I just came across this guide for selfhosting a matrix server but I
don't understand why you need to set up ssh though cloudflare tunnels.
Is it compulsory to do so?
reddit / selfhosted

----------------------------------------------------------------------
Pico_me · 2023-12-13 08:24

https://zerodya.net/all-your-chats-in-one-app-with-matrix/

----------------------------------------------------------------------
daedric · 2023-12-13 08:45

No. Cloudflare is not mandatory for Matrix... it's actually
unadvisable as you're basically doing a MITM to yourself (Clouldflare
will decrypt all traffic, and encrypt it again, being able to read it
meanwhile).

All you need is a Matrix Server (Synapse, Conduit etc) and a bridge
for each of your selected chat networks.

A advice: Matrix is not a simple network. It's complex and convulated.
If you go down this line, make sure Matrix is working ok before
attempting to launch bridged. You can also go down the Beeper route
(basically Synapse + Bridges + some extras), either the official one,
or https://github.com/beeper/self-host

----------------------------------------------------------------------
StillParticular5602 · 2023-12-13 09:15

I ran a matrix server for a couple of months and it was a good and
interesting experience.  The best video tutorial I came across was
this one from the founder of Matrix.  It is old and you don't need to
do the Jitsi integration anymore but it give you a great overview and
understanding of what is required to get it up and running.  [https://
www.youtube.com/watch?v=dDddKmdLEdg&t=228s](https://www.youtube.com/wa
tch?v=dDddKmdLEdg&t=228s)

The other thing I learnt was that Matrix is very heavily dependent on
continuous DNS resolution and your upstream DNS provider can block you
due to excessive queries.  The way to overcome this is to ensure you
have a solid DNS cache on your local network that caches queries and
cuts down the requirement to access the Internet or ISP DNS servers
for every query.  Something like DNSmasq is a good choice with the
DHCP server disabled.  In my case, I used Mikrotik routers and they
come with an inbuilt, configurable DNS cache and I just allocated more
storage to the DNS server to compensate.

u/daedric is also spot on with his assessment.

----------------------------------------------------------------------
Pico_me · 2023-12-13 09:47

I like want to know if i have to do the ssh tunnel though cloudflare.
I am still going to be using cloudflare for matrix as I can't port
forward

----------------------------------------------------------------------
FuriousRageSE · 2023-12-13 14:29

You only need a service like CF tunnels, if you are behind for example
CGNat, or cannot control stuff like open ports to the world etc, then
the tunnel helps you by-pass this, by connecting out (to CF side) and
use CF open ports to get to your server behind CGNAT and/or locked
ports.

----------------------------------------------------------------------
Old-Satisfaction-564 · 2023-12-13 18:16

I run it behind a wireguard tunnel in docker-compose so that it is
completely isolated and all traffic goes through the tunnel.

Sometimes matrix nodes are DDoSed by bad guys or flaws in the
protocol, using a tunnel is a wise idea to protect your internet
connection since it is easy to limit or drop the tunnel in case of
attack.