### Download and Install Conduit Binary

Source: https://docs.conduit.rs/deploying/generic.html

Download the appropriate Conduit binary for your system architecture and make it executable. This is a quick way to get Conduit running.

```bash
$ sudo wget -O /usr/local/bin/matrix-conduit <url>
$ sudo chmod +x /usr/local/bin/matrix-conduit
```

--------------------------------

### Enable Caddy Service

Source: https://docs.conduit.rs/deploying/generic.html

Enable the Caddy service to start automatically on system boot.

```bash
$ sudo systemctl enable caddy
```

--------------------------------

### Start Conduit Service

Source: https://docs.conduit.rs/deploying/generic.html

Start the Conduit service. This command assumes Conduit has been installed and configured.

```bash
$ sudo systemctl start conduit
```

--------------------------------

### Enable Conduit Service

Source: https://docs.conduit.rs/deploying/generic.html

Enable the Conduit service to start automatically on system boot.

```bash
$ sudo systemctl enable conduit
```

--------------------------------

### Install Conduit Build Dependencies

Source: https://docs.conduit.rs/deploying/generic.html

Install necessary development dependencies for compiling Conduit from source on Debian or RHEL-based systems.

```bash
# Debian
$ sudo apt install libclang-dev build-essential

# RHEL
$ sudo dnf install clang
```

--------------------------------

### Configure Apache Proxy for Conduit

Source: https://docs.conduit.rs/deploying/generic.html

Example Apache configuration for proxying requests to Conduit. This requires `mod_proxy` and `mod_proxy_http` to be enabled.

```apache
# Requires mod_proxy and mod_proxy_http
#
# On Apache instance compiled from source,

```

--------------------------------

### Build and Run Conduit with Docker Compose

Source: https://docs.conduit.rs/deploying/docker.html

Builds the Conduit Docker image using Docker Compose and starts the container. Use the '-d' flag to run in detached mode.

```bash
docker compose up
```

```bash
docker compose up -d
```

--------------------------------

### Run Conduit Docker Container

Source: https://docs.conduit.rs/deploying/docker.html

Runs a Conduit Docker container in detached mode. This example configures server name, database backend, registration, federation, request size, trusted servers, concurrent requests, and port. It also mounts a volume for database persistence.

```bash
docker run -d -p 8448:6167 \
  -v db:/var/lib/matrix-conduit/ \
  -e CONDUIT_SERVER_NAME="your.server.name" \
  -e CONDUIT_DATABASE_BACKEND="rocksdb" \
  -e CONDUIT_ALLOW_REGISTRATION=true \
  -e CONDUIT_ALLOW_FEDERATION=true \
  -e CONDUIT_MAX_REQUEST_SIZE="20000000" \
  -e CONDUIT_TRUSTED_SERVERS="[\"matrix.org\"]" \
  -e CONDUIT_MAX_CONCURRENT_REQUESTS="100" \
  -e CONDUIT_PORT="6167" \
  --name conduit <link>
```

--------------------------------

### Configure Media Backend

Source: https://docs.conduit.rs/configuration.html

Sets the media storage backend. The 'filesystem' backend is the default.

```toml
[global.media]
backend = "filesystem" # the default backend
```

--------------------------------

### Filesystem Backend Custom Path and Directory Structure

Source: https://docs.conduit.rs/configuration.html

Configure a custom base directory for media storage and specify the depth and length for subdirectory creation. This allows for organized storage of media files.

```toml
[global.media]
backend = "filesystem"
path = "/srv/matrix-media"

[global.media.directory_structure]
depth = 4
length = 2


```

--------------------------------

### Configure TURN Server Settings

Source: https://docs.conduit.rs/print.html

Configure global TURN server settings by specifying URIs, and either a static authentication secret or username and password. Ensure the `your.turn.url` matches your Coturn server's REALM setting.

```toml
[global.turn]
uris = ["turn:your.turn.url?transport=udp", "turn:your.turn.url?transport=tcp"]
secret = "ADD SECRET HERE"

# If you have your TURN server configured to use a username and password
# you can provide these information too. In this case comment out `turn_secret above`!
#username = ""
#password = ""
```

