· 5 years ago · Feb 26, 2021, 10:18 PM
1# vim:ft=yaml
2# PEM encoded X509 certificate for TLS.
3# You can replace the self-signed certificate that synapse
4# autogenerates on launch with your own SSL certificate + key pair
5# if you like. Any required intermediary certificates can be
6# appended after the primary certificate in hierarchical order.
7#tls_certificate_path: "/etc/matrix-synapse/homeserver.tls.crt"
8
9# PEM encoded private key for TLS
10#tls_private_key_path: "/etc/matrix-synapse/homeserver.tls.key"
11
12# PEM dh parameters for ephemeral keys
13#tls_dh_params_path: "/etc/matrix-synapse/homeserver.tls.dh"
14
15# Don't bind to the https port
16no_tls: False
17
18# List of allowed TLS fingerprints for this server to publish along
19# with the signing keys for this server. Other matrix servers that
20# make HTTPS requests to this server will check that the TLS
21# certificates returned by this server match one of the fingerprints.
22#
23# Synapse automatically adds the fingerprint of its own certificate
24# to the list. So if federation traffic is handled directly by synapse
25# then no modification to the list is required.
26#
27# If synapse is run behind a load balancer that handles the TLS then it
28# will be necessary to add the fingerprints of the certificates used by
29# the loadbalancers to this list if they are different to the one
30# synapse is using.
31#
32# Homeservers are permitted to cache the list of TLS fingerprints
33# returned in the key responses up to the "valid_until_ts" returned in
34# key. It may be necessary to publish the fingerprints of a new
35# certificate and wait until the "valid_until_ts" of the previous key
36# responses have passed before deploying it.
37#
38# You can calculate a fingerprint from a given TLS listener via:
39# openssl s_client -connect $host:$port < /dev/null 2> /dev/null |
40# openssl x509 -outform DER | openssl sha256 -binary | base64 | tr -d '='
41# or by checking matrix.org/federationtester/api/report?server_name=$host
42#
43tls_fingerprints: []
44# tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
45
46
47## Server ##
48
49# When running as a daemon, the file to store the pid in
50pid_file: "/var/run/matrix-synapse.pid"
51
52# CPU affinity mask. Setting this restricts the CPUs on which the
53# process will be scheduled. It is represented as a bitmask, with the
54# lowest order bit corresponding to the first logical CPU and the
55# highest order bit corresponding to the last logical CPU. Not all CPUs
56# may exist on a given system but a mask may specify more CPUs than are
57# present.
58#
59# For example:
60# 0x00000001 is processor #0,
61# 0x00000003 is processors #0 and #1,
62# 0xFFFFFFFF is all processors (#0 through #31).
63#
64# Pinning a Python process to a single CPU is desirable, because Python
65# is inherently single-threaded due to the GIL, and can suffer a
66# 30-40% slowdown due to cache blow-out and thread context switching
67# if the scheduler happens to schedule the underlying threads across
68# different cores. See
69# https://www.mirantis.com/blog/improve-performance-python-programs-restricting-single-cpu/.
70#
71# cpu_affinity: 0xFFFFFFFF
72
73# The path to the web client which will be served at /_matrix/client/
74# if 'webclient' is configured under the 'listeners' configuration.
75#
76# web_client_location: "/path/to/web/root"
77
78# The public-facing base URL for the client API (not including _matrix/...)
79# public_baseurl: https://example.com:8448/
80
81# Set the soft limit on the number of file descriptors synapse can use
82# Zero is used to indicate synapse should set the soft limit to the
83# hard limit.
84soft_file_limit: 0
85
86# Set to false to disable presence tracking on this homeserver.
87#
88#use_presence: false
89
90# Whether to require authentication to retrieve profile data (avatars,
91# display names) of other users through the client API. Defaults to
92# 'false'. Note that profile data is also available via the federation
93# API, so this setting is of limited value if federation is enabled on
94# the server.
95#
96#require_auth_for_profile_requests: true
97
98# Uncomment to require a user to share a room with another user in order
99# to retrieve their profile information. Only checked on Client-Server
100# requests. Profile requests from other servers should be checked by the
101# requesting server. Defaults to 'false'.
