allmende/docker-matrix

docker composition of images for a Matrix home server with Riot interface and coturn

Introduction

Dockerfile for installation of matrix open federated Instant Messaging and VoIP communication server.

Configuration

To configure run the image with "generate" as argument. You have to setup the server domain and a /data-directory. After this you have to edit the generated homeserver.yaml file. Don't forget to configure the vector.im.conf file if you need the vector.im web client. Rename this file to deactivate vector.im

To get the things done, "generate" will create a own self-signed certificate.

This needs to be changed for production usage.

Example:

$ docker run -v /tmp/data:/data --rm -e SERVER_NAME=localhost silviof/docker-matrix generate

Start

For starting you need the port bindings and a mapping for the /data-directory.

$ docker run -d -p 8448:8448 -p 3478:3478 -v /tmp/data:/data silviof/docker-matrix start

Port configurations

This following ports are used in the container. You can use -p-option on docker run to configure this part (eg.: -p 443:8448).

• turnserver: 3478,3479,5349,5350 udp and tcp
• homeserver: 8008,8448 tcp
• vector.im web client: defaults to 8080

Version information

To get the installed synapse version you can run the image with version as argument or look at the container via cat.

$ docker run -ti --rm silviof/docker-matrix version
-=> Matrix Version: v0.7.1-0-g894a89d
# docker exec -it CONTAINERID cat /synapse.version
v0.7.1-0-g894a89d

Environment variables

• SERVER_NAME: Server and domain name, mandatory, needed only for generate
• REPORT_STATS: statistic report, mandatory, values: yes or no, needed only for generate

build specific arguments

• BV_SYN: synapse version, optional, defaults to master
• BV_VEC: vector version, optional, defaults to master
• BV_TUR: coturn turnserver version, optional, defaults to master

For building of synapse version v0.11.0-rc2 and vector with commit a9fc47e add --build-arg BV_SYN=v0.11.0-rc2 --build-arg BV_VEC=a9fc47efd77 to the docker build command.

Exported volumes

• /data: data-container

---

Composing

You can also generate the example configuration into /srv/matrix/example with

docker-compose -f generate.yml up

Then run the turnserver and matrix with

docker-compose -d up

Debugging the images happens with

docker-compose down

To debug the environments instead of the source images, use

docker-compose stop
docker-compose rm

instead.

Migration

Create the database container first and start it, attached to the desired network. Then run the migration with

docker-compose -f generate.yml run --rm migrate

docker-matrix's Issues

Adding mail address to an account fails due to disallowed use of a 3PID service

When adding a mail address to an identity which didn't have one associated, we currently receive

Untrusted ID Server matrix.allmende.io

This seems closely related to #10 and may be due to the fact that we are still trying to use the sydent service from matrix.org/vector.im, who seem to be closed for 3rd parties nowadays (CORS).

We may have to think about deploying our own 3PID, i.e. https://github.com/kamax-io/mxisd

Certificate expiration despite automatisation

So we had this issue yesterday and today, that the matrix.allmende.io home server reported to be unavailable from several Riot and Vector clients. When accessing its FQDN directly, one could see a CERT_DATE_INVALID error. Why did this happen?

The synapse home server makes use of TLS certificates for E2E signing of its packages. This happens from within the synapse Twisted application and is unrelated to the frontend TLS termination by nginx.

It also accepts outdated certificates, as long as they are cryptographically correct. In our use case I have reused the existing certificates from nginx and mapped them into matrix. Unfortunately this seems to be a bad idea, as it probably keeps file handles on those open, which prevents updating the symlinks by the letsencrypt container.

We could either copy them on first run and initialisation of the container into some lossy storage path that is not exposed as a volume, or do some other funky magic, to omit this. At each synapse update, or recreation of the container, the certificates would be synced from nginx, which is no problem due to the lazyness of their interpretation.

We'd need to adapt our local homeserver.yaml, too.

Email invitation to our home server does not work

When inviting users via the web interface at riot.allmende.io, no invitation message is being sent to a targeted user.

