diff --git a/docker/complement/conf-workers/caddy.complement.json b/docker/complement/conf-workers/caddy.complement.json
deleted file mode 100644
index 09e2136af2..0000000000
--- a/docker/complement/conf-workers/caddy.complement.json
+++ /dev/null
@@ -1,72 +0,0 @@
-{
- "apps": {
- "http": {
- "servers": {
- "srv0": {
- "listen": [
- ":8448"
- ],
- "routes": [
- {
- "match": [
- {
- "host": [
- "{{ server_name }}"
- ]
- }
- ],
- "handle": [
- {
- "handler": "subroute",
- "routes": [
- {
- "handle": [
- {
- "handler": "reverse_proxy",
- "upstreams": [
- {
- "dial": "localhost:8008"
- }
- ]
- }
- ]
- }
- ]
- }
- ],
- "terminal": true
- }
- ]
- }
- }
- },
- "tls": {
- "automation": {
- "policies": [
- {
- "subjects": [
- "{{ server_name }}"
- ],
- "issuers": [
- {
- "module": "internal"
- }
- ],
- "on_demand": true
- }
- ]
- }
- },
- "pki": {
- "certificate_authorities": {
- "local": {
- "name": "Complement CA",
- "root": {
- "certificate": "/complement/ca/ca.crt",
- "private_key": "/complement/ca/ca.key"
- }
- }
- }
- }
- }
- }
diff --git a/docker/complement/conf-workers/caddy.supervisord.conf b/docker/complement/conf-workers/caddy.supervisord.conf
deleted file mode 100644
index d9ddb51dac..0000000000
--- a/docker/complement/conf-workers/caddy.supervisord.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-[program:caddy]
-command=/usr/local/bin/prefix-log /root/caddy run --config /root/caddy.json
-autorestart=unexpected
-stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/stderr
-stderr_logfile_maxbytes=0
diff --git a/docker/complement/conf-workers/start-complement-synapse-workers.sh b/docker/complement/conf-workers/start-complement-synapse-workers.sh
index b9a6b55bbe..a10b57a53f 100755
--- a/docker/complement/conf-workers/start-complement-synapse-workers.sh
+++ b/docker/complement/conf-workers/start-complement-synapse-workers.sh
@@ -9,9 +9,6 @@ function log {
echo "$d $@"
}
-# Replace the server name in the caddy config
-sed -i "s/{{ server_name }}/${SERVER_NAME}/g" /root/caddy.json
-
# Set the server name of the homeserver
export SYNAPSE_SERVER_NAME=${SERVER_NAME}
@@ -39,6 +36,21 @@ export SYNAPSE_WORKER_TYPES="\
appservice, \
pusher"
+
+# Generate a TLS key, then generate a certificate by having Complement's CA sign it
+# Note that both the key and certificate are in PEM format (not DER).
+openssl genrsa -out /conf/server.tls.key 2048
+
+openssl req -new -key /conf/server.tls.key -out /conf/server.tls.csr \
+ -subj "/CN=${SERVER_NAME}"
+
+openssl x509 -req -in /conf/server.tls.csr \
+ -CA /complement/ca/ca.crt -CAkey /complement/ca/ca.key -set_serial 1 \
+ -out /conf/server.tls.crt
+
+export SYNAPSE_TLS_CERT=/conf/server.tls.crt
+export SYNAPSE_TLS_KEY=/conf/server.tls.key
+
# Run the script that writes the necessary config files and starts supervisord, which in turn
# starts everything else
exec /configure_workers_and_start.py
|
