Category: Howto

Setting up a Matrix server for Secure Encrypted Communications through almost all the channels you and your friends use.

With all the privacy issues these days I decided to check out alternatives to using standard services.

With that I found Matrix which allows for a secure ‘slack like’ service that also has ‘bridges’ that let you connect to iMessage, Slack, Signal, Facebook even Twitter and Instagram.

I have not fully configured this, this is mainly for my records purposes and I stole most of this from the excellent article I found called Running your own secure communication service with Matrix and Jitsi.

First I setup a Debian VPS over at Vultr (affiliate link). Which this assumes you’ve already done too.

So let’s begin!

First ssh to your server and update, upgrade, and install nginx.

apt-get update && apt -y install nginx lsb-release wget apt-transport-https

cd /etc/nginx/sites-enabled
rm default 
cp ../sites-available/default yourdomain.com
cp ../sites-available/default matrix.yourdomain.com
cp ../sites-available/default riot.yourdomain.com

Now we’re going to configure our settings. You should have a domain picked out already. In our example we’ll use ‘mydomain.com’ but this will obviously have to change.

First, you’re going to want to login to your DNS Registrar and setup these records. These will all have to be A Records.

  • TYPE: A IP: 190.190.190.1 POINTS TO: yourdomain.com
  • TYPE: A IP: 190.190.190.1 POINTS TO: matrix.yourdomain.com
  • TYPE: A IP: 190.190.190.1 POINTS TO: riot.yourdomain.com
  • TYPE: A IP: 190.190.190.1 POINTS TO: jitsi.yourdomain.com

** NOTE YOU WILL HAVE TO CHANGE ‘YOURDOMAIN.COM’ AND IP ADDRESS TO MATCH YOUR SETTINGS.

Once that is done we can continue with the rest of the setup. While you’re doing this the DNS records should propagate.

Now we’re going to need to edit each of our files in /etc/nginx/sites-available/

cd /etc/nginx/sites-available 
nano *

And in each file make it look like this, changing the domain and the path. Note that in the matrix configuration the location is proxy_pass instead of a directory.

matrix.yourdomain.com:

server {
        listen 80;
        listen [::]:80;
        root /var/www/matrix;
        index index.html index.htm;
        server_name matrix.yourdomain.com;
        location / {
                proxy_pass http://localhost:8008;
        }
}

yourdomain.com:

server {
        listen 80;
        listen [::]:80;
        root /var/www/html;
        index index.html index.htm;
        server_name yourdomain.com;
        location / {
                try_files $uri $uri/ =404;
        }
}

riot.yourdomain.com:

server {
        listen 80;
        listen [::]:80;
        root /var/www/riot;
        index index.html index.htm;
        server_name riot.yourdomain.com;
        location / {
                try_files $uri $uri/ =404;
        }
}

Now we go ahead and install certbot, and generate the certificates for your hosts with nginx. This gives you secure SSL connections on every new site you just created.

apt install -y python3-certbot-nginx && certbot --nginx -d yourdomain.com -d riot.yourdomain.com -d matrix.yourdomain.com

Now you can go ahead and create the directories you need.

cd /var/www
mkdir riot
mkdir matrix

Now we create the ‘.well-known’ file for the connector to authenticate your domain when you start everything up. You will have to modify your domain in the last command.

mkdir -p /var/www/html/.well-known/matrix
cd /var/www/html/.well-known/matrix
echo '{ "m.server": "matrix.yourdomain.com:443" }' > server

Now we get element (riot) going.

cd /var/www/riot
wget https://github.com/vector-im/element-web/releases/download/v1.7.22/element-v1.7.22.tar.gz
apt install -y gnupg
tar xzvf element-v1.7.22.tar.gz
ln -s element-v1.7.22 element
chown www-data:www-data -R riot

At this point you should be able to start nginx up and visit your domain to set everything up.

systemctl restart nginx 

Now open a browser and hit this url

https://riot.yourdomain.com

There you will make your account. Next we’ll setup Jitsi for video conferencing capabilities. First get the repository added.

echo 'deb https://download.jitsi.org stable/' >> /etc/apt/sources.list.d/jitsi-stable.list

Now install the gpg key needed.

wget -qO -  https://download.jitsi.org/jitsi-key.gpg.key | sudo apt-key add -

Now go ahead and update, and install Jitsi

apt-get update

During the installer you will want to make sure you give the installer the hostname of ‘jitsi.yourdomain.com‘ and make SURE the DNS is already setup (step 2 way up there) otherwise it _will_ fail on you here.

apt-get -y install jitsi-meet

Then you’re going to want to secure it using the provided script.

/usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh

After this, you should now be able to connect to the Jitsi server running on your domain by visiting it’s URL in your browser.

https://jitsi.yourdomain.com/

Now you’re going to want to set up Riot to use Jitsi. You can do this by performing the following.

nano /var/www/riot/config.json

Then change the ‘preferredDomain’ to your server. Change this block

"jitsi": {
        "preferredDomain": "https://jitsi.riot.im"
    }

To this instead

"jitsi": {
        "preferredDomain": "https://jitsi.yourdomain.com"
    }

That’s it. Just refresh your Riot screen in your browser and you are now ready to use Jitsi from within your server. No need for an integration manager to embed Jitsi!

