This commit is contained in:
DMRobertson committed 2022-01-17 15:13:40 +00:00
1 parent 62381195e7
commit 5227d9948d
4 files changed
+34 -2

No files matched your search

+16
View File
@@ -1283,11 +1283,22 @@ cert=/path/to/fullchain.pem
# TLS private key file
pkey=/path/to/privkey.pem
# Ensure the configuration lines that disable TLS/DTLS are commented-out or removed
#no-tls
#no-dtls
</code></pre>
<p>In this case, replace the <code>turn:</code> schemes in the <code>turn_uris</code> settings below
with <code>turns:</code>.</p>
<p>We recommend that you only try to set up TLS/DTLS once you have set up a
basic installation and got it working.</p>
<p>NB: If your TLS certificate was provided by Let's Encrypt, TLS/DTLS will
not work with any Matrix client that uses Chromium's WebRTC library. This
currently includes Element Android &amp; iOS; for more details, see their
<a href="https://github.com/vector-im/element-android/issues/1533">respective</a>
<a href="https://github.com/vector-im/element-ios/issues/2712">issues</a> as well as the underlying
<a href="https://bugs.chromium.org/p/webrtc/issues/detail?id=11710">WebRTC issue</a>.
Consider using a ZeroSSL certificate for your TURN server as a working alternative.</p>
</li>
<li>
<p>Ensure your firewall allows traffic into the TURN server on the ports
@@ -1389,6 +1400,11 @@ TURN ports (normally 3478 and 5349).</p>
relay ports (49152-65535 by default).</p>
</li>
<li>
<p>Try disabling <code>coturn</code>'s TLS/DTLS listeners and enable only its (unencrypted)
TCP/UDP listeners. (This will only leave signaling traffic unencrypted;
voice &amp; video WebRTC traffic is always encrypted.)</p>
</li>
<li>
<p>Some WebRTC implementations (notably, that of Google Chrome) appear to get
confused by TURN servers which are reachable over IPv6 (this appears to be
an unexpected side-effect of its handling of multiple IP addresses as
+1 -1
View File
@@ -1 +1 @@
Object.assign(window.search, {"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#donating-to-synapse-development","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","postgres.html#fixing-inconsistent-sequences-error","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v1","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#coturn-setup","turn-howto.html#initial-installation","turn-howto.html#configuration","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-to-v1500","upgrade.html#dropping-support-for-old-python-and-postgres-versions","upgrade.html#upgrading-to-v1470","upgrade.html#removal-of-old-room-admin-api","upgrade.html#deprecation-of-the-user_may_create_room_with_invites-module-callback","upgrade.html#upgrading-to-v1450","upgrade.html#changes-required-to-media-storage-provider-modules-when-reading-from-the-synapse-configuration-object","upgrade.html#upgrading-to-v1440","upgrade.html#the-url-preview-cache-is-no-longer-mirrored-to-storage-providers","upgrade.html#upgrading-to-v1430","upgrade.html#the-spaces-summary-apis-can-now-be-handled-by-workers","upgrade.html#upgrading-to-v1420","upgrade.html#removal-of-old-room-admin-api","upgrade.html#user-interactive-authentication-fallback-templates-can-now-display-errors","upgrade.html#removal-of-out-of-date-email-pushers","upgrade.html#upgrading-to-v1410","upgrade.html#add-support-for-routing-outbound-http-requests-via-a-proxy-for-federation","upgrade.html#deprecation-of-template_dir","upgrade.html#_synapseadminv1usersuseridmedia-must-be-handled-by-media-workers","upgrade.html#upgrading-to-v1390","upgrade.html#deprecation-of-the-current-third-party-rules-module-interface","upgrade.html#upgrading-to-v1380","upgrade.html#re-indexing-of-events-table-on-postgres-databases","upgrade.html#upgrading-to-v1370","upgrade.html#deprecation-of-the-current-spam-checker-interface","upgrade.html#upgrading-to-v1340","upgrade.html#room_invite_state_types-configuration-setting","upgrade.html#upgrading-to-v1330","upgrade.html#account-validity-html-templates-can-now-display-a-users-expiration-date","upgrade.html#upgrading-to-v1320","upgrade.html#regression-causing-connected-prometheus-instances-to-become-overwhelmed","upgrade.html#dropping-support-for-old-python-postgres-and-sqlite-versions","upgrade.html#removal-of-old-list-accounts-admin-api","upgrade.html#application-services-must-use-type-mloginapplication_service-when-registering-users","upgrade.html#upgrading-to-v1290","upgrade.html#requirement-for-x-forwarded-proto-header","upgrade.html#upgrading-to-v1270","upgrade.html#changes-to-callback-uri-for-oauth2--openid-connect-and-saml2","upgrade.html#changes-to-html-templates","upgrade.html#upgrading-to-v1260","upgrade.html#rolling-back-tLine truncated
