Set up Matrix delegation

What you need

Address	For	Response
/.well-known/matrix/server	Other Matrix servers	Where your server is reachable for federation
/.well-known/matrix/client	Apps like Element	Where apps log in

Both go on the web server for example.com, over HTTPS with a valid certificate. Replace matrix.example.com in all examples with the address of your Matrix server.

nginx

In the server block for port 443:

location = /.well-known/matrix/server {
    default_type application/json;
    return 200 '{"m.server": "matrix.example.com:443"}';
}

location = /.well-known/matrix/client {
    default_type application/json;
    add_header Access-Control-Allow-Origin "*" always;
    return 200 '{"m.homeserver": {"base_url": "https://matrix.example.com"}}';
}

Then check and reload: nginx -t && systemctl reload nginx

Apache 2

Create two files without an extension in the web root of your main domain.

.well-known/matrix/server:

{"m.server": "matrix.example.com:443"}

.well-known/matrix/client:

{"m.homeserver": {"base_url": "https://matrix.example.com"}}

Then add this to the VirtualHost for port 443 so the files are served as JSON. This needs mod_headers (a2enmod headers):

<Location "/.well-known/matrix/">
    ForceType application/json
    Header always set Access-Control-Allow-Origin "*"
</Location>

Then check and reload: apachectl configtest && systemctl reload apache2

Apache 2 with .htaccess, for example with WordPress

If you cannot edit the server configuration, create the same two files and add a .well-known/matrix/.htaccess next to them:

ForceType application/json
Header always set Access-Control-Allow-Origin "*"

Test

curl -s https://example.com/.well-known/matrix/server
curl -si https://example.com/.well-known/matrix/client

The first line shows the JSON with m.server. The second also shows the headers, which must include content-type: application/json and access-control-allow-origin: *.

Finally, enter your main domain in the Matrix Federation Tester. It checks federation from the outside.

If it does not work

• Federation fails: Check that m.server includes the port :443. Without it, other servers try port 8448.
• Element in the browser cannot find the server: Usually the Access-Control-Allow-Origin header is missing on /client.
• The response is an HTML page or 404: A CMS or redirect is catching the path. These entries have to take effect before such rules.
• It works in the browser but not in the Federation Tester: A bot block or firewall is stopping server requests. Exclude /.well-known/matrix/ from it.