docker安装 Synapse（Matrix 服务器）和 Element Web（Matrix 客户端）

全平台的自托管的支持端到端加密的聊天软件
去中心化，故可以和其他所有人的matrix服务器进行加密聊天，类似于邮件系统

最终效果:

web:

1.png

web

ios:

ios

创建配置文件

docker run -it --rm \
    -v /home/matrix/data:/data \
    -e SYNAPSE_SERVER_NAME=matrix.xxx.com:443 \
    -e SYNAPSE_REPORT_STATS=no \
    matrixdotorg/synapse:latest generate

会在/home/matrix/data文件夹生成homeserver.yaml

homeserver.yaml需要手动修改一下，修改后是这样:

# Configuration file for Synapse.
#
# This is a YAML file: see [1] for a quick introduction. Note in particular
# that *indentation is important*: all the elements of a list or dictionary
# should have the same indentation.
#
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
#
# For more information on how to configure Synapse, including a complete accounting of
# each option, go to docs/usage/configuration/config_documentation.md or
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
server_name: "matrix.xxx.com:443"
pid_file: /data/homeserver.pid
listeners:
  - port: 8008
    tls: false
    type: http
    x_forwarded: true
    resources:
      - names: [client, federation]
        compress: false
database:
  name: sqlite3
  args:
    database: /data/homeserver.db
log_config: "/data/matrix.xxx.com:443.log.config"
media_store_path: /data/media_store
registration_shared_secret: ";V^o;[email protected]:rzjsand2S@K3#t1TZaskjdqy^cSHM-N"
report_stats: false
macaroon_secret_key: "j41qkRhzK=3ljN5+qaskjnd2MD5z.cZ4FoV_S_v8YT_ESxXKD"
form_secret: "HESK209sZrIJU&6GsEz8TFWDM&CKjofdSf&m7=5&HkIf#s@H@j"
signing_key_path: "/data/matrix.xxx.com:443.signing.key"
trusted_key_servers:
  - server_name: "matrix.org"

enable_registration: true
enable_registration_without_verification: false

suppress_key_server_warning: true

registrations_require_3pid: #允许的3pid注册方式
  - email
# vim:ft=yaml


email:
  smtp_host: mail.xxx.com
  smtp_port: 465
  smtp_user: "[email protected]"
  smtp_pass: "SKJDOIAFJS23kJE@LJLaskldjasalfalskfjlasjf"
  force_tls: true
  require_transport_security: true
  enable_tls: true
  notif_from: "Matrix 通知 <[email protected]>"
  app_name: matrix
  enable_notifs: true
  notif_for_new_users: false
  client_base_url: "http://matrix.xxx.com:443/riot"
  validation_token_lifetime: 15m
  invite_client_location: https://matrix.xxx.com:443

  subjects:
    message_from_person_in_room: "[%(app)s] 你在 %(app)s 上收到了来自 %(room)s 房间 %(person)s 的消息..."
    message_from_person: "[%(app)s] 你在 %(app)s 上收到了来自 %(person)s 的消息..."
    messages_from_person: "[%(app)s] 你在 %(app)s 上收到了来自 %(person)s 的多条消息..."
    messages_in_room: "[%(app)s] 你在 %(app)s 上收到了 %(room)s 房间的多条消息..."
    messages_in_room_and_others: "[%(app)s] 你在 %(app)s 上收到了 %(room)s 房间和其他地方的多条消息..."
    messages_from_person_and_others: "[%(app)s] 你在 %(app)s 上收到了来自 %(person)s 和其他人的多条消息..."
    invite_from_person_to_room: "[%(app)s] %(person)s 邀请你加入 %(room)s 房间，来 %(app)s 上一起聊天吧..."
    invite_from_person: "[%(app)s] %(person)s 邀请你在 %(app)s 上聊天..."
    password_reset: "[%(server_name)s] 密码重置"
    email_validation: "[%(server_name)s] 验证你的邮箱"

docker-compose.yml:

version: "3.3"

