tuwunel官方有更新，文档更新 v.20260416
在linux.do上看到有人部署Tuwunel，没有docker版的，看官方文档（https://tuwunel.chat/development.html）部署完，记录下。
整体测试非常好使，相较于Synapse，内存占用低，Tuwunel配置好TURN也可以通话和视频等等，非常适合团队使用。
一、docker-compose.yml
整个compose包含tuwunel、element-web、coturn、jwt、livekt，根据实际情况进行删减。
services:
tuwunel:
### If you already built the tuwunel image with 'docker build' or want to use a registry image,
### then you are ready to go.
image: jevolk/tuwunel:latest
restart: unless-stopped
container_name: tuwunel
ports:
- "127.0.0.1:5001:6167"
volumes:
- ./tuwunel/db:/var/lib/tuwunel
- ./tuwunel/config.toml:/etc/tuwunel.toml
environment:
# TUWUNEL_SERVER_NAME: example.com # EDIT THIS
# TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
# TUWUNEL_PORT: 6167
# TUWUNEL_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
# TUWUNEL_ALLOW_REGISTRATION: 'true'
# TUWUNEL_REGISTRATION_TOKEN: '注册码' # A registration token is required when registration is allowed.
# TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
# TUWUNEL_ALLOW_FEDERATION: 'true'
# TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
# TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
# TUWUNEL_LOG: warn,state_res=warn
# TUWUNEL_ADDRESS: 0.0.0.0
TUWUNEL_CONFIG: '/etc/tuwunel.toml' # Uncomment if you mapped config toml above
coturn:
image: coturn/coturn:latest
container_name: coturn
restart: unless-stopped
environment:
DETECT_EXTERNAL_IP: "yes"
DETECT_RELAY_IP: "yes"
user: "用户名:密码"
realm: "tuwunel反代的域名"
ports:
- "3478:3478/tcp"
- "3478:3478/udp"
- "5349:5349/tcp"
- "5349:5349/udp"
- "49160-49170:49160-49170/udp"
command:
- --min-port=49160
- --max-port=49170
element-web:
container_name: "element-web"
ports:
- '127.0.0.1:8098:80' # 本地端口别冲突
image: vectorim/element-web
restart: unless-stopped
# volumes:
# - ./element-web/data/config.json:/app/config.json
environment:
- TZ=Asia/Shanghai
matrix-rtc-jwt:
image: ghcr.io/element-hq/lk-jwt-service:latest
container_name: matrix-rtc-jwt
environment:
- LIVEKIT_JWT_BIND=:8081
- LIVEKIT_URL=wss://matrix-rtc.example.com
- LIVEKIT_KEY=MRTCKEY
- LIVEKIT_SECRET=kk30GFy9IKeW6snI3BkQuezu8jsga4nu
- LIVEKIT_FULL_ACCESS_HOMESERVERS=example.com
restart: unless-stopped
ports:
- "127.0.0.1:8081:8081"
matrix-rtc-livekit:
image: livekit/livekit-server:latest
container_name: matrix-rtc-livekit
command: --config /etc/livekit.yaml
restart: unless-stopped
volumes:
- ./matrix-rtc/livekit.yaml:/etc/livekit.yaml:ro
# network_mode: "host"
# Uncomment the lines below and comment `network_mode: "host"` above to specify port mappings.
ports:
- "7880:7880/tcp"
- "7881:7881/tcp"
- "50100-50200:50100-50200/udp"
二、tuwunel.toml
配置中包含代理PROXY的配置案例和TURN的配置，代理可以支持联邦宇宙中被屏蔽的域名也能通信，TURN的服务器支持视频通话，替换成自己的。这里采用的是在Cloudflare中Realtime里申请的TURN服务器为案例，如果要使用cloudlfare需要转换，因为二者不能直连，目前没找到直接转换的项目，可能需要自己撸一个。
原版配置：https://github.com/matrix-construct/tuwunel/blob/main/tuwunel-example.toml
[global]
# 🔧 核心必填配置
server_name = "example.com" # 服务器域名（必填）
database_path = "/var/lib/tuwunel" # 数据库路径（必填）
# 🌐 网络配置
address = ["0.0.0.0"] # 监听地址
port = 6167 # 监听端口
max_request_size = 20971520 # 最大请求大小（20MB）
# 👥 用户注册与认证
allow_registration = true # 是否允许注册
registration_token = "example.com" # 注册令牌
allow_guest_registration = false # 是否允许访客注册
# 🤝 联邦网络配置
#allow_federation = true # 是否允许联邦
trusted_servers = ["example.com"] # 信任的服务器列表
# allow_public_room_directory_over_federation = false # 联邦公开房间目录
# ⚡ 性能优化 (保留你的所有注释)
# db_cache_capacity_mb = 512.0 # 数据库缓存大小（MB）
# cache_capacity_modifier = 1.0 # 缓存容量乘数
# 🔒 安全配置
# forbidden_remote_server_names = [] # 禁止的服务器域名
# allow_check_for_updates = true # 是否检查更新
# require_auth_for_profile_requests = false # 个人资料是否需要认证
# 📊 房间设置
# allow_room_creation = true # 是否允许创建房间
# default_room_version = "" # 默认房间版本
# allow_unstable_room_versions = true # 是否允许不稳定房间版本
# 🔔 管理员功能
grant_admin_to_first_user = true # 首个注册用户设为管理员
