2. wait no that repo is archived. it's now under element-hq/synapse. click that

3. go to docs -> installation -> click "contrib/docker" -> open docker-compose.yml

4. so this example is incorrect because it's referring to "/data/uploads" which is not a thing. just examine all the documentation, the dockerfile, the synapse source code, to figure out which mountpoints you actually need and how to generate the config file

5. now you obviously want OIDC auth, so just add password_config: enabled: false and add your oidc provider according to synapse documentation

6. now you can sign up and log in using your OIDC provider, you can try it out in the Element app. congrats!

7. download Element X app on the phone and try logging in. the error would say "the selected homeserver doesn't support password or oidc login". close the error and see a little hint saying that Element X only works with servers supporting "sliding sync"

8. the hint has a link to instructions on how to set up sliding sync. comfy! click it and you end up here https://github.com/matrix-org/...

9. install the sliding sync proxy (another docker container). update your .well-known/matrix/client to announce your sliding sync proxy

10. try logging in with Element X again. see the same error. keep googling to see what went wrong with the sliding sync setup

11. turns out you don't need sliding sync proxy anymore. it's discontinued. native sliding sync is the new meta, and it's already built into your synapse install. uninstall the sliding sync proxy and remove it from .well-known

12. it also turns out the error had nothing to do with sliding sync. the actual reason is that the authentication you set up is deprecated. synapse isn't supposed to be handling auth anymore. you need Matrix Authentication Service

13. install MAS (another docker container). configure it to use your upstream OIDC provider. configure synapse to use MAS. this is done through these undocumented config parameters: experimental_features: msc3861: ...

14. you also configured MAS in your .well-known/matrix/client according to the instruction. but the instruction showed an incorrect example for the "issuer" field, so spend 10 extra minutes figuring that out and fix it

15. done! now your synapse server isn't handling auth, MAS does that instead. but you can't log in. you need to migrate your account from synapse embedded auth to MAS. use the node tool "syn2mas" for that. be very careful with it, it can break everything, read the docs!!

16. now that your account is migrated, your .well-known is doing well, and your synapse is using MAS, you can log into your server from Element X. congratulations!

17. try calling your girlfriend. the call doesn't come through. go look it up

18. turns out you need to install the RTC backend for your server. it's called livekit. but livekit needs to be bridged with synapse, os for that you need livekit-jwt-service. basically you need to add 2 more docker containers

19. spend 30 minutes figuring out paths for your reverse proxy configuration to make the RTC backend work. don't forget to forward some UDP ports for it too

20. and of course the synapse config, but this is self-explanatory: experimental_features: msc3266_enabled: true msc4222_enabled: true msc4140_enabled: true

21. restart all your clients 6 times and try calling your girlfriend again. it works! finally! now you have a functioning matrix server consisting of: - synapse - Matrix Authentication Service - livekit - livekit jwt bridge - postgres db

22. wait. hold on. you can't authenticate with regular Element on desktop anymore. obviously this is because it doesn't understand MAS and uses legacy authentication. how did you not know this, idiot?

23. MAS has a legacy shim for this case. but MAS is proxied from http://auth.matrix.domain.com, and the client is trying to auth via http://matrix.domain.com. you need a way to have SOME requests to the main domain handled by MAS

24. achieve this with the simple reverse proxy rule on the MAS container: Host(`http://auth.matrix.domain.com`... || (Host(`http://matrix.domain.com`) && PathRegexp(`^/_matrix/client/.*/(login|logout|refresh)`))

25. now you can authenticate from both legacy and modern clients, and your calls work. enjoy the taste of open source software!