Wraps the Matrix Synapse container with an env-based config.
Use the below Docker stack for environment variables, default volume locations, and ports.
Once the ${YOUR_*}
and example.com variables are filled in, deploy with docker stack deploy matrix --compose-file docker-compose.yml
.
Most of the secret env vars are random strings but some, like the signing key, are a specific format. To generate a signing key file, run:
docker run --rm -it --entrypoint generate_signing_key.py johnstarich/synapse:1.31.0_20210429 > signing.key
NOTE: All published ports are examples only. Use HTTPS and a proxy instead, like Traefik.
version: "3.4"
services:
synapse:
image: johnstarich/synapse:latest # IMPORTANT: Replace ':latest' with a stable version of Synapse.
ports:
- "8008:8008"
environment:
# Required:
- SERVER_NAME=example.com
- DB_HOST=synapse_db
- DB_NAME=synapse
- DB_PASSWORD=${YOUR_DB_PASS}
- DB_USER=synapse
- FORM_SECRET=${YOUR_FORM_SECRET}
- REGISTRATION_SHARED_SECRET=${YOUR_REGISTRATION_SHARED_SECRET}
- SIGNING_KEY_FILE=/run/secrets/signing_key
- TOKEN_SIGNING_SECRET=${YOUR_TOKEN_SIGNING_SECRET}
# Optional. See Synapse docs for more config info: https://github.com/matrix-org/synapse
#- CONFIG_public_baseurl=https://matrix.example.com/
#- CONFIG_enable_registration=false
#- CONFIG_recaptcha_public_key=
#- CONFIG_recaptcha_private_key=
#- CONFIG_enable_registration_captcha=true
#- CONFIG_recaptcha_siteverify_api=
#- CONFIG_turn_uris.0=turn:turn.example.com?transport=udp
#- CONFIG_turn_uris.1=turn:turn.example.com?transport=tcp
#- CONFIG_turn_shared_secret=
#- CONFIG_media_store_path=/data/media
#- CONFIG_app_service_config_files.0=/bridge/slack-bridge.yaml
#
## SharedSecretAuthProvider is built-in and can be enabled if you like: https://github.com/devture/matrix-synapse-shared-secret-auth#configuring
#- CONFIG_modules.0.module=shared_secret_authenticator.SharedSecretAuthProvider
#- CONFIG_modules.0.config.shared_secret=
#- CONFIG_modules.0.config.m_login_password_support_enabled=true
#
secrets:
# Signing key file provided as a Docker secret. Unfortunately not declaratively generated.
- signing_key
volumes:
- synapse:/data
- bridge:/bridge
synapse_db:
image: postgres:12-alpine
environment:
- POSTGRES_USER=synapse
- POSTGRES_PASSWORD=${YOUR_DB_PASS}
- POSTGRES_DB=synapse
- POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
volumes:
- synapse_db:/var/lib/postgresql/data
web:
image: vectorim/element-web:v1.7.25
ports:
- "8081:80"
web_admin:
image: awesometechnologies/synapse-admin:0.7.2
ports:
- "8080:80"
volumes:
synapse:
synapse_db:
bridge: # This volume is intended to hold bridge registration files, which are included in synapse's app_service_config_files config
secrets:
signing_key:
file: ./signing.key