Object.assign(window.search, {"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#donating-to-synapse-development","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","postgres.html#fixing-inconsistent-sequences-error","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v1","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#coturn-setup","turn-howto.html#initial-installation","turn-howto.html#configuration","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-to-v1500","upgrade.html#dropping-support-for-old-python-and-postgres-versions","upgrade.html#upgrading-to-v1470","upgrade.html#removal-of-old-room-admin-api","upgrade.html#deprecation-of-the-user_may_create_room_with_invites-module-callback","upgrade.html#upgrading-to-v1450","upgrade.html#changes-required-to-media-storage-provider-modules-when-reading-from-the-synapse-configuration-object","upgrade.html#upgrading-to-v1440","upgrade.html#the-url-preview-cache-is-no-longer-mirrored-to-storage-providers","upgrade.html#upgrading-to-v1430","upgrade.html#the-spaces-summary-apis-can-now-be-handled-by-workers","upgrade.html#upgrading-to-v1420","upgrade.html#removal-of-old-room-admin-api","upgrade.html#user-interactive-authentication-fallback-templates-can-now-display-errors","upgrade.html#removal-of-out-of-date-email-pushers","upgrade.html#upgrading-to-v1410","upgrade.html#add-support-for-routing-outbound-http-requests-via-a-proxy-for-federation","upgrade.html#deprecation-of-template_dir","upgrade.html#_synapseadminv1usersuseridmedia-must-be-handled-by-media-workers","upgrade.html#upgrading-to-v1390","upgrade.html#deprecation-of-the-current-third-party-rules-module-interface","upgrade.html#upgrading-to-v1380","upgrade.html#re-indexing-of-events-table-on-postgres-databases","upgrade.html#upgrading-to-v1370","upgrade.html#deprecation-of-the-current-spam-checker-interface","upgrade.html#upgrading-to-v1340","upgrade.html#room_invite_state_types-configuration-setting","upgrade.html#upgrading-to-v1330","upgrade.html#account-validity-html-templates-can-now-display-a-users-expiration-date","upgrade.html#upgrading-to-v1320","upgrade.html#regression-causing-connected-prometheus-instances-to-become-overwhelmed","upgrade.html#dropping-support-for-old-python-postgres-and-sqlite-versions","upgrade.html#removal-of-old-list-accounts-admin-api","upgrade.html#application-services-must-use-type-mloginapplication_service-when-registering-users","upgrade.html#upgrading-to-v1290","upgrade.html#requirement-for-x-forwarded-proto-header","upgrade.html#upgrading-to-v1270","upgrade.html#changes-to-callback-uri-for-oauth2--openid-connect-and-saml2","upgrade.html#changes-to-html-templates","upgrade.html#upgrading-to-v1260","upgrade.html#rolling-back-tLine truncated
+1 -1
View File
@@ -1 +1 @@
{"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#donating-to-synapse-development","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","postgres.html#fixing-inconsistent-sequences-error","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v1","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#coturn-setup","turn-howto.html#initial-installation","turn-howto.html#configuration","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-to-v1500","upgrade.html#dropping-support-for-old-python-and-postgres-versions","upgrade.html#upgrading-to-v1470","upgrade.html#removal-of-old-room-admin-api","upgrade.html#deprecation-of-the-user_may_create_room_with_invites-module-callback","upgrade.html#upgrading-to-v1450","upgrade.html#changes-required-to-media-storage-provider-modules-when-reading-from-the-synapse-configuration-object","upgrade.html#upgrading-to-v1440","upgrade.html#the-url-preview-cache-is-no-longer-mirrored-to-storage-providers","upgrade.html#upgrading-to-v1430","upgrade.html#the-spaces-summary-apis-can-now-be-handled-by-workers","upgrade.html#upgrading-to-v1420","upgrade.html#removal-of-old-room-admin-api","upgrade.html#user-interactive-authentication-fallback-templates-can-now-display-errors","upgrade.html#removal-of-out-of-date-email-pushers","upgrade.html#upgrading-to-v1410","upgrade.html#add-support-for-routing-outbound-http-requests-via-a-proxy-for-federation","upgrade.html#deprecation-of-template_dir","upgrade.html#_synapseadminv1usersuseridmedia-must-be-handled-by-media-workers","upgrade.html#upgrading-to-v1390","upgrade.html#deprecation-of-the-current-third-party-rules-module-interface","upgrade.html#upgrading-to-v1380","upgrade.html#re-indexing-of-events-table-on-postgres-databases","upgrade.html#upgrading-to-v1370","upgrade.html#deprecation-of-the-current-spam-checker-interface","upgrade.html#upgrading-to-v1340","upgrade.html#room_invite_state_types-configuration-setting","upgrade.html#upgrading-to-v1330","upgrade.html#account-validity-html-templates-can-now-display-a-users-expiration-date","upgrade.html#upgrading-to-v1320","upgrade.html#regression-causing-connected-prometheus-instances-to-become-overwhelmed","upgrade.html#dropping-support-for-old-python-postgres-and-sqlite-versions","upgrade.html#removal-of-old-list-accounts-admin-api","upgrade.html#application-services-must-use-type-mloginapplication_service-when-registering-users","upgrade.html#upgrading-to-v1290","upgrade.html#requirement-for-x-forwarded-proto-header","upgrade.html#upgrading-to-v1270","upgrade.html#changes-to-callback-uri-for-oauth2--openid-connect-and-saml2","upgrade.html#changes-to-html-templates","upgrade.html#upgrading-to-v1260","upgrade.html#rolling-back-to-v1250-after-a-failed-upgradLine truncated
