Matrix Conduit 国内部署实战：Docker 镜像拉取、Nginx 反代与生产环境优化

# 创建/编辑 Docker daemon 配置文件
sudo vim /etc/docker/daemon.json

# 添加以下内容
{
  "registry-mirrors": [
    "https://docker.mirrors.ustc.edu.cn",
    "https://registry.docker-cn.com",
    "https://mirror.ccs.tencentyun.com"
  ],
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  }
}

# 重启 Docker 服务
sudo systemctl daemon-reload
sudo systemctl restart docker

# 验证配置
docker info | grep -A 5 "Registry Mirrors"

# 使用阿里云镜像拉取
docker pull registry.cn-hangzhou.aliyuncs.com/matrix-org/conduit:latest

# 创建工作目录
mkdir -p ~/matrix-conduit && cd ~/matrix-conduit

# 创建 docker-compose.yml
cat > docker-compose.yml << 'EOF'
version: '3.8'

services:
  conduit:
    image: matrixorg/conduit:latest
    container_name: matrix-conduit
    restart: unless-stopped
    ports:
      - "8008:8008"
    volumes:
      - ./data:/var/lib/conduit
    environment:
      - CONDUIT_SERVER_NAME=matrix.example.com
      - CONDUIT_PORT=8008
      - CONDUIT_MAX_CONCURRENT_REQUESTS=100
    networks:
      - matrix-net

networks:
  matrix-net:
    driver: bridge
EOF

# 启动服务
docker compose up -d

# 查看日志
docker compose logs -f

# 验证服务
curl http://localhost:8008/_matrix/client/versions

# 检查容器状态
docker ps | grep conduit

# 预期输出：
# matrix-conduit   matrixorg/conduit:latest   Up 2 minutes   0.0.0.0:8008->8008/tcp

# 测试 API 响应
curl -s http://localhost:8008/_matrix/client/versions | jq .

# 预期输出包含支持的 Matrix 版本
# {
#   "versions": ["r0.6.0", "r0.6.1", ...]
# }

version: '3.8'

services:
  # Matrix Conduit 主服务
  conduit:
    image: matrixorg/conduit:latest
    container_name: matrix-conduit
    restart: unless-stopped
    environment:
      # 服务器名称（必须是域名）
      - CONDUIT_SERVER_NAME=matrix.example.com
      # 监听端口
      - CONDUIT_PORT=8008
      # 最大并发请求数
      - CONDUIT_MAX_CONCURRENT_REQUESTS=100
      # 日志级别（error/warn/info/debug/trace）
      - RUST_LOG=info
    volumes:
      # 数据持久化
      - ./data:/var/lib/conduit
      # 配置文件（可选）
      - ./conduit.toml:/etc/conduit/conduit.toml:ro
    networks:
      - matrix-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8008/_matrix/client/versions"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Nginx 反向代理
  nginx:
    image: nginx:alpine
    container_name: matrix-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8448:8448"
    volumes:
      # Nginx 配置
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      # SSL 证书
      - ./ssl:/etc/nginx/ssl:ro
      # 日志
      - ./logs/nginx:/var/log/nginx
    depends_on:
      - conduit
    networks:
      - matrix-net

  # Redis 缓存（可选，提升性能）
  redis:
    image: redis:7-alpine
    container_name: matrix-redis
    restart: unless-stopped
    command: redis-server --appendonly yes
    volumes:
      - ./redis-data:/data
    networks:
      - matrix-net
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3

networks:
  matrix-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # 日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    # 性能优化
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    client_max_body_size 50M;

    # Gzip 压缩
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript 
               application/xml application/xml+rss text/javascript;

    # 包含站点配置
    include /etc/nginx/conf.d/*.conf;
}

# HTTP 重定向到 HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name matrix.example.com;

    # ACME 挑战（Let's Encrypt）
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    # 其他请求重定向到 HTTPS
    location / {
        return 301 https://$server_name$request_uri;
    }
}

# HTTPS 主服务器
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrix.example.com;

    # SSL 证书配置
    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;

    # SSL 优化
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # 现代 SSL 配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS
    add_header Strict-Transport-Security "max-age=63072000" always;

    # Matrix 客户端 API
    location /_matrix/ {
        proxy_pass http://conduit:8008;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket 支持
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # 超时配置
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # 静态资源（可选）
    location /_static/ {
        alias /var/www/matrix-static/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # 健康检查
    location /health {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }
}

