Skip to Content

Distribution-managed Element Web

Dependency and ownership

The addon uses the complete, separately installed Element Web client. On Arch Linux, the external frontend dependency is extra/element-web. The binary package provides its own JavaScript, WebAssembly, encryption, recovery, and calling UI. The Odoo addon contains only its integration code: it does not copy, extract, build, or update Element's assets or install npm packages.

Element Web may be served on the same host or another host. Odoo needs the reviewed client HTTPS origin, not access to the client-serving host's filesystem. Do not add element-web to Odoo's Python or executable dependency lists: it is a separately hosted web application, not a Python package or command.

Arch Linux setup

Install the official binary element-web package through the host's normal Arch Linux package-management procedure. A package installation or full system upgrade is an operator action, independent of installing/updating the Odoo addon. Confirm the installed version and file layout:

pacman -Q element-web
pacman -Ql element-web

The installed package's web root is /usr/share/webapps/element/. Serve that directory directly through the client host's existing HTTPS web server. The package's config.json is a symlink to /etc/webapps/element/config.json; maintain the deployment configuration there and review package upgrade notices. Element's public configuration must identify the intended Matrix homeserver. Never put company integration tokens, personal tokens, or recovery keys in it.

Use an HTTPS origin distinct from Odoo, such as https://element.example.com. On the Matrix target, set Element Web Origin to that exact origin, without paths, credentials, query parameters, or fragments. file:// URLs and pointing Odoo at the package's filesystem path do not provide an embedded web client.

Element responses must allow the exact Odoo origin through the deployment's Content-Security-Policy: frame-ancestors. Conflicting X-Frame-Options headers must be resolved by the operator. Odoo's content-security and permissions policies must also allow the selected frame and its supported media features. Delegate camera, microphone, and screen sharing only to the configured Element origin and, if different, the explicit Element Call Origin. The packaged Element Call widget under /widgets/element-call/ uses the same client origin. Calls still need the deployment's supported MatrixRTC transport and backend.

The existing Matrix deployment guide covers the Synapse, client, HTTPS, and conferencing service setup. The addon does not change host services or Nginx configuration automatically.

Odoo usage and session boundary

Choose Matrix Client in Odoo or Open in Odoo on a verified identity or approved room membership. Odoo checks the current native account, mapping, selected companies, and managed room approval before opening the client and periodically while the frame is open. Failed checks unload the frame. Pause, navigation, and component teardown also unload Element's active frame.

Sign in inside Element as the identity displayed by Odoo. Element owns personal Matrix authentication, encrypted chat, devices, recovery, attachments, and calls. Odoo cannot inspect or force logout of a cross-origin Element session. An Odoo mapping is not proof of the account currently signed into Element, and unloading the frame does not revoke that independent Matrix account or its memberships. Reviewed Matrix room membership controls calling access; Element and the MatrixRTC deployment own admission, moderation, and disconnection. Odoo maintains no separate call approvals or invitation leases, and Matrix room withdrawal does not guarantee immediate removal of an already connected SFU participant. The encrypted Discuss relay remains a separate integration; embedding Element does not implement it.

Updates

Follow Arch's element-web package updates and upstream Element release/security notes. Apply reviewed host updates through the existing maintenance procedure, check operator configuration and framing/media headers, then reload the client. Avoid stale caching of the HTML entry point and configuration after upgrades. No frontend build, npm installation, or copied SDK update is required in Odoo. Test encrypted chat, device recovery, and calls against the configured services before accepting a production service update.

Sources: Arch package and Element Web deployment documentation.