envsdotnet-matrix-conf/etc/nginx/sites-available/matrix.envs.net.conf

server {
	listen 80 default_server;
	#listen [::]:80;
	server_name matrix.envs.net;

	location / {
		return 307 https://$host$request_uri;
	}

	location /.well-known/acme-challenge/ {
		alias /var/lib/letsencrypt/.well-known/acme-challenge/;
	}
}
server {
	listen 80;
	#listen [::]:80;
	server_name turn.envs.net;

	location / {
		return 307 https://matrix.envs.net$request_uri;
	}

	location /.well-known/acme-challenge/ {
		alias /var/lib/letsencrypt/.well-known/acme-challenge/;
	}
}


map $http_origin $DO_CORS {
	# indicates all map values are hostnames and should be parsed as such
	hostnames;
	# default value
	default 'true';
	# blocked domains
	renaissance.eu.org 'false';
	element.renaissance.eu.org 'false';
}


upstream generic_worker_rr {
       server localhost:8510;
       server localhost:8511;
       server localhost:8512;
}
upstream generic_worker_ih {
       ip_hash;
       server localhost:8510;
       server localhost:8511;
       server localhost:8512;
}
upstream generic_worker_lc {
       least_conn;
       server localhost:8510;
       server localhost:8511;
       server localhost:8512;
}


server {
	listen 443 ssl http2 default_server;
	#listen [::]:443 ssl;
	server_name matrix.envs.net;

	include snippets/ssl.conf;

	## well-known
	location /.well-known/matrix/support {
		add_header Access-Control-Allow-Origin "$DO_CORS";
		add_header Content-Type application/json;
		return 200 '{"admins": [{"matrix_id": "@creme:envs.net", "email_address": "hostmaster@envs.net", "role": "admin"}]}';
	}

	location /.well-known/matrix/ {
		add_header Access-Control-Allow-Origin "$DO_CORS";
		add_header Content-Type application/json;
		return 200 '{"m.server": "matrix.envs.net:443", "m.homeserver": {"base_url": "https://matrix.envs.net"}, "m.integrations": {"managers": [{"ui_url": "https://dimension.envs.net/riot", "api_url": "https://dimension.envs.net/api/v1/scalar"}, {"ui_url": "https://scalar.vector.im/", "api_url": "https://scalar.vector.im/api"}]}, "m.integrations_widget": {"url": "https://dimension.envs.net/riot", "data": {"api_url": "https://dimension.envs.net/api/v1/scalar"}}}';
	}

	## workers
	include include.d/generic_worker.conf;

	##
	location ~* ^(\/_matrix|\/_synapse\/client) {
		proxy_pass http://localhost:8008;
		include include.d/synapse-proxy.conf;
	}
	# /synapse/admin
	include include.d/synapse_admin.conf;

	## media-repo
	location ^~ /_matrix/media {
		proxy_pass http://localhost:8000;

		client_max_body_size 100M;

		proxy_set_header Host envs.net;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_read_timeout 3600;
	}

	## appservice-irc
	location ^~ /_matrix/provision {
		allow 127.0.0.1;
		deny all;
		proxy_pass http://localhost:9999/_matrix/provision;
		include include.d/synapse-proxy.conf;
	}

	## MAUBOT
	location ^~ /_matrix/maubot {
		proxy_pass http://localhost:29316/_matrix/maubot;
		include include.d/synapse-proxy.conf;
	}
	# log
	location ^~ /_matrix/maubot/v1/logs {
		proxy_pass http://localhost:29316/_matrix/maubot/v1/logs;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "Upgrade";
		include include.d/synapse-proxy.conf;
	}

	##
	location / {
		proxy_pass http://localhost:8008;
		include include.d/synapse-proxy.conf;
	}
}

server {
        listen 8448 ssl http2;
        server_name matrix.envs.net;

        include snippets/ssl.conf;

        location / {
                proxy_pass http://localhost:8008;
		include include.d/synapse-proxy.conf;
        }
}