CSRF protection blocks Vector's URL previews

ailed to load resource: the server responded with a status of 404 ()
/#/room/!JZHnXcPDYRoiDcrMxW:matrix.allmende.io:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fww…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fa…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/!JZHnXcPDYRoiDcrMxW:matrix.allmende.io:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fa…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/!JZHnXcPDYRoiDcrMxW:matrix.allmende.io:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
LinkPreviewWidget.js:58 Failed to get preview for http://www.spiegel.de/fotostrecke/seebaer-schwandt-navigation-ist-wenn-man-trotzdem-ankommt-fotostrecke-137508-11.html Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fww…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
LinkPreviewWidget.js:58 Failed to get preview for https://archive.org/details/DubSituation Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fa…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
LinkPreviewWidget.js:58 Failed to get preview for http://jon.patterns.wiki.transformap.co/view/welcome-visitors/view/resource…-first/ward.fed.wiki.org/predicted-results/ward.fed.wiki.org/welcome-pages Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo

Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fw…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Ft…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Ft…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fpa…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fpa…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fg…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fg…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
LinkPreviewWidget.js:58 Failed to get preview for https://www.jacobinmag.com/2014/06/no-shortcuts/ Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fw…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
LinkPreviewWidget.js:58 Failed to get preview for http://jon.patterns.wiki.transformap.co/view/welcome-visitors/view/german-x…n-community/community.sfw.c2.com/developing-ideas-using-community-dialogue Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
LinkPreviewWidget.js:58 Failed to get preview for https://tree.taiga.io/project/gandhiano-degrowth-2016/us/27 Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Ft…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
LinkPreviewWidget.js:58 Failed to get preview for http://patterns.wiki.transformap.co/view/welcome-visitors/jon.patterns.wiki…rs/frances.uk.fedwikihappening.net/hospitality-and-hostility-to-technology Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fpa…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
LinkPreviewWidget.js:58 Failed to get preview for https://github.com/gandhiano/technology-degrowth/issues/7 Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fg…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fd…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fd…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Ft…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Ft…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Ft…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Ft…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fg…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fg…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
LinkPreviewWidget.js:58 Failed to get preview for https://drive.google.com/file/d/0B0UXRV0dOOgaUElaeWo2QXdxS2c/view Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fd…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
LinkPreviewWidget.js:58 Failed to get preview for https://twitter.com/lechatpito/status/434770786348322816 Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Ft…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
LinkPreviewWidget.js:58 Failed to get preview for https://twitter.com/fedwiki/status/732155523823456256 Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Ft…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
LinkPreviewWidget.js:58 Failed to get preview for https://github.com/gandhiano/technology-degrowth Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Fg…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
https://vector.allmende.io/version?ts=1464814491222 Failed to load resource: the server responded with a status of 404 ()
https://matrix.allmende.io/_matrix/client/r0/sync?filter=3&timeout=30000&si…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: net::ERR_NETWORK_CHANGED
sync.js:561 /sync error Error: CORS request rejected: https://matrix.allmende.io/_matrix/client/r0/sync?filter=3&timeout=30000&si…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo
    at i (https://vector.allmende.io/bundle.js:77:12581)
    at XMLHttpRequest.r (https://vector.allmende.io/bundle.js:77:12391)(anonymous function) @ sync.js:561
sync.js:562Error: CORS request rejected: https://matrix.allmende.io/_matrix/client/r0/sync?filter=3&timeout=30000&si…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(…)

https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
LinkPreviewWidget.js:58Failed to get preview for http://jon.patterns.wiki.transformap.co/view/welcome-visitors/view/resource…-first/ward.fed.wiki.org/predicted-results/ward.fed.wiki.org/welcome-pages Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo(anonymous function) @ LinkPreviewWidget.js:58
https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo Failed to load resource: the server responded with a status of 404 ()
/#/room/#federation:matrix.org:1 XMLHttpRequest cannot load https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://vector.allmende.io' is therefore not allowed access. The response had HTTP status code 404.
LinkPreviewWidget.js:58Failed to get preview for http://jon.patterns.wiki.transformap.co/view/welcome-visitors/view/resource…-first/ward.fed.wiki.org/predicted-results/ward.fed.wiki.org/welcome-pages Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=http%3A%2F%2Fjo…TE3MTA5MDUKMDAyZnNpZ25hdHVyZSArZ8VVU2Z6ET8xP2wvzvH59DEZRfgG0XbDRP0VJVCX9wo

registration is failing on captcha-validation

1. Register an Account
2. Validate your E-Mail
3. Tick the Box "I am not a Robot"
4. Select the pictures that fit the description
5. Submit the selection
6. If the selection was correct, you will be redirected to the registration page and an Error message is shown: "Internal Server Error: M_UNKNOWN".

