Improve NGINX reverse proxy setup instructions #971
Open
Anagastes
wants to merge 6 commits from
Anagastes/continuwuity:main into main
pull from: Anagastes/continuwuity:main
merge into: continuwuation:main
continuwuation:main
continuwuation:renovate/crate-ci-typos-1.x
continuwuation:renovate/cargo-bins-cargo-binstall-1.x
continuwuation:renovate/rust-patch-updates
continuwuation:renovate/rspress-plugin-preview-2.x-lockfile
continuwuation:renovate/rspress-plugin-client-redirects-2.x-lockfile
continuwuation:renovate/rspress-core-2.x-lockfile
continuwuation:nex/perf/dont-process-disconnected-rooms
continuwuation:aranje/illegal-car-mods
continuwuation:nex/feat/faster-deactivations
continuwuation:ginger/hs-ops-guidelines
continuwuation:nex/feat/msc4322-media-redaction
continuwuation:ginger/stitched-order
continuwuation:nex/feat/msc4406-sender-ignored
continuwuation:ginger/fallback-auth-handler
continuwuation:jade/build-info
continuwuation:jade/fix-optional-config-sections
continuwuation:nex/stateres-refactor
continuwuation:nex/feat/complement
continuwuation:ginger/deps/update-rspress
continuwuation:jade/admin-announce-improvements
continuwuation:ginger/xtask-improvements
continuwuation:jade/improve-admin-config-display
continuwuation:nex/fix/better-stateres-error-logs
continuwuation:renovate/crate-ci-committed-1.x
continuwuation:jade/sender-timeouts
continuwuation:nex/feat/custom-v12-room-ids
continuwuation:ginger/update-metadata
continuwuation:renovate/rand-0.x
continuwuation:nex/feat/admin-force-logout
continuwuation:renovate/lddtree-0.x
continuwuation:tom/max-perf-docs
continuwuation:renovate/github-actions-non-major
continuwuation:nex/fix/invalid-appservice-reg
continuwuation:nex/feat/antispam
continuwuation:nex/feat/account-locking
continuwuation:jade/logging-cleanup
continuwuation:jade/remove-legacy-appservice-auth
continuwuation:nex/fix/key-query
continuwuation:jade/update-prek
continuwuation:nex/fix/room-summaries
continuwuation:ginger/restrict-admin-commands
continuwuation:ginger/enable-console-by-default
continuwuation:jade/tag-fixes
continuwuation:jade/otlp
continuwuation:nex/meta/pull-req-template
continuwuation:nex/fix/fed-invite-compliance
continuwuation:nex/feat/build-commit
continuwuation:nex/feat/join-logging
continuwuation:jade/mailmap-updates
continuwuation:jade/hack-ci-tmp
continuwuation:jade/v12-stable
continuwuation:jade/relations
continuwuation:renovate/axum-monorepo
continuwuation:ginger/database-refactor
continuwuation:jade/fix-ldap-uiaa
continuwuation:nex/fix/validation
continuwuation:ginger/nuke-invalid-msc4133-fields-in-migration
continuwuation:ginger/downgrade-artifact-actions
continuwuation:oddlid/reload-fix
continuwuation:jade/fix-assert
continuwuation:ginger/sync-v3-cleanup
continuwuation:renovate/ruma-digest
continuwuation:ginger/remove-absolute-action-urls
continuwuation:renovate/https-code.forgejo.org-actions-checkout-6.x
continuwuation:renovate/actions-checkout-6.x
continuwuation:jade/website
continuwuation:renovate/https-code.forgejo.org-actions-checkout-digest
continuwuation:nex/fix/backoff
continuwuation:renovate/bytes-1.x-lockfile
continuwuation:ginger/fix-mdbook-for-0.5
continuwuation:ginger/no-docker-on-prs
continuwuation:backport/v0.5.0-rc.8-1
continuwuation:renovate/hyper-1.x-lockfile
continuwuation:nex/fed-improvements
continuwuation:dahsa_uwu/axum-0.8
continuwuation:jade/rust-1.90
continuwuation:jade/mirror-dockerhub
continuwuation:jade/clippy-fixes
continuwuation:jade/fix-support
continuwuation:jade/clean-images
continuwuation:jade/wal-compression-type
continuwuation:jade/flake-clone
continuwuation:ginger/upload-rpms-on-schedule
continuwuation:nex/fix/incoming-fetch
continuwuation:nex/fix/upgrade
continuwuation:tom/ci-fedora-rpm
continuwuation:jade/ci-release-fix
continuwuation:jade/rocksdb-10-5
continuwuation:ginger/fix-msc4133-migration
continuwuation:ginger/migrate-busted-tz
continuwuation:hydra/public
continuwuation:nex/feat/manual-extremities
continuwuation:nex/feat/async-media
continuwuation:nex/feat/fast-joins-hack-do-not-use-DO-NOT-USE
continuwuation:nex/feat/better-logging
continuwuation:trigger-ci-so-latest-isnt-on-illegal-car-mods
continuwuation:nex/feat/pins-backfill
continuwuation:jade/tuwunel-2025-06-old
