Beacon Node Docker

This Docker image will run Synapse as a single process and is a fork of the matrixdotorg/synapse docker image.

The big difference this image has is that it include pysodium and an auth provider that is compatible with cryptographic signatures: crypto_auth_provider.py

By default it uses a postgres database; and is hence suited for production use.

The image also does not provide a TURN server.

Volumes

By default, the image expects a single volume, located at /data, that will hold:

• keys;
• temporary data;

Dependencies

We require a postgres database connection. The environment variable SERVER_NAME controls how your matrix node will be called and reached, this needs to be a fqdn which will be forwarding requests on port 8080 and 8448 to this container.

Service Ports

Port 8008 is required for the actual matrix service and will be your endpoint.

Note: in order for federation to work you will need:

1. SSL/TLS enabled for your domain
2. have that SSL/TLS setup for port 8448 and 443
3. forward SSL/TLS traffic from 8448 to 8008 of this container
4. forward SSL/TLS traffic from 443 to 8008 of this container

Running beacon-node using docker

You can start beacon-node as follows (currently we support only postgres setups and expect that the domain given in "SERVER_NAME" is also where this container will be reachable on port 8080 for the letsencrypt request):

docker run -d --name beacon-node \
--mount type=volume,src=synapse-data,dst=/data \
-p 8080:8080 \
-p 8008:8008 \
-e SERVER_NAME=matrix.example.com \
-e DB_HOST=postgres \
-e DB_USER=synapse \
-e DB_NAME=synapse \
-e DB_PASS=password \
airgapdocker/beacon-node:latest

Running beacon-node using docker-compose

You can start beacon-node as follows (currently we support only postgres setups and expect that the domain given in "SERVER_NAME" is also where this container will be reachable):

git clone
cd beacon-node/samples
vim docker-compose.yml # edit according to your likings: SERVER_NAME must be changed!
docker-compose up -d

Sample Nginx configuration

This is a sample configuration of nginx that will route all the traffic to the correct port. The certificates were added by Certbot and provided by letsencrypt.

upstream matrix_workers {server localhost:8083;server localhost:8084;server localhost:8085;server localhost:8086;}server{listen8448ssl;listen [::]:8448ssl;server_name MY_SERVER_DOMAIN;location~* ^(\/_matrix\/client\/(v2_alpha|r0)\/sync) {proxy_set_header Host $host;proxy_set_header X-Forwarded-For $remote_addr;proxy_set_header X-Forwarded-Proto $scheme;proxy_passhttp://matrix_workers;client_max_body_size50M;}location~* ^(\/_matrix\/client\/(api/v1|r0|unstable)\/rooms\/.*\/(join|invite|leave|ban|unban|kick)) {proxy_set_header Host $host;proxy_set_header X-Forwarded-For $remote_addr;proxy_set_header X-Forwarded-Proto $scheme;proxy_passhttp://matrix_workers;client_max_body_size50M;}location~* ^(\/_matrix\/client\/(api/v1|r0|unstable)\/login) {proxy_set_header Host $host;proxy_set_header X-Forwarded-For $remote_addr;proxy_set_header X-Forwarded-Proto $scheme;proxy_passhttp://matrix_workers;client_max_body_size50M;}location / {proxy_set_header X-Forwarded-For $remote_addr;proxy_set_header Host $http_host;proxy_passhttp://localhost:8008;}listen [::]:443ssl ipv6only=on; # managed by Certbot
listen443ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/MY_SERVER_DOMAIN/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/MY_SERVER_DOMAIN/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

Running beacon-node using kubernetes

See the k8s folder in this project for a production ready k8s setup.

Running beacon-node directly

Our requirements to any beacon-node installation are minimal. Check docker/homeserver.yaml for the configuration and make sure to place docker/crypto_auth_provider.py to a place where it can be picked up by beacon-node (the Dockerfile is quite straight forward and the best documentation).