overmind
/
matrix-docker-ansible-deploy
镜像来自 https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
複製 0
程式碼 問題管理 0 版本發佈 0 Wiki Activity
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
6992 Commit
13 分支
36 MiB
 
 
目錄樹: 54fb153acf
分支列表 標籤列表
${ item.name }
Create branch ${ searchTerm }
from '54fb153acf'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-synapse-reverse-prox.../defaults/main.yml

246 line
21 KiB
原始文件 Blame 文件歷史 

  1. ---

  2. 

  3. # matrix-synapse-reverse-proxy companion is a role which brings up a containerized nginx webserver which helps with reverse-proxying to Synapse.

  4. #

  5. # When Synapse is NOT running in worker-mode, reverse-proxying is relatively simple (everything goes to `matrix-synapse:XXXX`).

  6. #

  7. # When Synapse workers are enabled, however, the reverse-proxying configuration is much more complicated.

  8. # Certain requests need to go to certain workers, etc.

  9. # In the past, the main reverse proxy (`matrix-synapse-reverse-proxy-companion`) was handling request routing to the appropriate workers,

  10. # but that only worked well for external requests (from outside of the Matrix server itself).

  11. #

  12. # Without the help of `matrix-synapse-reverse-proxy-companion`, internal services (like Dimension) that would like to talk to Synapse over the container network

  13. # did not have an endpoint for Synapse that they could be pointed to and have it just work.

  14. # If `matrix-synapse-reverse-proxy-companion` was enabled, Dimension could be pointed to its vhost handling Synapse and routing to the appropriate workers,

  15. # but when `matrix-synapse-reverse-proxy-companion` was disabled, this helpful functionality was not available and the best we could do

  16. # is point Dimension to the main Synapse process at `matrix-synapse:XXXX` itself.

  17. # Doing that breaks requests that need to go to specific workers.

  18. # See: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2090

  19. #

  20. # What this role does is, it extracts all the Synapse request routing out of the `matrix-synapse-reverse-proxy-companion` role here,

  21. # and makes the `matrix-synapse-reverse-proxy-companion` container service represent Synapse and route appropriately,

  22. # regardless of whether workers are enabled or disabled.

  23. # All other playbook services can then forget about `matrix-synapse` or `matrix-synapse-whatever-worker`, etc.,

  24. # and just use `matrix-synapse-reverse-proxy-companion` as their request destination.

  25. 

  26. matrix_synapse_reverse_proxy_companion_enabled: true

  27. 

  28. # renovate: datasource=docker depName=nginx

  29. matrix_synapse_reverse_proxy_companion_version: 1.25.3-alpine

  30. 

  31. matrix_synapse_reverse_proxy_companion_base_path: "{{ matrix_synapse_base_path }}/reverse-proxy-companion"

  32. matrix_synapse_reverse_proxy_companion_confd_path: "{{ matrix_synapse_reverse_proxy_companion_base_path }}/conf.d"

  33. 

  34. # List of systemd services that matrix-synapse-reverse-proxy-companion.service depends on

  35. matrix_synapse_reverse_proxy_companion_systemd_required_services_list: "{{ matrix_synapse_reverse_proxy_companion_systemd_required_services_list_default + matrix_synapse_reverse_proxy_companion_systemd_required_services_list_auto + matrix_synapse_reverse_proxy_companion_systemd_required_services_list_custom }}"

  36. matrix_synapse_reverse_proxy_companion_systemd_required_services_list_default: ['docker.service']

  37. matrix_synapse_reverse_proxy_companion_systemd_required_services_list_auto: []

  38. matrix_synapse_reverse_proxy_companion_systemd_required_services_list_custom: []

  39. 

  40. # List of systemd services that matrix-synapse-reverse-proxy-companion.service wants

  41. matrix_synapse_reverse_proxy_companion_systemd_wanted_services_list: ['matrix-synapse.service']

  42. 

  43. # We use an official nginx image, which we fix-up to run unprivileged.

  44. # An alternative would be an `nginxinc/nginx-unprivileged` image, but

  45. # that is frequently out of date.