Under the bridge downtown

Next we’re going to install some bridges.

I have not fully configured these (or any of this!!) again just noting this for future when I do have time to configure it fully and maybe it will help someone else!

Next, we’re going to install some bridge. So first off for the install we’re going to install a bunch of prerequisites.

sudo apt install python3 python3-venv
sudo apt install virtualenv python3-virtualenv
sudo apt install git
sudo apt install build-essential
sudo apt install python3-dev
sudo apt install python-olm 

Now add this to your source.list

nano /etc/apt/sources.list 

Paste this in

deb http://deb.debian.org/debian buster-backports main

Then you can install some more software you need.

sudo apt-get update 
sudo apt-get install libolm3/buster-backports
sudo apt-get install libolm-dev/buster-backports

Now configure your locales

dpkg-reconfigure locales

Configure all locales, and choose the default. Now we are ready to install whichever branch of the bridges we want to use. I’ll outline those below.

MASTER BRANCHES:

pip install --upgrade git+https://github.com/tulir/mautrix-instagram.git#egg=mautrix-instagram[all]
pip install --upgrade git+https://github.com/tulir/mautrix-telegram.git#egg=mautrix-telegram[all]
pip install --upgrade git+https://github.com/tulir/mautrix-facebook.git#egg=mautrix-facebook[all]
pip install --upgrade git+https://github.com/tulir/mautrix-signal.git#egg=mautrix-signal[all]

RELEASE BRANCHES:

pip install --upgrade mautrix-instagram[all]
pip install --upgrade mautrix-telegram[all]
pip install --upgrade mautrix-signal[all]
pip install --upgrade mautrix-facebook[all]

Then for each bridge run through the install

mkdir /var/www/bridge-fb 
cd /var/www/bridge-fb
virtualenv -p /usr/bin/python3 .
source ./bin/activate
pip install --upgrade mautrix-facebook[all]
deactivate
cd ..

and..

mkdir /var/www/bridge-telegram 
cd /var/www/bridge-telegram 
virtualenv -p /usr/bin/python3 .
source ./bin/activate
pip install --upgrade mautrix-telegram[all]
deactivate
cd ..

and..

mkdir bridge-signal 
cd bridge-signal 
virtualenv -p /usr/bin/python3 .
source ./bin/activate
pip install --upgrade mautrix-signal[all]
deactivate
cd ..

and finally…

mkdir bridge-insta
cd bridge-insta
virtualenv -p /usr/bin/python3 .
source ./bin/activate
pip install --upgrade mautrix-instagram[all]
deactivate
cd ..

So there you have it. Matrix. Riot/Elemment and Jitsi is installed and you have 4 bridges installed, but NOT configured so you can now begin experimenting!

Hope this can help someone else get it started on their journey to private communications .

Setting up SDRPlay RSPDX on Armbian running on an ODroid N2+ for network radio tuning.

Today I received my SDRPlay RSPDx device and decided to get it running on my remote radio server. I’m still not sure if I’ll run this remote or locally, but, wanted to have the option for whatever I do decide to do.

The setup is pretty painless and involves a few commands. I’m going to assume you already have your Armbian server setup and can SSH to it and have a special user called ‘radio’ setup to run all of this as. That’s what I do.

First we’re going to want to update the system.

sudo apt-get update
sudo apt-get upgrade

Then install some stuff to have it all ready

sudo apt install cmake g++ libpython2-dev python-numpy swig git
sudo apt install libavahi-client-dev avahi-daemon libnss-mdns

Now, we go to our home directory

cd /home/radio 

Then, do this

mkdir source
cd source
git clone https://github.com/pothosware/SoapySDR.git
cd SoapySDR 
mkdir build
cd build
cmake ..
make -j4
sudo make install
sudo ldconfig

Then, we have to visit the website in order to download the install script. In a browser go to

https://www.sdrplay.com/downloads/ 

Then, select your device, and arm ubuntu, then download the API version 3.x. In my case the file name was “SDRplay_RSP_API-ARM64-3.07.1.run“.

Then continue with;

chmod 777 SDRplay_RSP_API-ARM64-3.07.1.run
./SDRplay_RSP_API-ARM64-3.07.1.run

Now, plug in your SDRPlay RSPDx device via USB and run this

SoapySDRUtil --info

You should see output showing your device now, like so

######################################################
##     Soapy SDR -- the SDR abstraction library     ##
######################################################