continuwuation:jade/ai-slop-db-docs
continuwuation:nex/fix-create-auth
continuwuation:jade/version-stats
continuwuation:jade/read-receipts
continuwuation:jade/rust-toolchain-no-targets
continuwuation:jade/logging-features
continuwuation:jade/syncv5-typing
continuwuation:jade/msc2815
continuwuation:jade/purge-sync-tokens
continuwuation:morguldir/see-eye
continuwuation:jade/css-small-screen
continuwuation:nex/wip-751
continuwuation:tuwunel-rebase
continuwuation:test
continuwuation:oddlid/rename-admin-room-bot
continuwuation:strawberry/nix-ci-stuff
continuwuation:strawberry/valgrind
continuwuation:phonemain
continuwuation:strawberry/morgs-snake-sync-jason-main
continuwuation:newer-media-endpoints
continuwuation:folly-coroutines-async-io
continuwuation:federation-retry-timer-port
continuwuation:bad-attempt-at-extracting-homeserver-signing-key
continuwuation:room-deletion-attempt-do-not-use
No reviewers
Labels
Clear labels
This pull request or issue is currently blocked from being merged/closed
Something isn't working as intended
Commits picked from other conduit projects
This requires or includes changes to the database
Something dependency related
Automatic dependency upgrades by Renovate
Low difficulty to implement - touches few parts of the codebase, low complexity
High difficulty to implement - touches many parts of the codebase, high complexity
Medium difficulty to implement - touches more parts of the codebase, higher complexity
Improvements or additions to documentation
New feature or request
Good for newcomers
Additional eyes and keyboards are required for this one
Issues that have been inhereted from the project pre-fork
Features pertaining to homeserver administration
Features pertaining to the appservice API
Features pertaining to authentication
Features pertaining to client-to-server interactions
Issues relating to core matrix functionality, such as state resolution and PDU formats
Features pertaining to server-to-server interactions
Issues related to room version 12 and related changes (temporary label)
Features pertaining to unstable matrix features
Features pertaining to media interactions
Related to housekeeping, maintenance, or other repo-meta.
Issues related to CI changes
Packaging
This issue is blocking the next release
This issue is very important
This issue is of a rather low priority
This item is related to general security
This issue has enough information and is confirmed
This issue or pull request already exists
This issue doesn't seem right
This issue needs further investigation
Questions or support requests
This will not be worked on
Ci/CD
Pull requests that update Rust code
Blocked
This pull request or issue is currently blocked from being merged/closed
Bug
Something isn't working as intended
Cherry-picking
Commits picked from other conduit projects
Database
This requires or includes changes to the database
Dependencies
Something dependency related
Dependencies/Renovate
Automatic dependency upgrades by Renovate
Difficulty
Easy
Low difficulty to implement - touches few parts of the codebase, low complexity
Difficulty
Hard
High difficulty to implement - touches many parts of the codebase, high complexity
Difficulty
Medium
Medium difficulty to implement - touches more parts of the codebase, higher complexity
Documentation
Improvements or additions to documentation
Enhancement
New feature or request
Good first issue
Good for newcomers
Help wanted
Additional eyes and keyboards are required for this one
Inherited
Issues that have been inhereted from the project pre-fork
Matrix/Administration
Features pertaining to homeserver administration
Matrix/Appservices
Features pertaining to the appservice API
Matrix/Auth
Features pertaining to authentication
Matrix/Client
Features pertaining to client-to-server interactions
Matrix/Core
Issues relating to core matrix functionality, such as state resolution and PDU formats
Matrix/Federation
Features pertaining to server-to-server interactions
Matrix/Hydra
Issues related to room version 12 and related changes (temporary label)
Matrix/MSC
Features pertaining to unstable matrix features
Matrix/Media
Features pertaining to media interactions
Meta
Related to housekeeping, maintenance, or other repo-meta.