services:
  synapse:
    image: "matrixdotorg/synapse:latest"
    container_name: "matrix_synapse"
    restart: unless-stopped
    ports:
      - "172.17.0.1:47808:8008"
    volumes:
      - "./data:/data"
    environment:
      VIRTUAL_HOST: "matrix.xxx.com"
      VIRTUAL_PORT: 8008
      LETSENCRYPT_HOST: "matrix.xxx.com"
      SYNAPSE_SERVER_NAME: "matrix.xxx.com"
      SYNAPSE_REPORT_STATS: "yes"
      TZ: "Asia/Shanghai"

  element-web:
    image: "vectorim/element-web"
    container_name: "element-web"
    restart: unless-stopped
    ports:
      - "172.17.0.1:47809:80"
    # volumes:
    #   - "./element-web/config.json:/app/config.json" #如果把element默认的服务器改为自己的话，可在容器启动后使用`docker cp element-web:/app/config.json ./`将文件复制出来，放到映射的对应位置
    environment:
      TZ: "Asia/Shanghai"

element-web自定义后的config.json:

修改matrix.xxx.com相关的行即可

{
    "default_server_config": {
        "m.homeserver": {
            "base_url": "https://matrix.xxx.com:443",
            "server_name": "matrix.xxx.com"
        },
        "m.identity_server": {
            "base_url": "https://vector.im"
        }
    },
    "disable_custom_urls": false,
    "disable_guests": false,
    "disable_login_language_selector": false,
    "disable_3pid_login": false,
    "brand": "Element",
    "integrations_ui_url": "https://scalar.vector.im/",
    "integrations_rest_url": "https://scalar.vector.im/api",
    "integrations_widgets_urls": [
        "https://scalar.vector.im/_matrix/integrations/v1",
        "https://scalar.vector.im/api",
        "https://scalar-staging.vector.im/_matrix/integrations/v1",
        "https://scalar-staging.vector.im/api",
        "https://scalar-staging.riot.im/scalar/api"
    ],
    "default_country_code": "CN",
    "show_labs_settings": false,
    "features": {},
    "default_federate": true,
    "default_theme": "light",
    "room_directory": {
        "servers": ["matrix.xxx.com"]
    },
    "enable_presence_by_hs_url": {
        "https://matrix.xxx.com:443": false
    },
    "setting_defaults": {
        "breadcrumbs": true
    },
    "jitsi": {
        "preferred_domain": "meet.element.io"
    },
    "element_call": {
        "url": "https://call.element.io",
        "participant_limit": 8,
        "brand": "Element Call"
    },
    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
}

创建账户

docker exec -it matrix_synapse register_new_matrix_user http://172.17.0.1:47808 -c /data/homeserver.yaml  -a -u admin -p a12013o23jb45jkjasdjkasdn994a7162oaijso3213n4m2k3j0asaaj25cea32

nginx配置文件(这个是适配这篇文章: docker运行nginx并用非标端口申请ssl证书 的配置文件: (普通的nginx配置文件在更下面)

# websocket支持
map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}
server {
    listen 80;
    listen [::]:80;
    http2 on;
    server_name matrix.xxx.com;

    access_log /var/log/nginx/matrix.xxx.com_access.log geoip_enriched;
    error_log /var/log/nginx/matrix.xxx.com_error.log;

    return 301 https://$host:443$request_uri;
}
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name matrix.xxx.com;

    auth_request @geoip;

    # 从auth_request返回的头信息中提取变量
    auth_request_set $geoip_country $upstream_http_x_geoip_country;
    auth_request_set $geoip_stateprov $upstream_http_x_geoip_stateprov;
    auth_request_set $geoip_city $upstream_http_x_geoip_city;
    auth_request_set $geoip_latitude $upstream_http_x_geoip_latitude;
    auth_request_set $geoip_longitude $upstream_http_x_geoip_longitude;
    auth_request_set $geoip_continent $upstream_http_x_geoip_continent;
    auth_request_set $geoip_timezone $upstream_http_x_geoip_timezone;
    auth_request_set $geoip_asn $upstream_http_x_geoip_asn;
    auth_request_set $geoip_asnorganization $upstream_http_x_geoip_asnorganization;

