activate
synctl start

或6b、用Systemd设置开机自启

  • 用vim创建synapse.service
    vi /etc/systemd/system/synapse.service
  • 填入如下代码，根据上文路径是以下，否则自行修改
    [Unit]
    Description=Matrix Synapse service
    After=network.target
    
    [Service]
    Type=forking
    WorkingDirectory=/root/.synapse/
    ExecStart=/root/.synapse/bin/synctl start
    ExecStop=/root/.synapse/bin/synctl stop
    ExecReload=/root/.synapse/bin/synctl restart
    Restart=always
    StandardOutput=syslog
    StandardError=syslog
    SyslogIdentifier=synapse
    
    [Install]
    WantedBy=multi-user.target

    
    
    # ===================或如下代码==============================
    # 模版：https://github.com/matrix-org/synapse/blob/master/contrib/systemd/synapse.service
    
    [Unit]
    Description=Synapse Matrix homeserver
    
    [Service]
    Type=simple
    User=synapse
    Group=synapse
    WorkingDirectory=/root/.synapse
    ExecStart=/root/.synapse/python2.7 -m synapse.app.homeserver --config-path=/root/.synapse/homeserver.yaml
    ExecStop=/root/.synapse/bin/synctl stop /root/.synapse/homeserver.yaml
    
    [Install]
    WantedBy=multi-user.target
  • 再运行以下命令
    systemctl enable synapse 或 systemctl daemon-reload
systemctl start synapse
  • systemd命令说明
    启动：systemctl start synapse
重启：systemctl restart synapse
停止：systemctl stop synapse

6c、用init设置开机自启

  • 参考模板，自行修改路径
  • Copy the linked file to /etc/init.d/$1
  • 运行以下命令
    update-rc.d $1
service $1 start

三、升级 Matrix Synapse

cd ~/.synapse
source ~/.synapse/bin/activate
pip install --upgrade --process-dependency-links https://github.com/matrix-org/synapse/tarball/master
synctl restart

四、迁移到新domain

  • 缺陷：用户的matrix ID 不能更改
  • 在新domain：y.com的dns解析添加
    • A记录：@ 服务器IP
    • SRV记录：_matrix._tcp.a.x.com 10 0 8448 y.com
    • 在bt重复添加网站 y.com 的步骤，最后重启nginx
    • 如果只是单程更换自定义服务器URL网址，以上便可。
    • 如果再加上更换服务器
    • 需要备份原先的 ~/.synapse文件夹
    • 再覆盖新服务器已安装的新的~/.synapse内容

五、相关技巧

  • 定向删除/查看注册用户的聊天室所有事件
    • 下载 ~/.synapse/homeserver.db
    • 修改/查看db数据库：DB.Browser.for.SQLite
    • 修改完成重新上传覆盖~/.synapse/homeserver.db
    • 重启synapse  cd ~/.synapse source ./bin/activate synctl restart 
  • bridge Matrix 和 Telegram
    • 第一种方法利用第三方服务
    • custom server_homeserver url：https://tchncs.de
    • 把机器人 t.me/tchncs_bot 加进 Telegram群
    • 输入 /alias and send. 然后就会获取地址，如: #telegram_-10010 — –:tchncs.de
    • 打开你需要连接的Riot聊天室的 Settings->addresses（设置-地址），填入上面获取的地址，如#telegram_-10010 — –:tchncs.de。
    • 设置：谁可以访问这个聊天室，以下任何一个皆可：
      • 任何知道聊天室链接的人，游客除外
      • 任何知道聊天室链接的人，包括游客
    • 第二种方法：把bridge自建在自己的服务器

六、使用客户端Riot

七、on CentOS 7

Install Development Tools

python -V
显示：Python 2.7.5

yum groupinstall -y "Development tools"

yum -y install libtiff-devel libjpeg-devel libzip-devel freetype-devel lcms2-devel libwebp-devel tcl-devel tk-devel redhat-rpm-config python-virtualenv libffi-devel openssl-devel 

wget https://bootstrap.pypa.io/get-pip.py
python get-pip.py

Install Synapse

virtualenv -p python2.7 /opt/synapse

chown -R $USER:$USER /opt/synapse/

source /opt/synapse/bin/activate
pip install --upgrade pip 
pip install --upgrade setuptools
pip install https://github.com/matrix-org/synapse/tarball/master