Lib Version: v0.8.0-g351896d3
API Version: v0.8.0
ABI Version: v0.8
Install root: /usr/local
Search path:  /usr/local/lib/SoapySDR/modules0.8
Module found: /usr/local/lib/SoapySDR/modules0.8/libLMS7Support.so    (20.10.0-1480bfea)
Module found: /usr/local/lib/SoapySDR/modules0.8/libremoteSupport.so  (0.6.0-c09b2f1)
Module found: /usr/local/lib/SoapySDR/modules0.8/librtlsdrSupport.so  (0.3.1-24b27fa)
Module found: /usr/local/lib/SoapySDR/modules0.8/libsdrPlaySupport.so (0.3.0-208f95d)
Available factories... lime, remote, rtlsdr, sdrplay
Available converters...
 -  CF32 -> [CF32, CS16, CS8, CU16, CU8]
 -  CS16 -> [CF32, CS16, CS8, CU16, CU8]
 -  CS32 -> [CS32]
 -   CS8 -> [CF32, CS16, CS8, CU16, CU8]
 -  CU16 -> [CF32, CS16, CS8]
 -   CU8 -> [CF32, CS16, CS8]
 -   F32 -> [F32, S16, S8, U16, U8]
 -   S16 -> [F32, S16, S8, U16, U8]
 -   S32 -> [S32]
 -    S8 -> [F32, S16, S8, U16, U8]
 -   U16 -> [F32, S16, S8]
 -    U8 -> [F32, S16, S8]

Now, we have to install SoapySDRPlay

cd /home/radio
cd source
git clone https://github.com/pothosware/SoapySDRPlay.git
cd SoapySDRPlay
mkdir build
cd build
cmake ..
make -j4
sudo make install

Now we want to configure SoapyRemote

cd /home/radio/source
git clone https://github.com/pothosware/SoapyRemote.git
cd SoapyRemote
mkdir build
cd build
cmake ../ # -DCMAKE_BUILD_TYPE=Debug
make -j4
sudo make install

And finally, you can test now with

SoapySDRUtil --find

Which, should give you output like this

######################################################
##     Soapy SDR -- the SDR abstraction library     ##
######################################################

Found device 1
  driver = sdrplay
  label = SDRplay Dev0 RSPdx 2005009843

So, lets make the system auto start it with

systemctl enable SoapySDRServer

Now you may (I haven’t fully tested this yet) expand your memory so you get to take advantage of the bandwidth provided by your shiny new SDRPlay device.

sudo nano /etc/sysctl.conf 

put this at the end

net.core.rmem_max=104857600
net.core.wmem_max=104857600

Close and save the file, then reboot your device. Once you have rebooted, you should be able to visit the device from the SDR you’re using (the docs recommend CubicSDR) with the IP of your remote radio server, and port as follows;

192.168.1.100:55132

I’ve found I have to adjust the bandwidth down to get anything usable, but this is because I’m on wifi. I have not fully tested on a wired network [yet].

How to setup a Chromium Kiosk Startup Mode for Raspberry Pi running Raspbian Server in 2021

I was tasked with creating a simple dashboard for a client of ours that auto runs on boot of the computer. This weekend I sat down to work on this and here’s what I found.

First, make sure you go with Rasbian Server edition of the OS. I tried with various other flavours and it was a convoluted process to remove GDM or install LXDE and actually have this run with minimal effort. This method takes around 15 minutes to setup and test, and I’m on a low speed satellite internet link – should be much faster if you have real Internet access!

Here’s how to do it;

The rest assumes you’ve already installed Vanilla Raspbian Server OS, connected to wifi if needed, and are at a shell prompt. Then you can begin by running the following commands

sudo apt-get update
sudo apt-get upgrade

That will get the system upgraded to the latest editions of everything you’re going to need next. Now let’s install the apps we need

# sudo apt-get install --no-install-recommends chromium-browser 
# sudo apt-get install --no-install-recommends xserver-xorg
# sudo apt-get install --no-install-recommends x11-xserver-utils 
# sudo apt-get install --no-install-recommends xinit 
# sudo apt-get install --no-install-recommends lxde
# sudo apt-get install lightdm screen aptitude rpd-plym-splash

Now you can go ahead and run raspi-config to edit some settings

# sudo raspi-config 

Here you’re going to want to do the following;

- setup the localization and timezone 
- setup splashscreen if desired 
- setup automatic login to x11 as the user 'pi' 

Then exit and save the settings.

Now you’re going to want to edit the xsession file so you can include the auto start of the browser

# sudo nano /etc/xdg/lxsession/LXDE/autostart

Then you’re going to want to make sure it looks like this (usually the top three lines will already be there on a typical install)

@lxpanel --profile LXDE-pi
@pcmanfm --desktop --profile LXDE-pi
@xscreensaver -no-splash
/usr/bin/chromium-browser --kiosk  --disable-restore-session-state https://google.ca

Then exit, and save the file (ctrl+x, enter to save).

Now we’ll go ahead and install unclutter, this will make sure the mouse pointer doesn’t display after a few minutes of inactivity.

# sudo apt-get install unclutter

Now we’ll remove anything we don’t need, just for good measure!

# sudo apt autoremove

And now you can reboot and wait a few seconds for it to boot into X11 and then start Chromium and display the site you listed above.

# sudo reboot

If you want to change the url to something else, just edit the autostart file again and change the url at the end of the line, exit, save, and reboot again to see the changes.