102#
103#limit_profile_requests_to_users_who_share_rooms: true
104
105# If set to 'true', removes the need for authentication to access the server's
106# public rooms directory through the client API, meaning that anyone can
107# query the room directory. Defaults to 'false'.
108#
109#allow_public_rooms_without_auth: true
110
111# If set to 'true', allows any other homeserver to fetch the server's public
112# rooms directory via federation. Defaults to 'false'.
113#
114#allow_public_rooms_over_federation: true
115
116# The default room version for newly created rooms.
117#
118# Known room versions are listed here:
119# https://matrix.org/docs/spec/#complete-list-of-room-versions
120#
121# For example, for room version 1, default_room_version should be set
122# to "1".
123#
124#default_room_version: "5"
125
126# The GC threshold parameters to pass to `gc.set_threshold`, if defined
127# gc_thresholds: [700, 10, 10]
128
129# Set the limit on the returned events in the timeline in the get
130# and sync operations. The default value is -1, means no upper limit.
131# filter_timeline_limit: 5000
132
133# Whether room invites to users on this server should be blocked
134# (except those sent by local server admins). The default is False.
135# block_non_admin_invites: True
136
137# Room searching
138#
139# If disabled, new messages will not be indexed for searching and users
140# will receive errors when searching for messages. Defaults to enabled.
141#
142#enable_search: false
143
144# Restrict federation to the following whitelist of domains.
145# N.B. we recommend also firewalling your federation listener to limit
146# inbound federation traffic as early as possible, rather than relying
147# purely on this application-layer restriction. If not specified, the
148# default is to whitelist everything.
149#
150# federation_domain_whitelist:
151# - lon.example.com
152# - nyc.example.com
153# - syd.example.com
154
155# Prevent federation requests from being sent to the following
156# blacklist IP address CIDR ranges. If this option is not specified, or
157# specified with an empty list, no ip range blacklist will be enforced.
158#
159# As of Synapse v1.4.0 this option also affects any outbound requests to identity
160# servers provided by user input.
161#
162# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
163# listed here, since they correspond to unroutable addresses.)
164#
165federation_ip_range_blacklist:
166 - '127.0.0.0/8'
167 - '10.0.0.0/8'
168 - '172.16.0.0/12'
169 - '192.168.0.0/16'
170 - '100.64.0.0/10'
171 - '169.254.0.0/16'
172 - '::1/128'
173 - 'fe80::/64'
174 - 'fc00::/7'
175
176# List of ports that Synapse should listen on, their purpose and their
177# configuration.
178#
179# Options for each listener include:
180#
181# port: the TCP port to bind to
182#
183# bind_addresses: a list of local addresses to listen on. The default is
184# 'all local interfaces'.
185#
186# type: the type of listener. Normally 'http', but other valid options are:
187# 'manhole' (see docs/manhole.md),
188# 'metrics' (see docs/metrics-howto.md),
189# 'replication' (see docs/workers.md).
190#
191# tls: set to true to enable TLS for this listener. Will use the TLS
192# key/cert specified in tls_private_key_path / tls_certificate_path.
193#
194# x_forwarded: Only valid for an 'http' listener. Set to true to use the
195# X-Forwarded-For header as the client IP. Useful when Synapse is
196# behind a reverse-proxy.
197#
198# resources: Only valid for an 'http' listener. A list of resources to host
199# on this port. Options for each resource are:
200#
201# names: a list of names of HTTP resources. See below for a list of
202# valid resource names.
203#
204# compress: set to true to enable HTTP comression for this resource.
205#
206# additional_resources: Only valid for an 'http' listener. A map of
207# additional endpoints which should be loaded via dynamic modules.
208#
209# Valid resource names are:
210#
211# client: the client-server API (/_matrix/client), and the synapse admin
212# API (/_synapse/admin). Also implies 'media' and 'static'.
213#
214# consent: user consent forms (/_matrix/consent). See
215# docs/consent_tracking.md.
216#
217# federation: the server-server API (/_matrix/federation). Also implies
218# 'media', 'keys', 'openid'
219#
220# keys: the key discovery API (/_matrix/keys).