Installing and Configuring PostgreSQL

rpm -Uvh https://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-7-x86_64/pgdg-centos96-9.6-3.noarch.rpm

yum -y install postgresql96-server postgresql96-contrib

/usr/pgsql-9.6/bin/postgresql96-setup initdb
  • Edit the /var/lib/pgsql/9.6/data/pg_hba.conf to enable MD5 based authentication.
    vi /var/lib/pgsql/9.6/data/pg_hba.conf
  • Find the following lines and change peer to trust and idnet to md5.
    # TYPE  DATABASE        USER            ADDRESS                 METHOD
    
    # "local" is for Unix domain socket connections only
    local   all             all                                     peer
    # IPv4 local connections:
    host    all             all             127.0.0.1/32            idnet
    # IPv6 local connections:
    host    all             all             ::1/128                 idnet
  • Once updated, the configuration should look like this.
    # TYPE  DATABASE        USER            ADDRESS                 METHOD
    
    # "local" is for Unix domain socket connections only
    local   all             all                                     trust
    # IPv4 local connections:
    host    all             all             127.0.0.1/32            md5
    # IPv6 local connections:
    host    all             all             ::1/128                 md5
  • Start the PostgreSQL server and enable it to start automatically at boot.
    systemctl start postgresql-9.6
    systemctl enable postgresql-9.6
  • Change the password for the default PostgreSQL user.
    passwd postgres
  • Login.
    su - postgres
  • Create a new PostgreSQL user for Synapse.
    createuser synapse
  • PostgreSQL provides the psql shell to run queries on the database. Switch to the PostgreSQL shell by running.
    psql
  • Set a password for the newly created user for Synapse database.
    ALTER USER synapse WITH ENCRYPTED password 'DBPassword';
  • Replace DBPassword with a strong password and make a note of it as we will use the password later. Create a new database for the PostgreSQL database.
    CREATE DATABASE synapse ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0 OWNER synapse;
  • Exit from the psql shell.
    \q
  • Switch to the sudo user from current postgres user.
    exit
  • You will also need to install the packages required for Synapse to communicate with the PostgreSQL database server.
    yum -y install postgresql-devel libpqxx-devel.x86_64
    source /opt/synapse/bin/activate
    pip install psycopg2

Configuring Synapse

  • Synapse requires a configuration file before it can be started. The configuration file stores the server settings. Switch to the virtual environment and generate the configuration for Synapse.  source /opt/synapse/bin/activate cd /opt/synapse python -m synapse.app.homeserver --server-name matrix.example.com --config-path homeserver.yaml --generate-config --report-stats=no 
  • Replace matrix.example.com with your actual domain name and make sure that the server name is resolvable to the IP address of your Vultr instance. Provide --report-stats=yes if you want the servers to generate the reports, provide --report-stats=no to disable the generation of reports and statistics.
  • You should see a similar output.
    (synapse)[user@vultr synapse]$ python -m synapse.app.homeserver --server-name matrix.example.com --config-path homeserver.yaml --generate-config --report-stats=yes
    A config file has been generated in 'homeserver.yaml' for server name 'matrix.example.com' with corresponding SSL keys and self-signed certificates. Please review this file and customise it to your needs.
    If this server name is incorrect, you will need to regenerate the SSL certificates
  • By default, the homeserver.yaml is configured to use a SQLite database. We need to modify it to use the PostgreSQL database we have created earlier.
  • Edit the newly created homeserver.yaml.
nano homeserver.yaml
  • Find the existing database configuration which uses SQLite3. Comment out the lines as shown below. Also, add the new database configuration for PostgreSQL. Make sure that you use the correct database credentials.
    # Database configuration
    #database:
      # The database engine name
      #name: "sqlite3"
      # Arguments to pass to the engine
      #args:
        # Path to the database
        #database: "/opt/synapse/homeserver.db"
    