Meta/CI
Issues related to CI changes
Meta/Packaging
Packaging
Priority
Blocking
This issue is blocking the next release
Priority
High
This issue is very important
Priority
Low
This issue is of a rather low priority
Security
This item is related to general security
Status
Confirmed
This issue has enough information and is confirmed
Status
Duplicate
This issue or pull request already exists
Status
Invalid
This issue doesn't seem right
Status
Needs Investigation
This issue needs further investigation
Support
Questions or support requests
To-Merge
Wont fix
This will not be worked on
old/ci/cd
Ci/CD
Archived
old/rust
Pull requests that update Rust code
Archived
No labels
Blocked
Bug
Cherry-picking
Database
Dependencies
Dependencies/Renovate
Difficulty
Easy
Difficulty
Hard
Difficulty
Medium
Documentation
Enhancement
Good first issue
Help wanted
Inherited
Matrix/Administration
Matrix/Appservices
Matrix/Auth
Matrix/Client
Matrix/Core
Matrix/Federation
Matrix/Hydra
Matrix/MSC
Matrix/Media
Meta
Meta/CI
Meta/Packaging
Priority
Blocking
Priority
High
Priority
Low
Security
Status
Confirmed
Status
Duplicate
Status
Invalid
Status
Needs Investigation
Support
To-Merge
Wont fix
old/ci/cd
old/rust
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
5 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set.
Reference
continuwuation/continuwuity!971
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "Anagastes/continuwuity:main"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Added NGINX example with Unix sockets. Helpful for newbies. I've struggled with this a lot, so here's to everyone now. :)
@Anagastes Are you planning to iterate on this further? If not we can review and propose merge once the WIP status is removed :)
WIP: docs/deploying/generic.md changedto WIP: Improve NGINX reverse proxy setup instructionsAh, I see. Yes, the process wasn't entirely clear yet :D
I'll do one last check and then remove the WIP.@nex wrote in #971 (comment):
No worries! I'm currently working on improving the issue/PR flows so they'll be clearer in future ^.^
WIP: Improve NGINX reverse proxy setup instructionsto Improve NGINX reverse proxy setup instructions7bbea1a88f11a61d214e11a61d214e4169f69e6b4169f69e6bfa638c7951fa638c7951e3f9fe2f34d3fbbade64869c044059869c044059333c029f84Going to merge this now, if you were going to add LK docs (looking at the reverted commit a few weeks ago) probably worth opening a followup PR
noticed a couple things on a final-pass look over
@ -168,0 +172,4 @@Please note that your NGINX must have access to the socket.In most cases, this is the **www-data** group. For consistency reasons, we change the systemd service.Something like this perhaps? nitpicking if anything
or just 'For the best security and performance, you can use Unix sockets with NGINX. Alternatively, you can use normal TCP proxying'
@ -168,0 +203,4 @@# Synapse-Server responses may be chunked, which is an HTTP/1.1 feature.proxy_http_version 1.1;}```The default value is 20M, perhaps the nginx config should reflect that?
Also we're not synapse, so the comment is off
yeah, my vault... im sorry. its because of my migration from synapse... :S
@ -174,0 +216,4 @@- `proxy_pass http://127.0.0.1:6167$request_uri;`- `proxy_pass http://127.0.0.1:6167;`Maybe you will check your conf bevor.bevor -> before?
Actually maybe this should just be rephrased to
Make sure that your IP and port match that on which continuwuity is listening. Check your configuration if you aren't sure.Sorry... I type quickly... I'm German and sometimes... I'm sorry. I think I should work on my quality in this area...
@ -168,0 +176,4 @@```User=conduwuitGroup=www-data```General clarity here.
Also, I'm not convinced making nginx and continuwuity share a group is a good idea, since the database is also group-readable, and this inherently increases the attack surface since now nginx will have the ability to completely read the database of continuwuity. Perhaps using something like
ExecStartPost=to change the permissions of the socket itself to be more permissive (world writable? unsure what the implications on that are) is the more secure option that seems in-scope.World-writable would have effectively the same security profile as network sockets AFAIK. I'm sure there's a better permissions-based solution
@ -174,0 +198,4 @@}location ~ ^(/|/_matrix|/_conduwuit) {Haven't used nginx in a hot minute, but shouldn't this be inside the server block?
@nex sorry, holidays.
And it should be located within the server block, yes.
But that's just one example. A whole block looks like this.
Would you like to publish an entire finished block? Or small snippets for system administrators who know what they are doing? ;)
333c029f842736b504b9@Anagastes wrote in #971 (comment):
I think including a full block somewhere (maybe towards the end) would be handy, but I'm not too bothered - just wanted to make sure it wasn't a mistake :)
Don't worry about the delay, there's no rush!
2736b504b9344eb1450f344eb1450f9e79293e3c9e79293e3c492f583e32View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.