--------------------------------

### Filesystem Backend Default Configuration

Source: https://docs.conduit.rs/configuration.html

Use this configuration when the default media storage path and directory structure are acceptable. No explicit configuration is needed for the directory structure if defaults are desired.

```toml
[global.media]
backend = "filesystem"

[global.media.directory_structure]


```

--------------------------------

### Conduit Well-Known Endpoint Traefik Labels

Source: https://docs.conduit.rs/deploying/docker-compose.override.yml

Configure Traefik to route requests for the Matrix well-known endpoint. This setup requires the same Traefik network and domain configuration as the homeserver.

```yaml
labels:
  - "traefik.enable=true"
  - "traefik.docker.network=proxy"

  - "traefik.http.routers.to-matrix-wellknown.rule=Host(`<SUBDOMAIN>.<DOMAIN>`) && PathPrefix(`/.well-known/matrix`)"
  - "traefik.http.routers.to-matrix-wellknown.tls=true"
  - "traefik.http.routers.to-matrix-wellknown.tls.certresolver=letsencrypt"
  - "traefik.http.routers.to-matrix-wellknown.middlewares=cors-headers@docker"

  - "traefik.http.middlewares.cors-headers.headers.accessControlAllowOriginList=*"
  - "traefik.http.middlewares.cors-headers.headers.accessControlAllowHeaders=Origin, X-Requested-With, Content-Type, Accept, Authorization"
  - "traefik.http.middlewares.cors-headers.headers.accessControlAllowMethods=GET, POST, PUT, DELETE, OPTIONS"
```

--------------------------------

### Configure TURN Server with Username and Password

Source: https://docs.conduit.rs/turn.html

Alternatively, configure the TURN server using username and password authentication. Comment out the 'secret' setting when using this method.

```toml
# If you have your TURN server configured to use a username and password
# you can provide these information too. In this case comment out `turn_secret above`!
#username = ""
#password = ""
```

--------------------------------

### Coturn Configuration File

Source: https://docs.conduit.rs/deploying/docker.html

This is the basic configuration file for the Coturn TURN server. Replace `<a secret key>` and `<your server domain>` with your specific values. A common way to generate a secret key is using `pwgen -s 64 1`.

```ini
use-auth-secret
static-auth-secret=<a secret key>
realm=<your server domain>
```

--------------------------------

### Configure Filesystem Media Path and Directory Structure

Source: https://docs.conduit.rs/print.html

Sets the base path for media storage and configures the depth and length of sub-directories for organizing media files.

```toml
[global.media]
backend = "filesystem"
path = "/srv/matrix-media"

[global.media.directory_structure]
depth = 4
length = 2

```

--------------------------------

### Configure S3 Media Backend

Source: https://docs.conduit.rs/print.html

Set up the S3 backend for media storage, specifying endpoint, bucket, region, access keys, and duration for signed requests. `bucket_use_path` controls how the bucket name is incorporated into the file path.

```toml
__
[global.media]
backend = "s3"
endpoint = "http://minio:9000"
bucket = "test"
region = "minio"
key = "<s3_key>"
secret = "<s3_secret>"
duration = 15
bucket_use_path = false

```

--------------------------------

### Client Delegation JSON for /.well-known/matrix/client

Source: https://docs.conduit.rs/delegation.html

Serve this JSON response for `/.well-known/matrix/client` to allow clients to discover how to access your domain. Ensure `matrix.example.org` is replaced with your actual accessible URL.

```json
{
  "m.homeserver": {
    "base_url": "https://matrix.example.org"
  }
}

```

--------------------------------

### Run Coturn Docker Container

Source: https://docs.conduit.rs/deploying/docker.html

This command runs the Coturn TURN server as a Docker container, mounting the local `coturn.conf` file to the container's configuration path. It uses host networking for direct access.

```bash
docker run -d --network=host -v $(pwd)/coturn.conf:/etc/coturn/turnserver.conf coturn/coturn
```

--------------------------------

### Server Delegation JSON for /.well-known/matrix/server

Source: https://docs.conduit.rs/delegation.html

Serve this JSON response for `/.well-known/matrix/server` to allow servers to discover how to access your domain. Ensure `matrix.example.org` and `443` are replaced with your actual domain and port.

```json
{
  "m.server": "matrix.example.org:443"
}