 
    database:
        name: psycopg2
        args:
            user: synapse
            password: DBPassword
            database: synapse
            host: localhost
            cp_min: 5
            cp_max: 10
  • Registration of a new user from a web interface is disabled by default. To enable registration, you can set enable_registration to True. You can also set a secret registration key, which allows anyone to register who has the secret key, even if registration is disabled.
    enable_registration: False

    registration_shared_secret: "YPPqCPYqCQ-Rj,ws~FfeLS@maRV9vz5MnnV^r8~pP.Q6yNBDG;"
  • Save the file and exit from the editor. Now you will need to register your first user. Before you can register a new user, though, you will need to start the application first.
    source /opt/synapse/bin/activate && cd /opt/synapse
    synctl start
  • You should see the following lines.
    2017-09-05 11:10:41,921 - twisted - 131 - INFO - - SynapseSite starting on 8008
    2017-09-05 11:10:41,921 - twisted - 131 - INFO - - Starting factory <synapse.http.site.SynapseSite instance at 0x44bbc68>
    2017-09-05 11:10:41,921 - synapse.app.homeserver - 201 - INFO - - Synapse now listening on port 8008
    2017-09-05 11:10:41,922 - synapse.app.homeserver - 442 - INFO - - Scheduling stats reporting for 3 hour intervals
    started synapse.app.homeserver('homeserver.yaml')
  • Register a new Matrix user.
    register_new_matrix_user -c homeserver.yaml https://localhost:8448
  • You should see the following.
    (synapse)[user@vultr synapse]$ register_new_matrix_user -c homeserver.yaml https://localhost:8448
    New user localpart [user]: admin
    Password:
    Confirm password:
    Make admin [no]: yes
    Sending registration request...
    Success.
  • Finally, before you can use the Homeserver, you will need to allow port 8448 through the Firewall. Port 8448 is used as the secured federation port. Homeservers use this port to communicate with each other securely. You can also use the built-in Matrix web chat client through this port.
    firewall-cmd --permanent --zone=public --add-port=8448/tcp
    firewall-cmd --reload
  • You can now log in to the Matrix web chat client by going to https://matrix.example.com:8448 through your favorite browser. You will see a warning about the SSL certificate as the certificates used are self-signed. We will not use this web chat client as it is outdated and not maintained anymore. Just try to check if you can log in using the user account you just created.

Setting up Let's Encrypt Certificates

  • Instead of using a self-signed certificate for securing federation port, we can use Let's Encrypt free SSL. Let's Encrypt free SSL can be obtained through the official Let's Encrypt client called Certbot.
  • Install Certbot.
    yum -y install certbot
  • Adjust your firewall setting to allow the standard HTTP and HTTPSports through the firewall. Certbot needs to make an HTTP connection to verify the domain authority.
    firewall-cmd --permanent --zone=public --add-service=http
    firewall-cmd --permanent --zone=public --add-service=https
    firewall-cmd --reload
To obtain certificates from Let's Encrypt CA, you must ensure that the domain for which you wish to generate the certificates is pointed towards the server. If it is not, then make the necessary changes to the DNS records of your domain and wait for the DNS to propagate before making the certificate request again. Certbot checks the domain authority before providing the certificates.
  • Now use the built-in web server in Certbot to generate the certificates for your domain.
    certbot certonly --standalone -d matrix.example.com
  • The generated certificates are likely to be stored in /etc/letsencrypt/live/matrix.example.com/. The SSL certificate will be stored as fullchain.pem and the private key will be stored as privkey.pem.
  • Copy the certificates.
    cp /etc/letsencrypt/live/matrix.example.com/fullchain.pem /opt/synapse/letsencrypt-fullchain.pem
    
    cp /etc/letsencrypt/live/matrix.example.com/privkey.pem /opt/synapse/letsencrypt-privkey.pem
  • You will need to change the path to the certificates and keys from the homeserver.yaml file. Edit the configuration.
    nano /opt/synapse/homeserver.yaml
  • Find the following lines and modify the path.
    tls_certificate_path: "/opt/synapse/letsencrypt-fullchain.pem" 

