updated to allow voice chat

group_vars/all.yml

@@ -22,4 +22,10 @@ landing_domain: "example.com"  # optional, or use same domain + path-based routi
 certbot_email: "admin@example.com"
 
 # Static site path
-nginx_webroot: "/var/lib/matrix-nginx"
+nginx_webroot: "/var/lib/matrix-nginx"
+
+coturn_shared_secret: "{{ 'your-secret-key' | password_hash('sha512', 'salt') }}"
+# Or generate randomly:
+# coturn_shared_secret: "{{ 24 | random_string | password_hash('sha512') }}"
+coturn_username: "matrix-turn"
+coturn_password: "{{ vault_coturn_password }}"

references/synapse-config/homeserver.yaml

@@ -0,0 +1,40 @@
+# Configuration file for Synapse.
+#
+# This is a YAML file: see [1] for a quick introduction. Note in particular
+# that *indentation is important*: all the elements of a list or dictionary
+# should have the same indentation.
+#
+# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
+#
+# For more information on how to configure Synapse, including a complete accounting of
+# each option, go to docs/usage/configuration/config_documentation.md or
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
+server_name: "my.matrix.host"
+pid_file: /data/homeserver.pid
+listeners:
+  - port: 8008
+    resources:
+    - compress: false
+      names:
+      - client
+      - federation
+    tls: false
+    type: http
+    x_forwarded: true
+database:
+  name: sqlite3
+  args:
+    database: /data/homeserver.db
+log_config: "/data/my.matrix.host.log.config"
+media_store_path: /data/media_store
+registration_shared_secret: "uC7Pv@:r=@Slvhx7Ex*An8QHXWnPRyI9+COZr_&;Kh*,~lGpql"
+report_stats: true
+macaroon_secret_key: "+QUdDhvNc9*@MORp9K-TjuGp1j5Ff-mUBS+pjkmAFWR0Y3#da8"
+form_secret: "meZSlI7K.EI-6hmXcjzCNf2IwrThcnoVr2X0iohOV7K5a_w^Ud"
+signing_key_path: "/data/my.matrix.host.signing.key"
+trusted_key_servers:
+  - server_name: "matrix.org"
+
+
+# vim:ft=yaml
+

references/synapse-config/my.matrix.host.log.config

@@ -0,0 +1,39 @@
+version: 1
+
+formatters:
+  precise:
+    
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+    
+
+handlers:
+
+
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+loggers:
+    # This is just here so we can leave `loggers` in the config regardless of whether
+    # we configure other loggers below (avoid empty yaml dict error).
+    _placeholder:
+        level: "INFO"
+
+    
+    
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+    
+
+    
+
+root:
+    level: INFO
+
+
+    handlers: [console]
+
+
+disable_existing_loggers: false

roles/common/tasks/main.yml

@@ -21,3 +21,10 @@
   loop:
     - "{{ synapse_data_dir }}"
     - "{{ nginx_webroot }}"
+
+# roles/matrix-synapse/tasks/main.yml
+- name: Restart Synapse to reload TURN config
+  container:
+    name: synapse
+    state: started
+    restart: yes

roles/matrix-synapse/tasks/main.yml

@@ -67,3 +67,28 @@
       - "{{ synapse_data_dir }}:/data"
     command: >
       -c /data/homeserver.yaml
+#----- Coturn + Synapse 
+- name: Run Coturn container (STUN/TURN server)
+  container:
+    name: coturn
+    image: coturn/coturn:latest
+    state: started
+    restart_policy: unless-stopped
+    pod: "{{ podman_pod_name }}"
+    env:
+      LISTENING_PORT: "3478"
+      ALTERNATE_LISTENING_PORT: "5349"
+      RELAY_ADDRESS: "{{ ansible_default_ipv4.address }}"  # or your server IP
+      EXTERNAL_IP: "{{ ansible_default_ipv4.address }}"
+      # Shared secret for dynamic credentials
+      TURNSERVER_STATIC_AUTH_SECRET: "{{ coturn_shared_secret }}"
+      # Enable TLS
+      TURNSERVER_TLS_LISTENING_PORT: "5349"
+      TURNSERVER_CERT: "/etc/turnserver/tls.crt"
+      TURNSERVER_PKEY: "/etc/turnserver/tls.key"
+      NO_AUTH_TIMESTAMPS: "true"
+      REALM: "{{ matrix_domain }}"
+    # Mount TLS certs (same as Nginx) if you want encrypted TURN (recommended)
+    volumes:
+      - "/var/lib/matrix-nginx/certbot/live/{{ matrix_domain }}:/etc/turnserver:ro"
+  register: coturn_cont

roles/matrix-synapse/templates/homeserver.yaml.j2

@@ -35,3 +35,24 @@ rc_flood_control:
 # Enable password login
 enable_registration: true
 enable_registration_without_verification: true
+
+
+## -- turn settings
+# Voice & Video Chat Settings
+media_store_path: /data/media_store
+max_image_pixels: 32000000  # 32MP max
+
+# TURN/STUN server config
+turn_uris:
+  - "turn:{{ matrix_domain }}:3478?transport=udp"
+  - "turn:{{ matrix_domain }}:3478?transport=tcp"
+  - "turns:{{ matrix_domain }}:5349?transport=tcp"  # encrypted TURN
+
+turn_shared_secret: "{{ coturn_shared_secret }}"
+turn_username: "{{ coturn_username }}"
+turn_password: "{{ coturn_password }}"
+turn_time_limit: 86400  # 24h (optional)
+turn_allow_guests: true  # allow non-Matrix users (e.g., web guests)
+
+# Optional: Enable call features
+enable_call_signalling: true

roles/nginx-proxy/templates/default.conf.j2

@@ -57,4 +57,37 @@ server {
     location /admin {
         return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin
     }
+}
+
+#--- Coturn changes --- #
+
+# TURN over TLS (port 443) — proxied to Coturn's 5349
+# Only needed if you want TURN on 443 (avoids firewall issues)
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+upstream coturn_tls {
+    server 127.0.0.1:5349;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name {{ matrix_domain }};
+
+    # ... [existing TLS config] ...
+
+    # TURN over TLS (for UDP/TCP fallback on port 443)
+    location /turn {
+        proxy_pass https://coturn_tls;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_read_timeout 86400;
+    }
+
+    # Or simpler: proxy UDP via a dedicated TCP tunnel (advanced)
+    # For most cases, just expose 3478/5349 directly → no Nginx needed!
 }