Deploy Matrix/Element

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget gnupg lsb-release apt-transport-https ca-certificates

sudo ufw allow 22/tcp       # SSH
sudo ufw allow 80/tcp       # HTTP (for Let's Encrypt)
sudo ufw allow 443/tcp      # HTTPS
sudo ufw allow 8448/tcp     # Matrix federation
sudo ufw enable

sudo apt install -y postgresql postgresql-contrib
sudo systemctl start postgresql
sudo systemctl enable postgresql

sudo -u postgres psql << EOF
CREATE USER synapse_user WITH PASSWORD 'your_secure_password_here';
CREATE DATABASE synapse ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0 OWNER synapse_user;
EOF

sudo wget -O /usr/share/keyrings/matrix-org-archive-keyring.gpg \
  https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] \
  https://packages.matrix.org/debian/ $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/matrix-org.list

sudo apt update

sudo apt install -y matrix-synapse-py3

server_name: "yourdomain.com"

listeners:
  - port: 8008
    tls: false
    type: http
    x_forwarded: true
    bind_addresses: ['127.0.0.1']
    resources:
      - names: [client, federation]
        compress: false

database:
  name: psycopg2
  args:
    user: synapse_user
    password: "your_secure_password_here"
    database: synapse
    host: localhost
    cp_min: 5

enable_registration: false
enable_registration_without_verification: false
federation_domain_whitelist: []
media_store_path: /var/lib/matrix-synapse/media
max_upload_size: 50M
url_preview_enabled: true
log_config: "/etc/matrix-synapse/log.yaml"

sudo apt install -y nginx certbot python3-certbot-nginx

# /etc/nginx/sites-available/matrix
server {
    listen 80;
    listen [::]:80;
    server_name matrix.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    listen 8448 ssl http2;
    listen [::]:8448 ssl http2;

    server_name matrix.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/matrix.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    client_max_body_size 50M;

    location /.well-known/matrix/client {
        return 200 '{"m.homeserver":{"base_url":"https://matrix.yourdomain.com"}}';
        default_type application/json;
    }

    location /.well-known/matrix/server {
        return 200 '{"m.server":"matrix.yourdomain.com:443"}';
        default_type application/json;
    }

    location ~ ^(/_matrix|/_synapse/client) {
        proxy_pass http://127.0.0.1:8008;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
        proxy_read_timeout 600s;
    }
}

sudo certbot certonly --webroot -w /var/www/html \
  -d matrix.yourdomain.com --non-interactive --agree-tos \
  -m admin@yourdomain.com

sudo ln -s /etc/nginx/sites-available/matrix /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

sudo mkdir -p /var/www/element

ELEMENT_VERSION=$(curl -s https://api.github.com/repos/element-hq/element-web/releases/latest | \
  grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
echo "Installing Element Web version: $ELEMENT_VERSION"

cd /tmp
wget "https://github.com/element-hq/element-web/releases/download/v${ELEMENT_VERSION}/element-v${ELEMENT_VERSION}.tar.gz"
tar -xzf "element-v${ELEMENT_VERSION}.tar.gz"
sudo cp -r "element-v${ELEMENT_VERSION}"/* /var/www/element/
sudo chown -R www-data:www-data /var/www/element

{
  "default_server_config": {
    "m.homeserver": {
      "base_url": "https://matrix.yourdomain.com",
      "server_name": "yourdomain.com"
    },
    "m.identity_server": {
      "base_url": "https://vector.im"
    }
  },
  "disable_custom_urls": false,
  "disable_guests": true,
  "brand": "Element",
  "default_country_code": "US",
  "show_labs_settings": true,
  "default_theme": "light"
}

# /etc/nginx/sites-available/element
server {
    listen 80;
    server_name element.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name element.yourdomain.com;
    root /var/www/element;
    index index.html;

    ssl_certificate /etc/letsencrypt/live/element.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/element.yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        try_files $uri $uri/ /index.html;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
}

sudo certbot certonly --webroot -w /var/www/html \
  -d element.yourdomain.com --non-interactive --agree-tos \
  -m admin@yourdomain.com

sudo ln -s /etc/nginx/sites-available/element /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

sudo systemctl start matrix-synapse
sudo systemctl enable matrix-synapse
sudo systemctl status matrix-synapse

# View logs if needed
sudo journalctl -u matrix-synapse -f

sudo register_new_matrix_user -c /etc/matrix-synapse/homeserver.yaml http://localhost:8008

# Follow prompts:
# - Enter username (e.g., admin)
# - Enter password
# - Confirm password
# - Make admin? yes

# Test client endpoint
curl https://matrix.yourdomain.com/.well-known/matrix/client

# Test server endpoint
curl https://matrix.yourdomain.com/.well-known/matrix/server

# Use Matrix Federation Tester
# Visit: https://federationtester.matrix.org/