  46. matrix_synapse_reverse_proxy_companion_container_image: "{{ matrix_container_global_registry_prefix }}nginx:{{ matrix_synapse_reverse_proxy_companion_version }}"

  47. matrix_synapse_reverse_proxy_companion_container_image_force_pull: "{{ matrix_synapse_reverse_proxy_companion_container_image.endswith(':latest') }}"

  48. 

  49. matrix_synapse_reverse_proxy_companion_container_network: ""

  50. 

  51. # A list of additional container networks that matrix-synapse-reverse-proxy-companion would be connected to.

  52. # The playbook does not create these networks, so make sure they already exist.

  53. matrix_synapse_reverse_proxy_companion_container_additional_networks: []

  54. 

  55. # Controls whether the matrix-synapse-reverse-proxy-companion container exposes its HTTP Client-Server API port (tcp/8008 in the container).

  56. #

  57. # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8008"), or empty string to not expose.

  58. matrix_synapse_reverse_proxy_companion_container_client_api_host_bind_port: ''

  59. 

  60. # Controls whether the matrix-synapse-reverse-proxy-companion container exposes its HTTP Federation (Server-Server) API port (tcp/8048 in the container).

  61. #

  62. # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8048"), or empty string to not expose.

  63. matrix_synapse_reverse_proxy_companion_container_federation_api_host_bind_port: ''

  64. 

  65. # matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.

  66. # See `../templates/labels.j2` for details.

  67. #

  68. # To inject your own other container labels, see `matrix_synapse_reverse_proxy_companion_container_labels_additional_labels`.

  69. matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled: true

  70. matrix_synapse_reverse_proxy_companion_container_labels_traefik_docker_network: "{{ matrix_synapse_reverse_proxy_companion_container_network }}"

  71. matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: web-secure

  72. matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: default

  73. matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: ''

  74. 

  75. # Controls whether labels will be added for handling the root (/) path

  76. matrix_synapse_reverse_proxy_companion_container_labels_client_root_enabled: true

  77. matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  78. matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_hostname }}`) && Path(`/`)"

  79. matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_priority: 0

  80. matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}"

  81. matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_entrypoints != 'web' }}"

  82. matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  83. matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: false

  84. matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: ""

  85. 

  86. # Controls whether labels will be added that expose the Client-Server API.

  87. matrix_synapse_reverse_proxy_companion_container_labels_client_api_enabled: true

  88. matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  89. matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_path_prefix: /_matrix

  90. matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_path_prefix }}`)"

  91. matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_priority: 0

  92. matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}"

  93. matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_entrypoints != 'web' }}"

  94. matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  95. 

  96. # Controls whether labels will be added that expose the /_synapse/client paths

  97. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled: true

  98. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  99. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_path_prefix: /_synapse/client

  100. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_path_prefix }}`)"

  101. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_priority: 0

  102. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}"

  103. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_entrypoints != 'web' }}"

  104. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  105. 

  106. # Controls whether labels will be added that expose the /_synapse/oidc paths

  107. # Enable this if you need OpenID Connect authentication support.

  108. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_enabled: false

  109. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  110. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_path_prefix: /_synapse/oidc

  111. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_path_prefix }}`)"

  112. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_priority: 0

  113. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}"

  114. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_entrypoints != 'web' }}"

  115. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  116. 

  117. # Controls whether labels will be added that expose the /_synapse/admin paths

  118. # Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.

  119. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_enabled: false

  120. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  121. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin

  122. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_path_prefix }}`)"

  123. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_priority: 0

  124. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}"

  125. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_entrypoints != 'web' }}"

  126. matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  127. 

  128. # Controls whether labels will be added that expose the Server-Server API (Federation API).

  129. matrix_synapse_reverse_proxy_companion_container_labels_federation_api_enabled: "{{ matrix_synapse_reverse_proxy_companion_federation_api_enabled }}"

  130. matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  131. matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_path_prefix: /_matrix

  132. matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_path_prefix }}`)"

  133. matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_priority: 0

  134. matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_entrypoints: ''

  135. matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_entrypoints != 'web' }}"

  136. matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  137. 

