search

spantaleev / matrix-docker-ansible-deploy

🐳 Matrix (An open network for secure, decentralized communication) server setup using Ansible and Docker
GNU Affero General Public License v3.0
4.88k stars 1.04k forks source link

Self-signed certificates in external services #331

Closed Hedgehog57 closed 4 years ago

Hedgehog57 commented 4 years ago

Hello!

Thanks for a perfect playbook.

I am stuck with one thing and don't know what to do. We have AD LDAP servers and want to communicate with then by LDAPS. After configuring mxisd and synapse we cannot login in the system because of LDAPS certificate errors (self-signed certificates). Changing to LDAP and disabling TLS allow us to pass authorization in synapse.

When it is installed on standart system w/o docker i can do one two things

  1. add CA certificates to openssl and this will work in python
  2. disable certification validation in python (bad idea, i know)

But what can we do in docker? Only make a fork of synapse image and modify dockerfile? Or there is some mechanism i didn't find?

Will much appreciate for any ideas.

spantaleev commented 4 years ago

You could make your own Synapse image and use that one. But you'd need to keep it updated, which is a bit annoying.

Another, possibly better, option might be to prepare the certificates directory on the host and mount it in the Synapse container (to /etc/ssl or wherever it needs to be). You can use the matrix_synapse_container_additional_volumes or matrix_synapse_container_extra_arguments variables to do that. You can read the documentation about those variables in roles/matrix-synapse/defaults/main.yml. Doing that, you'd be using the latest image (as defined by the playbook) and won't need to worry about keeping anything in sync.

daudo commented 4 years ago

Reawakening this a bit old post, as we've been hit by this issue as well.

The problem is not with the Synapse but the mxisd image (that has reached EOL btw, see https://github.com/kamax-matrix/mxisd/blob/master/EOL.md#end-of-life-notice).

mxisd is a Java application, so the "right" way to do it is to populate Java's keystore accordingly.

Are you interested in a PR for the mxisd role?

spantaleev commented 4 years ago

We know it's EOL and are considering adding ma1sd as an alternative. See #333.

If you've got time and would like to fix things for mxisd, it would probably be useful in the future for the ma1ds role as well. A pull request would be welcome! :)