```

--------------------------------

### Configure TLS Certificates

Source: https://docs.conduit.rs/configuration.html

Specify the paths to your TLS certificate and key files for secure connections.

```toml
__
[global.tls]
certs = "/path/to/cert.pem"
key = "/path/to/key.pem"

```

--------------------------------

### Caddyfile Configuration for Conduit

Source: https://docs.conduit.rs/deploying/generic.html

Create this file and enter the configuration, substituting your server name.

```caddy
your.server.name, your.server.name:8448 {
        reverse_proxy /_matrix/* 127.0.0.1:6167
}
```

--------------------------------

### Configure TURN Server URIs and Secret

Source: https://docs.conduit.rs/turn.html

Specify the TURN server URIs, including transport protocol, and the static authentication secret. Ensure the 'your.turn.url' matches your Coturn server's REALM setting.

```toml
[global.turn]
uris = ["turn:your.turn.url?transport=udp", "turn:your.turn.url?transport=tcp"]
secret = "ADD SECRET HERE"
```

--------------------------------

### S3 Backend Configuration

Source: https://docs.conduit.rs/configuration.html

Configure the S3 backend for media storage, specifying endpoint, bucket details, credentials, and request duration. Ensure the bucket exists and credentials have access.

```toml
[global.media]
backend = "s3"
endpoint = "http://minio:9000"
bucket = "test"
region = "minio"
key = "<s3_key>"
secret = "<s3_secret>"
duration = 15
bucket_use_path = false


```

--------------------------------

### Set Conduit Database Directory Permissions

Source: https://docs.conduit.rs/deploying/generic.html

Create and set ownership/permissions for the Conduit database directory if using the default path, ensuring the Conduit user can write to it.

```bash
sudo mkdir -p /var/lib/matrix-conduit/
sudo chown -R conduit:conduit /var/lib/matrix-conduit/
sudo chmod 700 /var/lib/matrix-conduit/
```

--------------------------------

### Compile Conduit from Source

Source: https://docs.conduit.rs/deploying/generic.html

Compile the Conduit server in release mode after navigating to the source code directory. This is an alternative to downloading pre-compiled binaries.

```bash
$ cargo build --release
```

--------------------------------

### TLS Certificate Configuration

Source: https://docs.conduit.rs/configuration.html

Configure TLS settings by providing paths to the public PEM certificate and the private key. This is essential for enabling HTTPS.

```toml
[[tls.certs]]
cert = "path/to/public.pem"
key = "path/to/private.key"

```

--------------------------------

### Minimal Conduit Configuration

Source: https://docs.conduit.rs/print.html

This is a basic configuration file for Conduit. Remember to replace placeholder values with your specific settings, such as server name and registration token.

```toml
[global]
# YOU NEED TO EDIT THIS
#server_name = "your.server.name"

database_backend = "rocksdb"
# This is the only directory where Conduit will save its data
database_path = "/var/lib/matrix-conduit/"

# The port Conduit will be running on. You need to set up a reverse proxy in
# your web server (e.g. apache or nginx), so all requests to /_matrix on port
# 443 and 8448 will be forwarded to the Conduit instance running on this port
# Docker users: Don't change this, you'll need to map an external port to this.
port = 6167

# Max size for uploads
max_request_size = 20_000_000 # in bytes

# Enables registration. If set to false, no users can register on this server.
allow_registration = true

# A static registration token that new users will have to provide when creating
# an account. YOU NEED TO EDIT THIS.
# - Insert a password that users will have to enter on registration
# - Start the line with '#' to remove the condition
registration_token = ""

allow_check_for_updates = true
allow_federation = true

# Enable the display name lightning bolt on registration.
enable_lightning_bolt = true

# Servers listed here will be used to gather public keys of other servers.
# Generally, copying this exactly should be enough. (Currently, Conduit doesn't
# support batched key requests, so this list should only contain Synapse
# servers.)
trusted_servers = ["matrix.org"]

#max_concurrent_requests = 100 # How many requests Conduit sends to other servers at the same time

# Controls the log verbosity. See also [here][0].
#
# [0]: https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#directives
#log = "..."

address = "127.0.0.1" # This makes sure Conduit can only be reached using the reverse proxy
#address = "0.0.0.0" # If Conduit is running in a container, make sure the reverse proxy (ie. Traefik) can reach it.

[global.well_known]
# Conduit handles the /.well-known/matrix/* endpoints, making both clients and servers try to access conduit with the host
# server_name and port 443 by default.
# If you want to override these defaults, uncomment and edit the following lines accordingly:
#server = your.server.name:443
#client = https://your.server.name