# Matrix Federation（服务器间通信）
server {
    listen 8448 ssl http2;
    listen [::]:8448 ssl http2;
    server_name matrix.example.com;

    # SSL 证书（可以和主域名共用）
    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

    location / {
        proxy_pass http://conduit:8008;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

# 创建证书目录
mkdir -p ~/matrix-conduit/ssl
cd ~/matrix-conduit/ssl

# 使用 Certbot 获取证书
docker run --rm -it \
  -v $(pwd)/fullchain.pem:/etc/letsencrypt/live/matrix.example.com/fullchain.pem \
  -v $(pwd)/privkey.pem:/etc/letsencrypt/live/matrix.example.com/privkey.pem \
  -v $(pwd)/certbot:/var/www/certbot \
  certbot/certbot certonly \
  --webroot -w /var/www/certbot \
  -d matrix.example.com \
  --email your-email@example.com \
  --agree-tos

# 复制证书到正确位置
cp /etc/letsencrypt/live/matrix.example.com/fullchain.pem ./ssl/
cp /etc/letsencrypt/live/matrix.example.com/privkey.pem ./ssl/

# 设置权限
chmod 600 ./ssl/privkey.pem
chmod 644 ./ssl/fullchain.pem

# 启动所有服务
docker compose up -d

# 查看服务状态
docker compose ps

# 查看 Conduit 日志
docker compose logs -f conduit

# 查看 Nginx 日志
docker compose logs -f nginx

# 验证 HTTPS
curl -k https://matrix.example.com/_matrix/client/versions

[global]
server_name = "matrix.example.com"
port = 8008
max_concurrent_requests = 100

[database]
# RocksDB 优化
enable_compression = true
compression_type = "lz4"
write_buffer_size = 256  # MB
max_write_buffer_number = 6
min_write_buffer_number_to_merge = 2
max_bytes_for_level_base = 512  # MB
target_file_size_base = 64  # MB
num_levels = 7

[cache]
# 内存缓存
cache_size = 512  # MB

[logging]
# 日志级别
level = "info"
# 日志文件
file = "/var/log/conduit/conduit.log"
# 日志轮转
max_size = 100  # MB
max_backups = 5

# 网络优化
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 15

# 文件描述符
fs.file-max = 2097152
fs.inotify.max_user_watches = 524288

# 内存管理
vm.swappiness = 10
vm.vfs_cache_pressure = 50

# 应用配置
sudo sysctl -p

# 增加文件描述符限制
* soft nofile 65535
* hard nofile 65535
root soft nofile 65535
root hard nofile 65535

services:
  conduit:
    # ... 其他配置 ...
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 256M

# 安装 ab（Apache Benchmark）
sudo apt install apache2-utils -y

# 测试并发性能（100 并发，1000 请求）
ab -n 1000 -c 100 http://localhost:8008/_matrix/client/versions

# 预期输出：
# Requests per second: 850.23 [#/sec] (mean)
# Time per request: 117.615 [ms] (mean)

global:
  scrape_interval: 15s
  evaluation_interval: 15s

alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

rule_files:
  - "alerts.yml"

scrape_configs:
  # Conduit 监控
  - job_name: 'conduit'
    static_configs:
      - targets: ['conduit:8008']
    metrics_path: '/_synapse/metrics'

  # Nginx 监控
  - job_name: 'nginx'
    static_configs:
      - targets: ['nginx:80']

  # Node Exporter（系统监控）
  - job_name: 'node'
    static_configs:
      - targets: ['node-exporter:9100']

groups:
  - name: matrix-alerts
    rules:
      # Conduit 宕机告警
      - alert: ConduitDown
        expr: up{job="conduit"} == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Conduit 服务宕机"
          description: "Conduit 服务已停止响应超过 1 分钟"

      # 高内存使用率
      - alert: HighMemoryUsage
        expr: container_memory_usage_bytes{container="matrix-conduit"} / container_spec_memory_limit_bytes > 0.8
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Conduit 内存使用率过高"
          description: "内存使用率超过 80%"

      # 高错误率
      - alert: HighErrorRate
        expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.1
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "HTTP 错误率过高"
          description: "5xx 错误率超过 10%"

