Page MenuHomePhabricator

Set up a hosted Matrix.org / Riot instance on modular.im
Closed, ResolvedPublic

Tokens
"Love" token, awarded by Arkanosis."Love" token, awarded by Neil_P._Quinn_WMF."Like" token, awarded by Seewolf."Love" token, awarded by Chicocvenancio.
Assigned To
Authored By
Tgr, Jan 31 2019

Description

We are trying to evaluate Matrix as a modern, user-friendly alternative to IRC and an open-source, privacy-friendly alternative to Slack / Google Chat. There is a public instance (matrix.org) but it has a huge userbase, which means it is often operating under abnormally high load and is quite slow; also since it's an instance used by everyone, we can't have anything Wikimedia-specific on it (such as SUL login). Thus, we want to have our own instance for evaluation. T193961: Set up Matrix.org homeserver on the Wikimedia Cloud VPS is the task to set one up locally, but as a less time-consuming alternative, we'll go for a hosted instance managed by the Matrix developers (New Vector) first.

See pricing here; it's $1.50 per user per month (that's monthly active users, not total registered accounts), with a $75 minimum.

Rough testing plan:

  • set up & test basic instance + Wikimedia SUL SSO (if feasible) + LDAP integration (if feasible) + communities (Matrix.org user groups) based on Wikimedia or LDAP groups
  • test bridging with IRC, Slack, Google Chat (maybe Telegram, Zulip if we feel like it)
  • ask some IRC/IRCCloud/GChat/Slack users, designers, user researchers to evaluate
  • convert an IRC logger bot, have it use rich text
  • convert an IRC chatbot
  • ask a Slack team to evaluate for some fixed period (3 months?)
  • ask an IRC team to evaluate for some fixed period

Overall, length of the testing period is expected to be somewhere between 3-6 month. After that (maybe after step 3 as well if there is enough feedback) we make a go / no-go decision; if it's a no, try to turn the feedback into concrete blockers, otherwise we make a proposal to the executive team and if there is at least conditional support for Matrix as a canonical chat solution, ask ops for a self-hosted instance. Add 3 months for the setup period before the testing, and a $1000 budget should cover it (with a 70 active user / month cap, which is probably plenty - if there's an unexpected level of interest, we can reevaluate the plan).

Event Timeline

Tgr created this task.Jan 31 2019, 10:16 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 31 2019, 10:16 PM
Tgr added a comment.EditedFeb 1 2019, 6:41 AM

More info:

Things to clarify:

  • with Matrix folks:
    • how does the pricing model work? (it mentions $75 / 50 users, but also $1.50 per user flat pricing)
    • can we use a wikimedia.org domain? (do we even want to? probably not, see below)
    • can we use the wikimedia.org namespace for Matrix accounts? (Even if it's not actually hosted on that domain?)
    • this is meant to be temporary, exactly what can / can't be ported to a locally hosted instance in the future?
    • what do we need for integration with Wikimedia logins (OAuth 1.0a with a homegrown OpenID-ish API)? Wikimedia user groups (same)? LDAP groups?
    • is there documentation on antispam measures? (think of something like the recent nasty Freenode spam)
  • with ops/security:
    • can we use a wikimedia.org domain? (scary cookie injection attacks...)
  • with legal:
    • the servers are in the EU, is that going to be a problem?
    • general privacy issues (is their policy acceptable? do we need to warn users? should we limit to WMF users? given that we use Slack I'd assume these are non-issues...)
  • with ourselves:
    • any other non-defailt features we want to trial?
Tgr updated the task description. (Show Details)Feb 1 2019, 6:49 AM
Tgr updated the task description. (Show Details)Feb 1 2019, 6:58 AM
Tgr updated the task description. (Show Details)
Tgr added a comment.Feb 1 2019, 7:01 AM

From matrix chat:

On pricing, the minimum spend is $75/mo which allows for 50 monthly active users. You can then buy more seats at a cost of $1.50/mo for as many people as you need.
The reason we have the 50 person and 100 person servers called out at all is that we intend to add some features only available to larger installs.
Worth noting that you are only charged for active native users. This means that a user must have been active in the previous month and new users chat for free for 2 days.
You are not charged for bridged users, or users that join your rooms over federation.

We can support multiple log in flows, so it would just be a case of configuring your instance to support LDAP and OAuth. The would mean users needing to select their auth method at log in time.
With OAuth [1.0], we’d need to talk a bit more on how to integrate with what you have.

Things to clarify:
with Matrix folks:
how does the pricing model work? (it mentions $75 / 50 users, but also $1.50 per user flat pricing)

as per Tgr's comment above

can we use a wikimedia.org domain? (do we even want to? probably not, see below)

Yes you can, this is true for the Riot instance and the underlying Synapse homeserver.

can we use the wikimedia.org namespace for Matrix accounts? (Even if it's not actually hosted on that domain?)

Yes you can, but soon you will need to provide a .well-known page on wikimedia.org (the spec will land very shortly, and I can share more details of how this will work)

this is meant to be temporary, exactly what can / can't be ported to a locally hosted instance in the future?

We can provide you access to a snap shot of your database and installation, so you can port as is retaining your history and user ids.

what do we need for integration with Wikimedia logins (OAuth 1.0a with a homegrown OpenID-ish API)? Wikimedia user groups (same)? LDAP groups?

We have LDAP auth out of the box. We could talk about doing some custom work to integrate with your OAuth/OpenID implementation, though this would need to be accounted for outside of the regular fee.

is there documentation on antispam measures? (think of something like the recent nasty Freenode spam)

Right now this is the best I have - though would happily action the issue for you.

Synapse works on the basis of custom anti-spam modules. Out of the box Modular instances do not have anti-spam measures by default, but if you have specific needs, we could definitely load something custom for you. Further down the line this could be self serve so that you can manage anti spam independently.

Tgr updated the task description. (Show Details)Feb 2 2019, 4:24 AM

FYI On the mobile version of https://matrix.org/blog/home/ WMF is listed as user of Matrix.

Tgr added a comment.Feb 23 2019, 12:05 AM

FYI On the mobile version of https://matrix.org/blog/home/ WMF is listed as user of Matrix.

Thanks for catching that! That was unintentional and has been fixed.

Tgr added a comment.Feb 23 2019, 12:15 AM

Things to clarify:

  • with ops/security:
    • can we use a wikimedia.org domain? (scary cookie injection attacks...)

Given that it is not needed for having :wikimedia.org Matrix namespace, probably no point in doing this. With the servers being in the EU and run by another orgaization it would be a lot of legal/privacy/security complexity with little benefit.

Tgr moved this task from Backlog to Next on the User-Tgr board.Feb 23 2019, 7:20 AM
bd808 added a subscriber: bd808.Feb 25 2019, 8:22 PM
Arkanosis added a subscriber: Arkanosis.
Tgr updated the task description. (Show Details)Apr 25 2019, 6:47 PM
Tgr updated the task description. (Show Details)
Tgr renamed this task from Set up a hosted Matrix.org / Riot instance to Set up a hosted Matrix.org / Riot instance on modular.im.May 19 2019, 4:12 PM
CDanis added a subscriber: CDanis.May 22 2019, 12:51 PM
Tgr closed this task as Resolved.Aug 15 2019, 9:32 AM
Tgr claimed this task.

The instance has been operational for a while; closing this in favor of T222458: Evaluate Riot as recommended IRC client as a way of tracking the trial itself.