```

--------------------------------

### Configure Global Proxy

Source: https://docs.conduit.rs/configuration.html

Set a global proxy URL to route all outgoing requests through a specific server.

```toml
__
[global.proxy.global]
url = "https://example.com"

```

--------------------------------

### Set Conduit Configuration Permissions

Source: https://docs.conduit.rs/deploying/generic.html

Set appropriate ownership and permissions for the Conduit configuration directory to ensure the Conduit user can read the configuration file.

```bash
sudo chown -R root:root /etc/matrix-conduit
sudo chmod 755 /etc/matrix-conduit
```

--------------------------------

### Configure Apache for Cloudflare Delegation

Source: https://docs.conduit.rs/deploying/generic.html

Set up Apache to handle .well-known delegation for Cloudflare, allowing federation traffic to be routed to port 443 when Cloudflare's free plan doesn't support port 8448.

```apache
# .well-known delegation on Apache
<Files "/.well-known/matrix/server">
    ErrorDocument 200 '{"m.server": "your.server.name:443"}'
    Header always set Content-Type application/json
    Header always set Access-Control-Allow-Origin *
</Files>
```

--------------------------------

### Apache Configuration for Conduit

Source: https://docs.conduit.rs/deploying/generic.html

Paste this configuration into your httpd-ssl.conf or httpd.conf file. Remember to edit 'your.server.name'.

```apache
Listen 8448

<VirtualHost *:443 *:8448>

ServerName your.server.name # EDIT THIS

AllowEncodedSlashes NoDecode
ProxyPass /_matrix/ http://127.0.0.1:6167/_matrix/ timeout=300 nocanon
ProxyPassReverse /_matrix/ http://127.0.0.1:6167/_matrix/

</VirtualHost>
```

--------------------------------

### Configure Media Retention Policies

Source: https://docs.conduit.rs/print.html

Define retention policies for media files to manage storage space. Policies can be set globally or per scope (local, remote, thumbnail) based on access time, creation time, and maximum space usage. Media not meeting all criteria is deleted.

```toml
__
# Total of 40GB for all media
[[global.media.retention]] # Notice the double "[]", due to this being a table item in an array
space = "40G"

# Delete remote media not accessed for 30 days, or older than 90 days
[[global.media.retention]]
scope = "remote"
accessed = "30d"
created = "90days" # you can mix and match between the long and short format

# Delete local media not accessed for 1 year
[[global.media.retention]]
scope = "local"
accessed = "1y"

# Only store 1GB of thumbnails
[[global.media.retention]]
scope = "thumbnail"
space = "1GB"

```

--------------------------------

### Register Appservice with Conduit

Source: https://docs.conduit.rs/appservices.html

To register an appservice, send the registration YAML content to the @conduit bot in your homeserver's admin room. This is typically done after downloading and configuring the appservice.

```text
@conduit:your.server.name: register-appservice
paste
the
contents
of
the
yaml
registration
here
```