      # 磁盘空间不足
      - alert: LowDiskSpace
        expr: (node_filesystem_avail_bytes / node_filesystem_size_bytes) * 100 < 20
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "磁盘空间不足"
          description: "可用磁盘空间低于 20%"

version: '3.8'

services:
  prometheus:
    image: prom/prometheus:v2.45.0
    container_name: matrix-prometheus
    restart: unless-stopped
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - ./prometheus/alerts.yml:/etc/prometheus/alerts.yml
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=30d'
      - '--web.enable-lifecycle'
    ports:
      - "9090:9090"
    networks:
      - matrix-net

  grafana:
    image: grafana/grafana:10.0.0
    container_name: matrix-grafana
    restart: unless-stopped
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=your-secure-password
      - GF_USERS_ALLOW_SIGN_UP=false
    ports:
      - "3000:3000"
    networks:
      - matrix-net
    depends_on:
      - prometheus

  alertmanager:
    image: prom/alertmanager:v0.25.0
    container_name: matrix-alertmanager
    restart: unless-stopped
    volumes:
      - ./alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml
      - alertmanager-data:/alertmanager
    ports:
      - "9093:9093"
    networks:
      - matrix-net

  node-exporter:
    image: prom/node-exporter:v1.6.0
    container_name: matrix-node-exporter
    restart: unless-stopped
    command:
      - '--path.rootfs=/host'
    volumes:
      - '/:/host:ro,rslave'
    pid: host
    networks:
      - matrix-net

volumes:
  prometheus-data:
  grafana-data:
  alertmanager-data:

Error response from daemon: Get https://registry-1.docker.io/v2/: dial tcp: i/o timeout

# 配置阿里云镜像加速器
sudo vim /etc/docker/daemon.json
# 添加 registry-mirrors（见 3.3 节）
sudo systemctl restart docker

docker ps -a
# conduit 状态为 Exited (1)

# 查看日志
docker logs matrix-conduit

# 常见原因：
# 1. CONDUIT_SERVER_NAME 未设置
# 2. 端口被占用
# 3. 数据目录权限问题

# 解决方案：
docker compose down
# 检查 docker-compose.yml 配置
docker compose up -d

curl https://matrix.example.com
# curl: (60) SSL certificate problem

# 检查证书文件
ls -la ./ssl/

# 重新获取证书
docker run --rm -it certbot/certbot renew

# 重启 Nginx
docker compose restart nginx

{
  "errcode": "M_UNKNOWN",
  "error": "Server blocked new registrations"
}

# 编辑 conduit.toml
vim conduit.toml

# 添加/修改配置
[global]
allow_registration = true

# 重启 Conduit
docker compose restart conduit

# 其他服务器无法连接
curl https://matrix.example.com:8448
# Connection refused

# 检查 8448 端口是否开放
netstat -tlnp | grep 8448

# 检查防火墙
sudo ufw allow 8448/tcp

# 检查 Nginx 配置
docker compose exec nginx nginx -t
docker compose restart nginx

# 检查 DNS 记录
dig SRV _matrix._tcp.matrix.example.com

{
  "errcode": "M_TOO_LARGE",
  "error": "Event too large"
}

# 增加 Nginx 客户端大小限制
vim ./nginx/conf.d/matrix.conf

# 添加/修改
client_max_body_size 100M;

# 重启 Nginx
docker compose restart nginx

docker stats
# conduit 内存 > 500MB

# 限制容器内存
vim docker-compose.yml

# 添加
deploy:
  resources:
    limits:
      memory: 1G

# 优化 RocksDB 配置（见 6.1 节）

# 重启服务
docker compose up -d

du -sh ./logs/*
# 日志文件 > 10GB

# 配置日志轮转
vim docker-compose.yml

# 添加
logging:
  driver: "json-file"
  options:
    max-size: "100m"
    max-file: "3"

# 清理旧日志
docker compose down
rm -rf ./logs/*
docker compose up -d

curl https://matrix.example.com
# 502 Bad Gateway

# 检查 Conduit 是否运行
docker ps | grep conduit

# 查看 Nginx 错误日志
docker compose exec nginx tail -f /var/log/nginx/error.log

# 常见原因：
# 1. Conduit 未启动
# 2. 网络不通
# 3. 超时配置过短

# 增加超时时间
vim ./nginx/conf.d/matrix.conf
# proxy_read_timeout 120s;

docker compose restart nginx

# 浏览器提示证书过期

# 自动续期（推荐）
docker run --rm -it \
  -v $(pwd)/ssl:/etc/letsencrypt \
  -v $(pwd)/certbot:/var/www/certbot \
  certbot/certbot renew

# 设置定时任务
sudo crontab -e
# 0 0 1 * * docker run --rm certbot/certbot renew

# 手动续期
docker run --rm -it certbot/certbot renew --force-renewal