    # 将提取到的变量添加到头信息中
    add_header X-Geoip-Country $geoip_country always;
    add_header X-Geoip-StateProv $geoip_stateprov always;
    add_header X-Geoip-City $geoip_city always;
    add_header X-Geoip-Latitude $geoip_latitude always;
    add_header X-Geoip-Longitude $geoip_longitude always;
    add_header X-Geoip-Continent $geoip_continent always;
    add_header X-Geoip-Timezone $geoip_timezone always;
    add_header X-Geoip-Asn $geoip_asn always;
    add_header X-Geoip-AsnOrganization $geoip_asnorganization always;

    ssl_certificate /home/nginx/certs/matrix.xxx.com/fullchain.pem;
    ssl_certificate_key /home/nginx/certs/matrix.xxx.com/privkey.pem;

    # 启动HSTS
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # 强制使用安全协议
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    access_log /var/log/nginx/matrix.xxx.com_access.log geoip_enriched;
    error_log /var/log/nginx/matrix.xxx.com_error.log;

    location /.well-known/matrix/server {
        default_type application/json;
        return 200 '{"m.server": "matrix.xxx.com:443"}';
    }

    location ~* ^(\/_matrix|\/_synapse\/client) {
        proxy_pass http://172.17.0.1:47808;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;

        # Nginx by default only allows file uploads up to 1M in size
        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
        client_max_body_size 50M;
    }

    location / {
        proxy_pass http://172.17.0.1:47809;

        # 隐藏X-Powered-By
        proxy_hide_header X-Powered-By;

        # 显示真实ip
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        #cloudflare真实ip，如果使用了cf的cdn需要取消注释下面两行
        #set_real_ip_from 0.0.0.0/0;
        #real_ip_header CF-Connecting-IP;

        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout         900;

        # websocket支持
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_set_header Connection $http_connection;
        proxy_http_version 1.1;

        # 密码验证 （可选）
        # auth_basic "Registry Realm"; #（可选）
        # auth_basic_user_file /home/docker-registry/registry.passwords;# （可选）

    }
    location = @geoip {
      internal;

      proxy_pass http://172.17.0.1:8081/;
      # proxy_pass_request_body off;
      proxy_set_header X-Geoip-Address $remote_addr;
    }
}

普通的nginx配置文件:

# websocket支持
map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}
server {
    listen 80;
    listen [::]:80;
    http2 on;
    server_name matrix.xxx.com;

    access_log /var/log/nginx/matrix.xxx.com_access.log default;
    error_log /var/log/nginx/matrix.xxx.com_error.log;

    return 301 https://$host:443$request_uri;
}
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name matrix.xxx.com;

    ssl_certificate /home/nginx/certs/matrix.xxx.com/fullchain.pem;
    ssl_certificate_key /home/nginx/certs/matrix.xxx.com/privkey.pem;

    # 启动HSTS
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # 强制使用安全协议
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    access_log /var/log/nginx/matrix.xxx.com_access.log default;
    error_log /var/log/nginx/matrix.xxx.com_error.log;

    location /.well-known/matrix/server {
        default_type application/json;
        return 200 '{"m.server": "matrix.xxx.com:443"}';
    }

    location ~* ^(\/_matrix|\/_synapse\/client) {
        proxy_pass http://172.17.0.1:47808;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;

        # Nginx by default only allows file uploads up to 1M in size
        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
        client_max_body_size 50M;
    }

    location / {
        proxy_pass http://172.17.0.1:47809;

        # 隐藏X-Powered-By
        proxy_hide_header X-Powered-By;

        # 显示真实ip
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        #cloudflare真实ip，如果使用了cf的cdn需要取消注释下面两行
        #set_real_ip_from 0.0.0.0/0;
        #real_ip_header CF-Connecting-IP;

        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout         900;

        # websocket支持
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_set_header Connection $http_connection;
        proxy_http_version 1.1;

        # 密码验证 （可选）
        # auth_basic "Registry Realm"; #（可选）
        # auth_basic_user_file /home/docker-registry/registry.passwords;# （可选）

    }
}

最后https://matrix.xxx.com:443 登录

各种平台也都有客户端

查看所有客户端: https://matrix.org/ecosystem/clients/

iOS/iPadOS客户端个人推荐: Synod.im

测试与其他服务器连通性的工具: https://federationtester.matrix.org

官方文档

Last modification：December 28, 2024
© Reprint prohibited
V50%看看实力