--------------------------------

### Minimal Conduit Server Configuration

Source: https://docs.conduit.rs/configuration.html

A basic configuration for Conduit, including database settings, port, and federation options. Remember to edit sensitive values.

```toml
__
[global]
# YOU NEED TO EDIT THIS
#server_name = "your.server.name"

database_backend = "rocksdb"
# This is the only directory where Conduit will save its data
database_path = "/var/lib/matrix-conduit/"

# The port Conduit will be running on. You need to set up a reverse proxy in
# your web server (e.g. apache or nginx), so all requests to /_matrix on port
# 443 and 8448 will be forwarded to the Conduit instance running on this port
# Docker users: Don't change this, you'll need to map an external port to this.
port = 6167

# Max size for uploads
max_request_size = 20_000_000 # in bytes

# Enables registration. If set to false, no users can register on this server.
allow_registration = true

# A static registration token that new users will have to provide when creating
# an account. YOU NEED TO EDIT THIS.
# - Insert a password that users will have to enter on registration
# - Start the line with '#' to remove the condition
registration_token = ""

allow_check_for_updates = true
allow_federation = true

# Enable the display name lightning bolt on registration.
enable_lightning_bolt = true

# Servers listed here will be used to gather public keys of other servers.
# Generally, copying this exactly should be enough. (Currently, Conduit doesn't
# support batched key requests, so this list should only contain Synapse
# servers.)
trusted_servers = ["matrix.org"]

#max_concurrent_requests = 100 # How many requests Conduit sends to other servers at the same time

# Controls the log verbosity. See also [here][0].
#
# [0]: https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#directives
#log = "..."

address = "127.0.0.1" # This makes sure Conduit can only be reached using the reverse proxy
#address = "0.0.0.0" # If Conduit is running in a container, make sure the reverse proxy (ie. Traefik) can reach it.

[global.well_known]
# Conduit handles the /.well-known/matrix/* endpoints, making both clients and servers try to access conduit with the host
# server_name and port 443 by default.
# If you want to override these defaults, uncomment and edit the following lines accordingly:
#server = your.server.name:443
#client = https://your.server.name

```

--------------------------------

### Conduit TOML Configuration for TURN

Source: https://docs.conduit.rs/deploying/docker.html

Configure Conduit's TOML file to use the TURN server. Ensure the `turn_uris` and `turn_secret` match your Coturn configuration.

```toml
turn_uris = ["turn:<your server domain>?transport=udp", "turn:<your server domain>?transport=tcp"]
turn_secret = "<secret key from coturn configuration>"
```

--------------------------------

### Conduit Docker Compose Configuration

Source: https://docs.conduit.rs/deploying/docker-compose.yml

This is the main docker-compose.yml file for setting up the Conduit homeserver. It specifies the image to use, restart policy, port mappings, volume for persistent data, and various environment variables for server configuration. Ensure you edit 'CONDUIT_SERVER_NAME' to your actual server domain.

```yaml
# Conduit
version: '3'

services:
    homeserver:
        ### If you already built the Conduit image with 'docker build' or want to use a registry image,
        ### then you are ready to go.
        image: matrixconduit/matrix-conduit:latest
        ### If you want to build a fresh image from the sources, then comment the image line and uncomment the
        ### build lines. If you want meaningful labels in your built Conduit image, you should run docker compose like this:
        ### CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ') VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml) docker compose up -d
        # build:
        #     context: .
        #     args:
        #         CREATED: '2021-03-16T08:18:27Z'
        #         VERSION: '0.1.0'
        #         LOCAL: 'false'
        #         GIT_REF: origin/master
        restart: unless-stopped
        ports:
            - 8448:6167
        volumes:
            - db:/var/lib/matrix-conduit/
        environment:
            CONDUIT_SERVER_NAME: your.server.name # EDIT THIS
            CONDUIT_DATABASE_PATH: /var/lib/matrix-conduit/
            CONDUIT_DATABASE_BACKEND: rocksdb
            CONDUIT_PORT: 6167
            CONDUIT_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
            CONDUIT_ALLOW_REGISTRATION: 'true'
            CONDUIT_ALLOW_FEDERATION: 'true'
            CONDUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
            CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
            #CONDUIT_MAX_CONCURRENT_REQUESTS: 100
            CONDUIT_ADDRESS: 0.0.0.0
            CONDUIT_CONFIG: '' # Ignore this
    #
    ### Uncomment if you want to use your own Element-Web App.
    ### Note: You need to provide a config.json for Element and you also need a second
    ###       Domain or Subdomain for the communication between Element and Conduit
    ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
    # element-web:
    #     image: vectorim/element-web:latest
    #     restart: unless-stopped
    #     ports:
    #         - 8009:80
    #     volumes:
    #         - ./element_config.json:/app/config.json
    #     depends_on:
    #         - homeserver

volumes:
    db:

```

--------------------------------

### Certbot SSL Certificate Generation

Source: https://docs.conduit.rs/deploying/generic.html

Use Certbot to obtain an SSL certificate for your server. This command assumes you have already configured Caddy or Nginx.

```bash
# To use ECC for the private key, 
# paste into /etc/letsencrypt/cli.ini:
# key-type = ecdsa
# elliptic-curve = secp384r1

$ sudo certbot -d your.server.name
```

