فارسی · Home · Setup guide
Blackout mode: installing without international internet
When the international internet is cut, a normal install fails: the playbook, its Ansible roles, the container images, Docker and the server's own packages all come from abroad. In blackout mode interzone gets every one of them from mirrors inside the country instead.
Follow the Setup guide as usual; this page covers the parts that differ.
1. Choose blackout on the Server step
Under Downloads, move to Network situation and choose
Blackout: in-country mirrors only with →.
Every download source below it now points at an in-country mirror:
| What | Default mirror |
|---|---|
| The playbook (git) | https://itsjustadream.g0th.ir/spantaleev/matrix-docker-ansible-deploy |
| Ansible roles (git) | https://itsjustadream.g0th.ir/ |
| Container images | mechatok.g0th.ir/ |
| Docker Engine packages | https://infamous.g0th.ir/docker |
| The server's OS packages | https://infamous.g0th.ir |
| Python packages (PyPI, for Ansible) | https://infamous.g0th.ir/pypi/simple |
Each field's help lists the other known mirrors in Iran (Hostbaran, Abrha, ArvanCloud, IranServer, MobinHost, FamaServer and more), with which Linux versions each one carries. You don't have to pick: during the deploy, interzone checks the chosen mirrors against your server's Linux version and the images it needs, and if one falls short, it switches to a known mirror that has everything, says so in the log and saves it.
2. Test the mirrors
Press ctrl+t on the Server step to test every source from your computer:
The Mirrors screen (in the menu, or interzone mirrors in a terminal)
checks every known mirror for what it actually carries, not only whether it
answers. Package mirrors must have updates less than two weeks old.
Its third tab, Images, checks that every container image your setup needs
can be pulled through the registry mirror. It asks your server, and needs the
playbook downloaded first: after the first deploy, or
./interzone apply --save-only.
3. Certificates: not Let's Encrypt
Let's Encrypt has to reach your server from abroad, so it fails during a blackout. Under HTTPS certificates choose:
- My own certificate if you have one (for instance from a provider inside the country). Give the paths to the certificate and key files on your computer, or
- Self-signed. interzone makes one. Browsers and apps will warn that it isn't trusted until each device trusts it, so this is best for a small group.
When the internet comes back you can switch to Let's Encrypt and run Update the server.
4. Federation
Servers abroad can't reach yours during a blackout, nor yours them, but servers inside the country can. Leave federation on, or under Networking › Federate only with list the servers you want to talk to.
5. No internet at all: the offline bundle
If the computer you run interzone on can't reach even the mirrors, make a bundle somewhere that has internet:
./interzone bundle -o interzone-bundle.tar.gz
It holds the playbook with every Ansible role, Ansible's Python packages and interzone itself. Copy it over, then:
tar xzf interzone-bundle.tar.gz
./interzone-bundle/interzone unbundle interzone-bundle
./interzone-bundle/interzone
Container images aren't in the bundle: the server still needs a registry mirror it can reach (the Container registry mirror field).
6. When the mirrors are down too: IPFS
If the in-country mirrors can't be reached either, other interzone servers can supply everything over IPFS, a network where any server that has a file can pass it on. Under Network situation choose IPFS: from interzone's swarm. The git and registry fields disappear: the playbook, roles, packages and every container image come from the swarm.
You must also answer Share what this server downloads:
- Yes keeps IPFS running on your server after the deploy, so other servers can fetch from it. It listens on TCP port 4001 (open it in your firewall), and the swarm's members can see that your server holds Matrix software.
- No only downloads; IPFS stops after each deploy.
The deploy then installs IPFS on the server, joins interzone's private swarm,
finds the newest publish and checks its signature before using anything.
ctrl+t checks that the publish and the swarm's entry node can be reached.
Let's Encrypt still needs the international internet (step 3).
A bundle made with IPFS chosen also carries IPFS itself, so a server with no internet at all can join the swarm.
Hosting without a homeserver
You can help the swarm without running Matrix at all. Choose Host in the
menu, switch on the parts to host (the container images, about 12 GB; the OS,
Docker and Python packages, 3.7 GB; the playbook and its roles in git, 50 MB;
interzone and IPFS themselves, 230 MB), then pick this machine or a Linux
server over SSH, and press enter. While it hosts, the same screen shows its
peers, how much of each part has arrived, traffic, what it gave the swarm,
disk use and when it checks next.
The machine then keeps the newest signed copy and shares it. It checks for a
new one every hour on its own, so interzone doesn't need to stay open. As
with sharing above, it listens on TCP port 4001 and the swarm can see that it
holds Matrix software.
To stop, open Host again with the same machine's details in the form.
ctrl+x stops sharing: the node stays off, even after a reboot, keeps what
it downloaded, and enter starts it again. ctrl+d removes it, after asking:
the node and everything it downloaded are deleted and the disk space is free
again. A Matrix server on the same machine keeps running. On the server
itself, this does the same as ctrl+x:
sudo systemctl disable --now interzone-ipfs-follow.timer interzone-ipfs