{"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#donating-to-synapse-development","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","postgres.html#fixing-inconsistent-sequences-error","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v1","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#coturn-setup","turn-howto.html#initial-installation","turn-howto.html#configuration","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-to-v1500","upgrade.html#dropping-support-for-old-python-and-postgres-versions","upgrade.html#upgrading-to-v1470","upgrade.html#removal-of-old-room-admin-api","upgrade.html#deprecation-of-the-user_may_create_room_with_invites-module-callback","upgrade.html#upgrading-to-v1450","upgrade.html#changes-required-to-media-storage-provider-modules-when-reading-from-the-synapse-configuration-object","upgrade.html#upgrading-to-v1440","upgrade.html#the-url-preview-cache-is-no-longer-mirrored-to-storage-providers","upgrade.html#upgrading-to-v1430","upgrade.html#the-spaces-summary-apis-can-now-be-handled-by-workers","upgrade.html#upgrading-to-v1420","upgrade.html#removal-of-old-room-admin-api","upgrade.html#user-interactive-authentication-fallback-templates-can-now-display-errors","upgrade.html#removal-of-out-of-date-email-pushers","upgrade.html#upgrading-to-v1410","upgrade.html#add-support-for-routing-outbound-http-requests-via-a-proxy-for-federation","upgrade.html#deprecation-of-template_dir","upgrade.html#_synapseadminv1usersuseridmedia-must-be-handled-by-media-workers","upgrade.html#upgrading-to-v1390","upgrade.html#deprecation-of-the-current-third-party-rules-module-interface","upgrade.html#upgrading-to-v1380","upgrade.html#re-indexing-of-events-table-on-postgres-databases","upgrade.html#upgrading-to-v1370","upgrade.html#deprecation-of-the-current-spam-checker-interface","upgrade.html#upgrading-to-v1340","upgrade.html#room_invite_state_types-configuration-setting","upgrade.html#upgrading-to-v1330","upgrade.html#account-validity-html-templates-can-now-display-a-users-expiration-date","upgrade.html#upgrading-to-v1320","upgrade.html#regression-causing-connected-prometheus-instances-to-become-overwhelmed","upgrade.html#dropping-support-for-old-python-postgres-and-sqlite-versions","upgrade.html#removal-of-old-list-accounts-admin-api","upgrade.html#application-services-must-use-type-mloginapplication_service-when-registering-users","upgrade.html#upgrading-to-v1290","upgrade.html#requirement-for-x-forwarded-proto-header","upgrade.html#upgrading-to-v1270","upgrade.html#changes-to-callback-uri-for-oauth2--openid-connect-and-saml2","upgrade.html#changes-to-html-templates","upgrade.html#upgrading-to-v1260","upgrade.html#rolling-back-to-v1250-after-a-failed-upgradLine truncated
+16
View File
@@ -296,11 +296,22 @@ cert=/path/to/fullchain.pem
# TLS private key file
pkey=/path/to/privkey.pem
# Ensure the configuration lines that disable TLS/DTLS are commented-out or removed
#no-tls
#no-dtls
</code></pre>
<p>In this case, replace the <code>turn:</code> schemes in the <code>turn_uris</code> settings below
with <code>turns:</code>.</p>
<p>We recommend that you only try to set up TLS/DTLS once you have set up a
basic installation and got it working.</p>
<p>NB: If your TLS certificate was provided by Let's Encrypt, TLS/DTLS will
not work with any Matrix client that uses Chromium's WebRTC library. This
currently includes Element Android &amp; iOS; for more details, see their
<a href="https://github.com/vector-im/element-android/issues/1533">respective</a>
<a href="https://github.com/vector-im/element-ios/issues/2712">issues</a> as well as the underlying
<a href="https://bugs.chromium.org/p/webrtc/issues/detail?id=11710">WebRTC issue</a>.
Consider using a ZeroSSL certificate for your TURN server as a working alternative.</p>
</li>
<li>
<p>Ensure your firewall allows traffic into the TURN server on the ports
@@ -402,6 +413,11 @@ TURN ports (normally 3478 and 5349).</p>
relay ports (49152-65535 by default).</p>
</li>
<li>
<p>Try disabling <code>coturn</code>'s TLS/DTLS listeners and enable only its (unencrypted)
TCP/UDP listeners. (This will only leave signaling traffic unencrypted;
voice &amp; video WebRTC traffic is always encrypted.)</p>
</li>
<li>
<p>Some WebRTC implementations (notably, that of Google Chrome) appear to get
confused by TURN servers which are reachable over IPv6 (this appears to be
an unexpected side-effect of its handling of multiple IP addresses as