    # PEM encoded private key for TLS
    tls_private_key_path: "/opt/synapse/letsencrypt-privkey.pem"
  • Save the file and exit from the editor. Restart the Synapse server so that the changes can take effect.
    source /opt/synapse/bin/activate && cd /opt/synapse
    synctl restart
  • Let's Encrypt certificates are due to expire in 90 days, so it is recommended that you setup auto renewal for the certificates using cron jobs. Cron is a system service which is used to run periodic tasks.
  • Create a new script to renew certificates and copy the renewed certificates to the Synapse directory.
    nano /opt/renew-letsencypt.sh
  • Populate the file.
#!/bin/sh


    /usr/bin/certbot renew --quiet --nginx
    cp /etc/letsencrypt/live/matrix.example.com/fullchain.pem /opt/synapse/letsencrypt-fullchain.pem
    cp /etc/letsencrypt/live/matrix.example.com/privkey.pem /opt/synapse/letsencrypt-privkey.pem
  • Provide the execution permission.
    chmod +x /opt/renew-letsencypt.sh
  • Open the cron job file.
    crontab -e
  • Add the following line at the end of the file.
    30 5 * * 1 /opt/renew-letsencypt.sh
  • The above cron job will run every Monday at 5:30 AM. If the certificate is due to expire, it will automatically renew them.
  • Now you can visit https://matrix.example.com:8448. You will see that there is no SSL warning before connection.

Setup Nginx With Let's Encrypt

  • Apart from the secured federation port 8448, Synapse also listens to the unsecured client port 8008. We will now configure Nginx as a reverse proxy to the Synapse application.
    yum -y install nginx
  • Create a new configuration file.
    nano /etc/nginx/conf.d/synapse.conf
  • Populate the file with the following content.
    server {
        listen 80;
        server_name matrix.example.com;
        return 301 https://$host$request_uri;
    }
    server {
    
        listen 443;
        server_name matrix.example.com;
    
        ssl_certificate           /etc/letsencrypt/live/matrix.example.com/fullchain.pem;
        ssl_certificate_key       /etc/letsencrypt/live/matrix.example.com/privkey.pem;
    
        ssl on;
        ssl_session_cache  builtin:1000  shared:SSL:10m;
        ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
        ssl_prefer_server_ciphers on;
    
        access_log    /var/log/nginx/synapse.access.log;
    
        location /_matrix {
    
          proxy_pass          http://localhost:8008;
          proxy_set_header X-Forwarded-For $remote_addr;
    
        }
      }
  • Restart and enable Nginx to automatically start at boot time.
    systemctl restart nginx
    systemctl enable nginx
  • Finally, you can verify if Synapse can be accessed through the reverse proxy.
      curl https://matrix.example.com/_matrix/key/v2/server/auto
  • You should get similar output.
    [user@vultr ~]$ curl https://matrix.example.com/_matrix/key/v2/server/auto
    {"old_verify_keys":{},"server_name":"matrix.example.com","signatures":{"matrix.example.com":{"ed25519:a_ffMf":"T/Uq/UN5vyc4w7v0azALjPIJeZx1vQ+HC6ohUGkTSqiFI4WI/ojGpb2763arwSSQLr/tP/2diCi1KLU2DEnOCQ"}},"tls_fingerprints":[{"sha256":"eorhQj/kubI2PEQZyBZvGV7K1x3EcQ7j/AO2MtZMplw"}],"valid_until_ts":1504876080512,"verify_keys":{"ed25519:a_ffMf":{"key":"Gc1hxkpPmQv71Cvjyk+uzR5UtrpmgV/UwlsLtosawEs"}}}