  138. # matrix_synapse_reverse_proxy_companion_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.

  139. # See `../templates/labels.j2` for details.

  140. #

  141. # Example:

  142. # matrix_synapse_reverse_proxy_companion_container_labels_additional_labels: |

  143. #   my.label=1

  144. #   another.label="here"

  145. matrix_synapse_reverse_proxy_companion_container_labels_additional_labels: ''

  146. 

  147. # The amount of worker processes and connections

  148. # Consider increasing these when you are expecting high amounts of traffic

  149. # http://nginx.org/en/docs/ngx_core_module.html#worker_connections

  150. matrix_synapse_reverse_proxy_companion_worker_processes: auto

  151. matrix_synapse_reverse_proxy_companion_worker_connections: 1024

  152. 

  153. # Option to disable the access log

  154. matrix_synapse_reverse_proxy_companion_access_log_enabled: true

  155. 

  156. # The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.

  157. matrix_synapse_reverse_proxy_companion_tmp_directory_size_mb: "{{ (matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb | int) * 50 }}"

  158. matrix_synapse_reverse_proxy_companion_tmp_cache_directory_size_mb: "{{ (matrix_synapse_reverse_proxy_companion_synapse_cache_max_size_mb | int) * 2 }}"

  159. 

  160. # A list of strings containing additional configuration blocks to add to the nginx server configuration (nginx.conf).

  161. # for big matrixservers to enlarge the number of open files to prevent timeouts

  162. # matrix_synapse_reverse_proxy_companion_additional_configuration_blocks:

  163. #  - 'worker_rlimit_nofile 30000;'

  164. matrix_synapse_reverse_proxy_companion_additional_configuration_blocks: []

  165. 

  166. # A list of strings containing additional configuration blocks to add to the nginx event server configuration (nginx.conf).

  167. matrix_synapse_reverse_proxy_companion_event_additional_configuration_blocks: []

  168. 

  169. # A list of strings containing additional configuration blocks to add to the nginx http's server configuration (nginx-http.conf).

  170. matrix_synapse_reverse_proxy_companion_http_additional_server_configuration_blocks: []

  171. 

  172. # To increase request timeout in NGINX using proxy_read_timeout, proxy_connect_timeout, proxy_send_timeout, send_timeout directives

  173. # Nginx Default: proxy_connect_timeout 60s;   #Defines a timeout for establishing a connection with a proxied server

  174. # Nginx Default: proxy_send_timeout 60s;      #Sets a timeout for transmitting a request to the proxied server.

  175. # Nginx Default: proxy_read_timeout 60s;      #Defines a timeout for reading a response from the proxied server.

  176. # Nginx Default: send_timeout 60s;            #Sets a timeout for transmitting a response to the client.

  177. #

  178. # For more information visit:

  179. # http://nginx.org/en/docs/http/ngx_http_proxy_module.html

  180. # http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout

  181. # https://www.nginx.com/resources/wiki/start/topics/examples/fullexample2/

  182. #

  183. # Here we are sticking with nginx default values change this value carefully.

  184. matrix_synapse_reverse_proxy_companion_proxy_connect_timeout: 60

  185. matrix_synapse_reverse_proxy_companion_proxy_send_timeout: 60

  186. matrix_synapse_reverse_proxy_companion_proxy_read_timeout: 60

  187. matrix_synapse_reverse_proxy_companion_send_timeout: 60

  188. 

  189. # For OCSP purposes, we need to define a resolver at the `server{}` level or `http{}` level (we do the latter).

  190. #

  191. # Otherwise, we get warnings like this:

  192. # > [warn] 22#22: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/matrix/ssl/config/live/.../fullchain.pem"

  193. #

  194. # We point it to the internal Docker resolver, which likely delegates to nameservers defined in `/etc/resolv.conf`.

  195. matrix_synapse_reverse_proxy_companion_http_level_resolver: 127.0.0.11

  196. 