--------------------------------

### Configure Apache Virtual Host for Conduit

Source: https://docs.conduit.rs/print.html

Set up an Apache virtual host to proxy requests to the Conduit server. This configuration listens on ports 443 and 8448 and forwards traffic to the local Conduit instance.

```apache
# Requires mod_proxy and mod_proxy_http
#
# On Apache instance compiled from source,
# paste into httpd-ssl.conf or httpd.conf

Listen 8448

<VirtualHost *:443 *:8448>

ServerName your.server.name # EDIT THIS

AllowEncodedSlashes NoDecode
ProxyPass /_matrix/ http://127.0.0.1:6167/_matrix/ timeout=300 nocanon
ProxyPassReverse /_matrix/ http://127.0.0.1:6167/_matrix/

</VirtualHost>
```

--------------------------------

### Configure Conduit Well-Known Delegation

Source: https://docs.conduit.rs/delegation.html

Use these options in the `global.well_known` table to configure Conduit to serve delegation files itself. This method is recommended if Conduit is on the same physical server as the server name.

```toml
[global.well_known]
client = "https://matrix.example.org"
server = "matrix.example.org:443"

```

--------------------------------

### Conduit Environment Variables for TURN

Source: https://docs.conduit.rs/deploying/docker.html

Alternatively, configure Conduit's TURN settings via environment variables. These values should correspond to your Coturn server's configuration.

```yaml
CONDUIT_TURN_URIS: '["turn:<your server domain>?transport=udp", "turn:<your server domain>?transport=tcp"]'
CONDUIT_TURN_SECRET: "<secret key from coturn configuration>"
```

--------------------------------

### Register Appservice via Admin Room

Source: https://docs.conduit.rs/print.html

Register an appservice by pasting its YAML registration content into the admin room. This command is executed by the @conduit bot.

```matrix-command
@conduit:your.server.name: register-appservice
<paste the contents of the yaml registration here>
```

--------------------------------

### Coturn Docker Compose Service

Source: https://docs.conduit.rs/deploying/docker.html

This Docker Compose configuration defines a service for running the Coturn TURN server. It maps the local `coturn.conf` and uses host networking.

```yaml
version: 3
services:
    turn:
      container_name: coturn-server
      image: docker.io/coturn/coturn
      restart: unless-stopped
      network_mode: "host"
      volumes:
        - ./coturn.conf:/etc/coturn/turnserver.conf
```

--------------------------------

### Build Conduit Docker Image

Source: https://docs.conduit.rs/deploying/docker.html

Builds the Conduit Docker image from the local source code. This command tags the resulting image as 'matrixconduit/matrix-conduit:latest'.

```bash
docker build --tag matrixconduit/matrix-conduit:latest .
```