Setting up the Systemd Service

  • It is recommended to use the Systemd service to manage the Synapse server process. Using Systemd will ensure that the server is automatically started on system startup and failures.
  • Create a new Systemd service file.
    nano /etc/systemd/system/matrix-synapse.service
  • Populate the file.
    [Unit]
    Description=Matrix Synapse service
    After=network.target
    
    [Service]
    Type=forking
    WorkingDirectory=/opt/synapse/
    ExecStart=/opt/synapse/bin/synctl start
    ExecStop=/opt/synapse/bin/synctl stop
    ExecReload=/opt/synapse/bin/synctl restart
    Restart=always
    StandardOutput=syslog
    StandardError=syslog
    SyslogIdentifier=synapse
    
    [Install]
    WantedBy=multi-user.target
  • Now you can quickly start the Synapse server.
    systemctl enable matrix-synapse
    systemctl start matrix-synapse
  • To stop  restart  status the server using following commands.
    systemctl stop matrix-synapse
    systemctl restart matrix-synapse
    systemctl status matrix-synapse

Using Riot

  • Setup Riot on Your Own Server.
  • Download Riot on your server.
    cd /opt/
    wget https://github.com/vector-im/riot-web/releases/download/v0.12.3/riot-v0.12.3.tar.gz
  • You can always find the link to the latest version on Riot's Github.
  • Extract the archive.
    tar -xzf riot-v*.tar.gz
  • Rename the directory for handling convenience.
    mv riot-v*/ riot/
  • Because we have already installed Certbot, we can generate the certificates directly. Make sure that the domain or subdomain you are using is pointed towards the server.
    systemctl stop nginx

    certbot certonly --standalone -d riot.example.com
  • The generated certificates are likely to be stored in the /etc/letsencrypt/live/riot.example.com/ directory.
  • Create a virtual host for the Riot application.
    nano /etc/nginx/conf.d/riot.conf
  • Populate the file.
    server {
        listen 80;
        server_name riot.example.com;
        return 301 https://$host$request_uri;
    }
    server {
    
        listen 443;
        server_name riot.example.com;
    
        ssl_certificate           /etc/letsencrypt/live/riot.example.com/fullchain.pem;
        ssl_certificate_key       /etc/letsencrypt/live/riot.example.com/privkey.pem;
    
        ssl on;
        ssl_session_cache  builtin:1000  shared:SSL:10m;
        ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
        ssl_prefer_server_ciphers on;
    
        root /opt/riot;
        index index.html index.htm;
    
        location / {
                try_files $uri $uri/ =404;
        }
    
        access_log    /var/log/nginx/riot.access.log;
    
      }
  • Copy the sample configuration file.
    cp /opt/riot/config.sample.json /opt/riot/config.json
  • Now edit the configuration file to make few changes.
    nano /opt/riot/config.json
  • Find the following lines.
    "default_hs_url": "https://matrix.org",
    "default_is_url": "https://vector.im",
  • Replace the value of the default home server URL with the URL of your Matrix server. For the identity server URL, you can use the default option, or you can also provide its value to the Matrix identity server, which is https://matrix.org.
    "default_hs_url": "https://matrix.example.com",
    "default_is_url": "https://matrix.org",
  • Save the file and exit. Provide ownership of the files to the Nginx user.
    chown -R nginx:nginx /opt/riot/
  • Restart Nginx.
    systemctl restart nginx
  • You can access Riot on https://riot.example.com. You can now log in using the username and password which you have created earlier. You can connect using the default server as we have already changed the default Matrix server for our application.
  • You now have a Matrix Synapse home server up and running. You also have a hosted copy of Riot, which you can use to send a message to other people using their Matrix ID, email or mobile number. Start by creating a chat room on your server and invite your friends on Matrix to join the chat room you have created.

centos7搭建转自：https://www.vultr.com/docs/create-a-chat-server-using-matrix-synapse-and-riot-on-centos-7

转载请超链接注明：事实派 » 搭建Riot支持的Matrix Synapse

标签： , ,