  197. matrix_synapse_reverse_proxy_companion_hostname: "matrix-synapse-reverse-proxy-companion"

  198. 

  199. # matrix_synapse_reverse_proxy_companion_client_api_addr specifies the address where the Client-Server API is

  200. matrix_synapse_reverse_proxy_companion_client_api_addr: 'matrix-synapse:{{ matrix_synapse_container_client_api_port }}'

  201. # This needs to be equal or higher than the maximum upload size accepted by Synapse.

  202. matrix_synapse_reverse_proxy_companion_client_api_client_max_body_size_mb: 50

  203. 

  204. # matrix_synapse_reverse_proxy_companion_federation_api_enabled specifies whether reverse proxying for the Federation (Server-Server) API should be done

  205. matrix_synapse_reverse_proxy_companion_federation_api_enabled: true

  206. # matrix_synapse_reverse_proxy_companion_federation_api_addr specifies the address where the Federation (Server-Server) API is

  207. matrix_synapse_reverse_proxy_companion_federation_api_addr: 'matrix-synapse:{{ matrix_synapse_container_federation_api_plain_port }}'

  208. matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb: "{{ (matrix_synapse_reverse_proxy_companion_client_api_client_max_body_size_mb | int) * 3 }}"

  209. 

  210. # A list of strings containing additional configuration blocks to add to the nginx vhost handling the Synapse Client-Server API

  211. matrix_synapse_reverse_proxy_companion_synapse_client_api_additional_server_configuration_blocks: []

  212. 

  213. # A list of strings containing additional configuration blocks to add to the nginx vhost handling the Synapse Federation (Server-Server) API

  214. matrix_synapse_reverse_proxy_companion_synapse_federation_api_additional_server_configuration_blocks: []

  215. 

  216. 

  217. # synapse worker activation and endpoint mappings

  218. matrix_synapse_reverse_proxy_companion_synapse_workers_enabled: false

  219. matrix_synapse_reverse_proxy_companion_synapse_workers_list: []

  220. matrix_synapse_reverse_proxy_companion_synapse_generic_worker_client_server_locations: []

  221. matrix_synapse_reverse_proxy_companion_synapse_generic_worker_federation_locations: []

  222. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_typing_stream_worker_client_server_locations: []

  223. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_to_device_stream_worker_client_server_locations: []

  224. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_account_data_stream_worker_client_server_locations: []

  225. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_receipts_stream_worker_client_server_locations: []

  226. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_presence_stream_worker_client_server_locations: []

  227. matrix_synapse_reverse_proxy_companion_synapse_media_repository_locations: []

  228. matrix_synapse_reverse_proxy_companion_synapse_user_dir_locations: []

  229. 

  230. 

  231. # synapse content caching

  232. matrix_synapse_reverse_proxy_companion_synapse_cache_enabled: false

  233. matrix_synapse_reverse_proxy_companion_synapse_cache_path: /tmp/synapse-cache

  234. matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_name: "STATIC"

  235. matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_size: "10m"

  236. matrix_synapse_reverse_proxy_companion_synapse_cache_inactive_time: "48h"

  237. matrix_synapse_reverse_proxy_companion_synapse_cache_max_size_mb: 1024

  238. matrix_synapse_reverse_proxy_companion_synapse_cache_proxy_cache_valid_time: "24h"

  239. 

  240. 

  241. # Controls whether matrix-synapse-reverse-proxy-companion trusts an upstream server's X-Forwarded-Proto header.

  242. # The `matrix-synapse-reverse-proxy-companion` does not terminate SSL and always expects to be fronted by another reverse-proxy server (`matrix-nginx-proxy`, etc.).

  243. # As such, it trusts the protocol scheme forwarded by the upstream proxy.

  244. matrix_synapse_reverse_proxy_companion_trust_forwarded_proto: true

  245. matrix_synapse_reverse_proxy_companion_x_forwarded_proto_value: "{{ '$http_x_forwarded_proto' if matrix_synapse_reverse_proxy_companion_trust_forwarded_proto else '$scheme' }}"