Matrix.org: private Instant Messaging

.well-known delegation which consists putting a file names .well-known in your website root-folder with following content

{
    "m.server": "your_matrix_server_name:443"
}

Unfortunately, this method doesn’t work if you create a Reverse-Proxy rule for your Matrix server via the Synology Application Portal GUI. The solution is to configure the rule manually via a customized NGINX file.

1. Export the SSL certificate created earlier: in Control panel / Security / Certificate tab, select your certificate, click on Export and save in a folder we are calling path_to_your_SSL_certificate.

2. Unzip the content in the same folder. You should have 3 files:

• • cert.pem
  • chain.pem
  • privkey.pem

3. delete the Reverse Proxy rule you have defined at Step 5
4. open a terminal, ssh to your Synology and get root privilege with “sudo su -“

cd /usr/local/etc/nginx/sites-enabled

5. create a file named with your matrix server name “your_matrix_server_name” and copy following contents replacing the highlighted information with yours

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name your_matrix_server_name;

    ssl_certificate /path_to_your_SSL_certificate/fullchain.pem;
    ssl_certificate_key /path_to_SSL_domain_certificate/privkey.pem;

    location ~* ^(\/_matrix|\/_synapse|\/_synapse\/admin|\/client) {
	proxy_connect_timeout 60;
        proxy_read_timeout 60;
        proxy_send_timeout 60;
        proxy_intercept_errors off;
        proxy_http_version 1.1;
        proxy_set_header        Host            $http_host;
        proxy_set_header        X-Real-IP            $remote_addr;
        proxy_set_header        X-Forwarded-For            $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto            $scheme;
        proxy_pass http://localhost:18008;
    }

    location /.well-known/matrix/server {
    	default_type application/json;
    	return 200 '{ "m.server": "your_matrix_server_name:443" }';
        add_header Content-Type application/json;
        add_header Access-Control-Allow-Origin *;
    }

    error_page 403 404 500 502 503 504 @error_page;
    location @error_page {
        root /usr/syno/share/nginx;
        rewrite (.*) /error.html break;
        allow all;
    }
}

6. test the configuration:

nginx -T > /tmp/nginx.conf

7. if no error is returned, apply the configuration

nginx -s reload

Note 1: The above manually created Reverse Proxy rule doesn’t appear in the Synology Application Portal GUI

Note 2: as per Let’s Encrypt rule, the Synology automatically renews the SSL Certificate every 90 days. Make sure to export the new keys to your path_to_your_SSL_certificate folder

The second method, SRV DNS Record delegation, uses the so called DNS resources identifying how to reach a specific resource. So using DDNS service, add in the DNS record SRV entry with following parameters:

• Prefix: _matrix._tcp
• Service: SRV
• Port: 443
• Target: your_matrix_server_name