Does restarting your router help in these moments? Might just be an underpowered router
Do your devices use the router’s DNS? If so is it still reachable? From the client? From the router machine?
Might be some kind of DHCP bug too but I’m not well versed in it
I don’t think they require Nextcloud. Consider LaSuite Docs too if you need something simpler
FWIW, you can use Headscale’s embedded DERP server, or host your own. They need a STUN port and an HTTPS port
Ntfy can send/receive notifications to/from the phone. You can selfhost it or use a public instance. For the healthcheck app, consider Uptime Kuma as it has ntfy integration. But a simple cron script that monitors + cURLing ntfy when it fails could also be used.
Protocol-wise, OIDC is generally the most supported out there. LDAP too, to an extent.
Software wise, I find Kanidm quite simple to set up (basically just one container). It’s mostly managed via the terminal though, and lacks some eyecandy. But some of the examples in its docs should be easy to follow and get you familiar with mapping scopes/groups between Kanidm and services.
Authelia is okay too
I believe as of now, the databases do not diverge and hence a binary swap/container image swap is doable. If you already set up SSO logins, then I’m not sure because Continuwuity doesn’t support that yet.
Please re-ask the question with the folks in #continuwuity:continuwuity.org to be extra sure before doing anything. Oh and without saying, do clone and backup the data paths for easy reverts later
It’s claimed to be official. But I went with https://continuwuity.org/ since it seemed to have a more active community. Plus ever since then, the core maintainer of Tuwunel has been making threats against Continuwuity including personal attacks, and seems to be quite unpleasant to deal with in general. There’s also been a thread about it here. So I honestly lost all taste to reconsider.
For Matrix consider Continuwuity instead of Synapse if you want something easier to maintain. You’ll also want to set up Element Call (i.e. the “new” calling stack) for wider client support.
Notifications can be unreliable but it depends on your push provider (e.g. don’t use the default ntfy.sh instance, use another one or selfhost yours). Do let me know of any other nits though.
For XMPP, notifications is most reliable as it maintains an in-band connection to the server. A/V is a bit more lacking, as mobile clients can only do 1:1 calls, and it misses some smaller features compared to matrix. But it’s very lightweight and should be more than capable for use with family and friends.
Look into DNS-01 challenge where instead of exposing 80/443, you obtain a cert by creating a TXT record for your domain. This requires your ACME client to support talking to your DNS provider’s API. For certbot they’re installable via plugins, for lego-acme many providers are included.
most of the guides can be outdated because the software changes a lot. You’d find some better support writing on their Discord guild
Caddy supports the HTTP-01 and TLS-ALPN-01 challenges by default, you just need to expose 80/443 and it just works. But if you want to use the DNS-01 challenge you’d need to build it with a plugin of your DNS provider.
Traefik supports all 3 challenges equally ootb, with a wide range of DNS providers. But it is a bit harder to configure and doesn’t support being a web server.
I wanna reshare my experiences here. Essentially it doesn’t scale well with large rooms, and isn’t friendly with janky/underpowered equipment like XMPP. But with a lot of performance tuning it can go a long way.
For a room, the amount of servers you federate with is a more reliable metric than member count (so 5000 accounts on 2 servers would likely take less load than 500 accounts on 500 servers, as an example). There are some large public rooms that are very broken, and I advise banning them before users get to join
The easy solution is to choose someone other than matrix.org, get everyone over there, and hope it works out in the long run
The technical answer is that if you own your domain name you can migrate from a managed solution to a selfhosted one with some caveats. If you can’t migrate the database, then some data will be lost (namely, unfederated rooms and local-only data) and your friends will likely need to do a few things (reset their passwords, and export/reimport their encryption keys). Unfortunately there are no database migrator between different server software right now
We are (like everyone) on matrix.org now but realize we need to move eventually.
Consider moving to another open registration server too. Find one that supports Element Call
do I need to pay for a domain still?
If you’re gonna selfhost, you should purchase a domain for proper federation with the wider network. IP-only servers are possible, but they are generally banned in most rooms due to antispam. Same with dynamic DNS domains
Unless it really is easy enough to do it on a synology nas for text/voice/screen share…
You’ll need to integrate a Matrix homeserver (I recommend Continuwuity.org, much lighter than Synapse) and Livekit (the software that handle Element Calls). It’s not particularly easy so maybe consider managed hosting beforehand, too
You can try Snikket.org, which is basically Prosody but easier. But you can’t selfhost “on each person’s own computers” as you said because you’d still need a publicly exposable IP addresses and high uptime. Maybe you could try registering on an XMPP or Matrix instance you like and migrate your community over there first
Question for others: is Prosody’s (and XMPP’s) group calls really good? I’m under the impression that Matrix (with Element Call) is currently better due to the SFU architecture, but I’d be happy to be proven otherwise. I’m interested to hear required specs, how large the calls can be, and how much strain it puts on the TURN server and clients especially when it comes to multiparty streaming
AFAIK the Movim people are working on SFU calls too, but not soon
If you want a non-federating LAN-only Matrix server, then STUN/TURN can be behind the NAT. Since you have Tailscale, STUN/TURN can also expose itself on the Tailscale VPN too. Just configure proper DNS records per-interface and you should be fine.
Since calls are p2p, the purpose of STUN is to determine a client’s (usually public) IP address, and TURN is to relay the connection if they can’t connect directly (i.e. behind NAT). If your clients are on the same LAN/VPN with unrestrictive firewalls then you might not even need any STUN/TURN altogether.
Conduwuit (predecessor of Continuwuity and Tuwunel) hard-forked from Conduit and introduced breaking database changes. That is a significant people don’t easily “switch over”
I would say its pace of development is very slow compared to the pace of Matrix in general. But if you only want the barebones features, you can use it.
Feature-wise, Continuwuity offers email support, single-use registration token, policy server integration, user suspending, a ton more of admin commands, and some extra endpoints for Element Call. It is also actively working on OIDC-OAuth (so you can login with your IDP), and an ecosystem-wide Admin API. It also has an active community. I can’t speak for the other fork.
Lastly, I don’t think anyone “hate” conduit, the project is alright. It’s just not the topmost option.