--------------------------------

### Docker Compose Configuration for Conduit and Traefik

Source: https://docs.conduit.rs/deploying/docker-compose.with-traefik.yml

Defines the services for Conduit homeserver, Nginx for well-known files, and Traefik reverse proxy. Includes volume and network configurations, and environment variables for Conduit.

```yaml
version: '3'

services:
    homeserver:
        ### If you already built the Conduit image with 'docker build' or want to use the Docker Hub image,
        ### then you are ready to go.
        image: matrixconduit/matrix-conduit:latest
        ### If you want to build a fresh image from the sources, then comment the image line and uncomment the
        ### build lines. If you want meaningful labels in your built Conduit image, you should run docker compose like this:
        ### CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ') VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml) docker compose up -d
        # build:
        #     context: .
        #     args:
        #         CREATED: '2021-03-16T08:18:27Z'
        #         VERSION: '0.1.0'
        #         LOCAL: 'false'
        #         GIT_REF: origin/master
        restart: unless-stopped
        volumes:
            - db:/srv/conduit/.local/share/conduit
            ### Uncomment if you want to use conduit.toml to configure Conduit
            ### Note: Set env vars will override conduit.toml values
            # - ./conduit.toml:/srv/conduit/conduit.toml
        networks:
            - proxy
        environment:
            CONDUIT_SERVER_NAME: localhost:6167  # replace with your own name
            CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
            CONDUIT_ALLOW_REGISTRATION : 'true'
            ### Uncomment and change values as desired
            # CONDUIT_ADDRESS: 0.0.0.0
            # CONDUIT_PORT: 6167
            # CONDUIT_REGISTRATION_TOKEN: '' # require password for registration
            # CONDUIT_CONFIG: '/srv/conduit/conduit.toml'  # if you want to configure purely by env vars, set this to an empty string ''
            # Available levels are: error, warn, info, debug, trace - more info at: https://docs.rs/env_logger/*/env_logger/#enabling-logging
            # CONDUIT_ALLOW_ENCRYPTION: 'true'
            # CONDUIT_ALLOW_FEDERATION: 'true'
            # CONDUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
            # CONDUIT_DATABASE_PATH: /srv/conduit/.local/share/conduit
            # CONDUIT_MAX_REQUEST_SIZE: 20000000  # in bytes, ~20 MB

    # We need some way to server the client and server .well-known json. The simplest way is to use a nginx container
    # to serve those two as static files. If you want to use a different way, delete or comment the below service, here
    # and in the docker compose override file.
    well-known:
        image: nginx:latest
        restart: unless-stopped
        volumes:
            - ./nginx/matrix.conf:/etc/nginx/conf.d/matrix.conf # the config to serve the .well-known/matrix files
            - ./nginx/www:/var/www/ # location of the client and server .well-known-files

    ### Uncomment if you want to use your own Element-Web App.
    ### Note: You need to provide a config.json for Element and you also need a second
    ###       Domain or Subdomain for the communication between Element and Conduit
    ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
    # element-web:
    #     image: vectorim/element-web:latest
    #     restart: unless-stopped
    #     volumes:
    #         - ./element_config.json:/app/config.json
    #     networks:
    #         - proxy
    #     depends_on:
    #         - homeserver

    traefik:
        image: "traefik:latest"
        container_name: "traefik"
        restart: "unless-stopped"
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - "/var/run/docker.sock:/var/run/docker.sock"
            # - "./traefik_config:/etc/traefik"
            - "acme:/etc/traefik/acme"
        labels:
            - "traefik.enable=true"

            # middleware redirect
            - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
            # global redirect to https
            - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
            - "traefik.http.routers.redirs.entrypoints=http"
            - "traefik.http.routers.redirs.middlewares=redirect-to-https"

volumes:
    db:
    acme:

networks:
    proxy:

```

--------------------------------

### Docker Compose for Conduit and Traefik

Source: https://docs.conduit.rs/deploying/docker-compose.for-traefik.yml

Defines services for the Conduit homeserver and an Nginx helper for .well-known files. Ensure the 'proxy' network is defined externally and accessible by Traefik.

```yaml
version: '3'

services:
    homeserver:
        ### If you already built the Conduit image with 'docker build' or want to use the Docker Hub image,
        ### then you are ready to go.
        image: matrixconduit/matrix-conduit:latest
        ### If you want to build a fresh image from the sources, then comment the image line and uncomment the
        ### build lines. If you want meaningful labels in your built Conduit image, you should run docker compose like this:
        ### CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ') VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml) docker compose up -d
        # build:
        #     context: .
        #     args:
        #         CREATED: '2021-03-16T08:18:27Z'
        #         VERSION: '0.1.0'
        #         LOCAL: 'false'
        #         GIT_REF: origin/master
        restart: unless-stopped
        volumes:
            - db:/var/lib/matrix-conduit/
        networks:
            - proxy
        environment:
            CONDUIT_SERVER_NAME: your.server.name # EDIT THIS
            CONDUIT_DATABASE_PATH: /var/lib/matrix-conduit/
            CONDUIT_DATABASE_BACKEND: rocksdb
            CONDUIT_PORT: 6167
            CONDUIT_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
            CONDUIT_ALLOW_REGISTRATION: 'true'
            #CONDUIT_REGISTRATION_TOKEN: '' # require password for registration
            CONDUIT_ALLOW_FEDERATION: 'true'
            CONDUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
            CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
            #CONDUIT_MAX_CONCURRENT_REQUESTS: 100
            CONDUIT_ADDRESS: 0.0.0.0
            CONDUIT_CONFIG: '' # Ignore this

    # We need some way to server the client and server .well-known json. The simplest way is to use a nginx container
    # to serve those two as static files. If you want to use a different way, delete or comment the below service, here
    # and in the docker compose override file.
    well-known:
        image: nginx:latest
        restart: unless-stopped
        volumes:
            - ./nginx/matrix.conf:/etc/nginx/conf.d/matrix.conf # the config to serve the .well-known/matrix files
            - ./nginx/www:/var/www/ # location of the client and server .well-known-files
    ### Uncomment if you want to use your own Element-Web App.
    ### Note: You need to provide a config.json for Element and you also need a second
    ###       Domain or Subdomain for the communication between Element and Conduit
    ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
    # element-web:
    #     image: vectorim/element-web:latest
    #     restart: unless-stopped
    #     volumes:
    #         - ./element_config.json:/app/config.json
    #     networks:
    #         - proxy
    #     depends_on:
    #         - homeserver

volumes:
    db:

networks:
    # This is the network Traefik listens to, if your network has a different
    # name, don't forget to change it here and in the docker-compose.override.yml
    proxy:
        external: true

