synapse-configs/public-nginx.config

upstream matrix_backend {
    server localhost:8008;
    keepalive 16;
}

upstream synchrotron {
    server localhost:8183;
    server localhost:8173;
    keepalive 16;
}

upstream media_repository {
    server localhost:8185;
    keepalive 16;
}

upstream client_reader {
    server localhost:8186;
    keepalive 16;
}

upstream user_dir {
    server localhost:8187;
    keepalive 16;
}
upstream frontend_proxy {
    server localhost:8188;
    keepalive 16;
}

server {

	root /var/www/thewords.faith/html;

	access_log /var/log/nginx/thewords.faith.log;


	server_name thewords.faith;

      listen 443 ssl http2; # managed by Certbot
      listen 8448 ssl http2 default_server;

      ssl_certificate /etc/letsencrypt/live/domain/fullchain.pem; # managed by Certbot
      ssl_certificate_key /etc/letsencrypt/live/domain/privkey.pem; # managed by Certbot
      include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


      location ~ ^/_matrix/client/(v2_alpha|r0)/sync$ {
        proxy_pass http://synchrotron;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location ~ ^/_matrix/client/(api/v1|v2_alpha|r0)/events$ {
        proxy_pass http://synchrotron;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location ~ ^/_matrix/client/(api/v1|r0)/initialSync$ {
        proxy_pass http://synchrotron;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location ~ ^/_matrix/client/(api/v1|r0)/rooms/[^/]+/initialSync$ {
        proxy_pass http://synchrotron;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location ~ ^/_matrix/client/(api/v1|r0|unstable)/publicRooms$ {
        proxy_pass http://client_reader;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location ~ ^/_matrix/client/(api/v1|r0|unstable)/user_directory/search$ {
        proxy_pass http://user_dir;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location ~ ^/_matrix/client/(api/v1|r0|unstable)/keys/upload {
        proxy_pass http://frontend_proxy;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location /_matrix/media/ {
        proxy_pass http://media_repository;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location /_matrix {
        proxy_pass http://matrix_backend;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location /.well-known/matrix/client {
        return 200 '{"m.homeserver": {"base_url": "https://thewords.faith"}}';
	      default_type application/json;
	      add_header Access-Control-Allow-Origin *;
    }
    location / {
	        proxy_pass http://127.0.0.1:8000;
        	proxy_set_header Host $host;
	        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

server {

    location /metrics {
        stub_status on;
        access_log   off;
        allow 127.0.0.1;
        deny all;
   }
    server_name thewords.faith;

    if ($host = thewords.faith) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
#    return 404; # managed by Certbot


}