URL previews are broken : CORS rejected

The browser console of our Riot instance is flooded with warnings such as:

Failed to get preview for https://lab.allmende.io/degrowth/map/milestones/1 Error: CORS request rejected: https://matrix.allmende.io/_matrix/media/r0/preview_url?url=https%3A%2F%2Flab.allmende.io%2Fdegrowth%2Fmap%2Fmilestones%2F1&ts=1538065253391

Identity server is missing

https://github.com/matrix-org/sydent takes care of 3rd party identifiers, 3pIDs, and maps phone numbers, Skype accounts, email addresses and more to Matrix homeserver identities.

CORS OPTIONS request rejected

When using https://riot.allmende.io with Rambox, the browser console issues repeating errors about

bundle.js:23 OPTIONS https://matrix.allmende.io/_matrix/client/r0/sync?filter=41&timeout=30000&since=s9055732_123868661_1049800_8002200_662241_1373_200549_777591_79 502

/#/room/#libre.sh:matrix.allmende.io/$1559035725442wRjzV:hackerspaces.be:1 Failed to load https://matrix.allmende.io/_matrix/client/r0/sync?filter=41&timeout=30000&since=s9055732_123868661_1049800_8002200_662241_1373_200549_777591_79: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://riot.allmende.io' is therefore not allowed access.
bundle.js:41 /sync error Error: CORS request rejected: https://matrix.allmende.io/_matrix/client/r0/sync?filter=41&timeout=30000&since=s9055732_123868661_1049800_8002200_662241_1373_200549_777591_79
    at c (https://riot.allmende.io/bundles/498db95e44f3e6e5056f/bundle.js:23:55883)
    at XMLHttpRequest.o.onreadystatechange (https://riot.allmende.io/bundles/498db95e44f3e6e5056f/bundle.js:23:55409)

bundle.js:41 Error: CORS request rejected: https://matrix.allmende.io/_matrix/client/r0/sync?filter=41&timeout=30000&since=s9055732_123868661_1049800_8002200_662241_1373_200549_777591_79
    at c (bundle.js:23)
    at XMLHttpRequest.o.onreadystatechange (bundle.js:23)

Plus also

bundle.js:23 OPTIONS https://matrix.allmende.io/_matrix/client/r0/joined_groups 502

/#/room/#libre.sh:matrix.allmende.io/$1559035725442wRjzV:hackerspaces.be:1 Failed to load https://matrix.allmende.io/_matrix/client/r0/joined_groups: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://riot.allmende.io' is therefore not allowed access.

GET https://matrix.allmende.io/_matrix/client/versions 502

/#/room/#libre.sh:matrix.allmende.io/$1559035725442wRjzV:hackerspaces.be:1 Failed to load https://matrix.allmende.io/_matrix/client/versions: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://riot.allmende.io' is therefore not allowed access. The response had HTTP status code 502.

Including what we know from #14, we need to review the CORS settings and apply suitable patches. There is a lenghty discussion about how to do this in our current environment at nginx-proxy/nginx-proxy#804

Separate Vector from Matrix image

The current monolithic container approach tightly couples the different application's life cycles to each other. But we only want to loosely couple them, so each container can have separate upgrades, which decreases overall downtimes.

To move along, decoupling Vector from Matrix can happen by:

• Repeating the procedure from the coturn commits to extract config generator and runtime build into a separate image.

Document compose with multiple setups

This involves setting the -f flag for site configurations and using a --name tag for namespace separation.

Synchronisation with upstream

Meanwhile Upstream has released v0.21, while we are still at v0.18.7.

Push gateway is missing

Push notifications arrive earlier with https://github.com/matrix-org/sygnal

Registration fails with email provided

As the identity servers don't seem to provide proper CORS headers for utilisation of them, registration has previously failed when email addresses were provided. A workaround is omitting them. Yet they are useful for email notifications and alike, why #7 is so important.

Remove separate config generation cases

The containers currently build with two start cases.
8c114ed introduced a simple workaround for docker-compose to share configuration between initialization-time containers.

docker-compose -f generate.yml up then creates prefilled configuration templates into /srv/matrix/example.

Adapting the files to ones needs and issuing docker-compose up then creates a working environment. To spare the need for a two-staged setup procedure, we want to:

• Extract config generation and environment setup into its own container.
  This container would always generate from passed declarations an error-free environment for following services.
  • Depend all services on a positive outcome of its application.
  • Share state between services via layered env files.

VoIP group conferences fail

The current deployment at matrix.allmende.io currently fails to initiiate group voice calls. From observing the situation, it is visible that the VoIP Integration bot does not enter the desired room anymore upon initialisation of a call.

This does not affect 1-on-1 calls, which are established without a bridging bot in a peer-to-peer way via WebRTC directly from client to client, only making use of the TURN service to eventually fist through firewalls.