```

--------------------------------

### Media Retention Policies Configuration

Source: https://docs.conduit.rs/configuration.html

Define retention policies to automatically delete media files based on access time, creation time, or space constraints. Policies can be scoped to 'local', 'remote', or 'thumbnail'.

```toml
# Total of 40GB for all media
[[global.media.retention]] # Notice the double "[]", due to this being a table item in an array
space = "40G"

# Delete remote media not accessed for 30 days, or older than 90 days
[[global.media.retention]]
scope = "remote"
accessed = "30d"
created = "90days" # you can mix and match between the long and short format

# Delete local media not accessed for 1 year
[[global.media.retention]]
scope = "local"
accessed = "1y"

# Only store 1GB of thumbnails
[[global.media.retention]]
scope = "thumbnail"
space = "1GB"


```

--------------------------------

### Configure Domain-Specific Proxy

Source: https://docs.conduit.rs/configuration.html

Proxy requests to specific domains using include and exclude patterns. Supports glob matching.

```toml
__
[[global.proxy.by_domain]]
url = "socks5://localhost:9050"
include = ["*.onion", "matrix.secretly-an-onion-domain.xyz"]
exclude = ["*.clearnet.onion"]

```

--------------------------------

### CORS Headers for Client Delegation Endpoint

Source: https://docs.conduit.rs/delegation.html

It is recommended to set these CORS headers for the `/.well-known/matrix/client` endpoint to ensure all clients can access it.

```http
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Authorization

```

--------------------------------

### Create Conduit System User

Source: https://docs.conduit.rs/deploying/generic.html

Create a dedicated system user for Conduit to manage permissions and security. This command is suitable for Debian or RHEL systems.

```bash
sudo adduser --system conduit --group --disabled-login --no-create-home
```

--------------------------------

### Conduit systemd Service Configuration

Source: https://docs.conduit.rs/deploying/generic.html

Configure a systemd service file for Conduit to manage its lifecycle, including automatic startup on boot and restarting on failure. Ensure the CONDUIT_CONFIG path is correct.

```systemd
[Unit]
Description=Conduit Matrix Server
After=network.target

[Service]
Environment="CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml"
User=conduit
Group=conduit
Restart=always
ExecStart=/usr/local/bin/matrix-conduit

[Install]
WantedBy=multi-user.target
```

--------------------------------

### Element-Web Traefik Labels (Commented Out)

Source: https://docs.conduit.rs/deploying/docker-compose.override.yml

These Traefik labels are for routing traffic to the Element-Web client. They are commented out and should be uncommented if Element-Web is enabled in your docker-compose.yml.

```yaml
labels:
  - "traefik.enable=true"
  - "traefik.docker.network=proxy"  # Change this to the name of your Traefik docker proxy network

  - "traefik.http.routers.to-element-web.rule=Host(`<SUBDOMAIN>.<DOMAIN>`)"  # Change to the address on which Element-Web is hosted
  - "traefik.http.routers.to-element-web.tls=true"
  - "traefik.http.routers.to-element-web.tls.certresolver=letsencrypt"
```

--------------------------------

### Reload Apache Service

Source: https://docs.conduit.rs/deploying/generic.html

Reload the Apache service after modifying its configuration.

```bash
# Debian
$ sudo systemctl reload apache2

# Installed from source
$ sudo apachectl -k graceful
```