#create_admin_room = true # 创建管理员房间
# 💾 媒体文件设置
# allow_legacy_media = false # 是否允许传统媒体端点
# media_startup_check = true # 启动时检查媒体文件
# 📡 turn服务器 (Legacy 1对1通话)
turn_allow_guests = true # 是否允许访客使用TURN
turn_uris = [ "stun:coturn.example.com:3478",
"turn:coturn.example.com:3478?transport=udp",
"turn:coturn.example.com:3478?transport=tcp",
"turns:coturn.example.com:5349?transport=tcp"] # TURN服务器URI列表
turn_username = "用户名"
turn_password = "密码"
#turn_secret =
#turn_secret_file = "/etc/.turn_secret"
turn_ttl = 86400
# 🎨 高级功能与日志 (原样保留)
# new_user_displayname_suffix = "💕" # 新用户显示名称后缀
# auto_join_rooms = [] # 自动加入的房间列表
log = "info" # 日志级别
log_colors = true # 日志颜色
# 🔄 数据库、DNS、代理等注释部分 (全部完整包含)
# rocksdb_compression_algo = "zstd"
# dns_cache_entries = 32768
# proxy = "none"
# [global.proxy] ... (此处省略你的长注释，请在实际文件中保留)
# 💡 实验性功能
# hydra_backports = false
# delete_rooms_after_leave = false
# =========================================================
# 🌐 Well-known 配置区 (根据你提供的最新指南进行修复)
# 重要：在 TOML 中，必须先定义 [父表]，再定义 [[数组子表]]！
# =========================================================
[global.well_known]
client = "https://example.com" # 客户端URL
server = "example.com:443" # 服务器地址
livekit_url = "https://matrix-rtc.example.com" #这是新的标准方式，下方rtc_transports 是旧的配置方法，已被取代。
# 📡 matrix-rtc服务器 (遵照指南 Step 3.1)
# 修复核心：必须写在 [global.well_known] 之后，解决 missing_matrix_rtc_transport
# [[global.well_known.rtc_transports]]
# type = "livekit"
# livekit_service_url = "https://matrix-rtc.example.com"
# =========================================================
# [KEEP] 以下为你原配置底部的所有可选子配置块，完整保留
# =========================================================
# 🔐 TLS/SSL配置
# [global.tls]
# certs = "/path/to/certificate.crt"
# key = "/path/to/private.key"
# 🖼️ 图片模糊哈希配置
# [global.blurhashing]
# components_x = 4
# components_y = 3
# 👤 LDAP认证
# [global.ldap]
# enable = false
# uri = "ldap://ldap.example.com:389"
# 🔑 JWT认证
# [global.jwt]
# enable = false
# key = "your-jwt-secret"
三、livekit.yaml
port: 7880 bind_addresses: - "" rtc: tcp_port: 7881 port_range_start: 50100 port_range_end: 50200 use_external_ip: true enable_loopback_candidate: false keys: MRTCKEY: 32位key
四、反向代理
反代主要有两个一个tuwunel的服务，一个Matrix_RTC的服务，coturn服务不需要反代，可以使用IP或者配置个域名解析到IP即可。
反代了关键路径(兼容synapse)，根目录依然可以访问静态页面或者其他项目，如果当前域名已经绑定了博客或者其他项目，也能在当前域名下兼容。
当前我自己测试使用element的客户端支持legacy call和element call，如果通话不通，原因很多比如反代不对、服务不对、端口没开放等等，需要自行排查。
Tuwunel反代
location ~ ^/(?:_matrix|\.well-known|_synapse)/ {
proxy_pass http://127.0.0.1:5001;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
add_header X-Cache $upstream_cache_status;
add_header Cache-Control no-cache;
proxy_ssl_server_name off;
proxy_ssl_name $proxy_host;
add_header Strict-Transport-Security "max-age=31536000";
add_header Alt-Svc 'h3=":443"; ma=2592000';
}
Matrix_RTC反代
# livekit
location / {
proxy_pass http://127.0.0.1:7880;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_http_version 1.1;
add_header X-Cache $upstream_cache_status;
proxy_ssl_server_name off;
proxy_ssl_name $proxy_host;
# Optional timeouts per LiveKit
proxy_read_timeout 300s;
proxy_send_timeout 300s;
}
# lk-jwt-service
location ~ ^/(sfu/get|healthz|get_token) {
proxy_pass http://127.0.0.1:8081;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
本文作者：ZKCOI
文章名称：【全网首发】Docker部署Matrix服务器Tuwunel+coturn支持视频和语音+nginx反代
文章链接：https://www.zkcoi.com/idea/program/4374.html
本站资源仅供个人学习和交流，如若转载，请注明出处，详见《免责声明》。
微信扫一扫 
支付宝扫一扫 