221#
222# media: the media API (/_matrix/media).
223#
224# metrics: the metrics interface. See docs/metrics-howto.md.
225#
226# openid: OpenID authentication.
227#
228# replication: the HTTP replication API (/_synapse/replication). See
229# docs/workers.md.
230#
231# static: static resources under synapse/static (/_matrix/static). (Mostly
232# useful for 'fallback authentication'.)
233#
234# webclient: A web client. Requires web_client_location to be set.
235#
236listeners:
237 # Main HTTPS listener
238 # For when matrix traffic is sent directly to synapse.
239 -
240 # The port to listen for HTTPS requests on.
241 port: 8448
242
243 # Local addresses to listen on.
244 # On Linux and Mac OS, `::` will listen on all IPv4 and IPv6
245 # addresses by default. For most other OSes, this will only listen
246 # on IPv6.
247 bind_addresses:
248 - '::1'
249 - '127.0.0.1'
250 # - '::'
251 # - '0.0.0.0'
252
253 # This is a 'http' listener, allows us to specify 'resources'.
254 type: http
255
256 tls: true
257
258 # Use the X-Forwarded-For (XFF) header as the client IP and not the
259 # actual client IP.
260 x_forwarded: false
261
262 # List of HTTP resources to serve on this listener.
263 resources:
264 -
265 # List of resources to host on this listener.
266 names:
267 - client # The client-server APIs, both v1 and v2
268
269 # Should synapse compress HTTP responses to clients that support it?
270 # This should be disabled if running synapse behind a load balancer
271 # that can do automatic compression.
272 compress: true
273
274 - names: [federation] # Federation APIs
275 compress: false
276
277 # optional list of additional endpoints which can be loaded via
278 # dynamic modules
279 # additional_resources:
280 # "/_matrix/my/custom/endpoint":
281 # module: my_module.CustomRequestHandler
282 # config: {}
283
284 # Unsecure HTTP listener,
285 # For when matrix traffic passes through loadbalancer that unwraps TLS.
286 - port: 8008
287 tls: false
288 bind_addresses:
289 - '::1'
290 - '127.0.0.1'
291 # - '::'
292 # - '0.0.0.0'
293 type: http
294
295 x_forwarded: true
296
297 resources:
298 - names: [client]
299 compress: true
300 - names: [federation]
301 compress: false
302
303 # Turn on the twisted ssh manhole service on localhost on the given
304 # port.
305 # - port: 9000
306 # bind_addresses:
307 # - '::1'
308 # - '127.0.0.1'
309 # type: manhole
310
311
312# Database configuration
313database:
314 # The database engine name
315 name: "sqlite3"
316 # Arguments to pass to the engine
317 args:
318 # Path to the database
319 database: "/var/lib/matrix-synapse/homeserver.db"
320
321# Number of events to cache in memory.
322event_cache_size: "10K"
323
324
325# A yaml python logging config file
326log_config: "/etc/matrix-synapse/log.yaml"
327
328
329
330## Ratelimiting ##
331
332# Ratelimiting settings for client actions (registration, login, messaging).
333#
334# Each ratelimiting configuration is made of two parameters:
335# - per_second: number of requests a client can send per second.
336# - burst_count: number of requests a client can send before being throttled.
337#
338# Synapse currently uses the following configurations:
339# - one for messages that ratelimits sending based on the account the client
340# is using
341# - one for registration that ratelimits registration requests based on the
342# client's IP address.
343# - one for login that ratelimits login requests based on the client's IP
344# address.
345# - one for login that ratelimits login requests based on the account the
346# client is attempting to log into.
347# - one for login that ratelimits login requests based on the account the
348# client is attempting to log into, based on the amount of failed login
349# attempts for this account.
350# - one for ratelimiting redactions by room admins. If this is not explicitly
351# set then it uses the same ratelimiting as per rc_message. This is useful
352# to allow room admins to deal with abuse quickly.
353#
354# The defaults are as shown below.
355#
356#rc_message:
357# per_second: 0.2
358# burst_count: 10
359#
360#rc_registration:
361# per_second: 0.17
362# burst_count: 3
363#
364#rc_login:
365# address:
366# per_second: 0.17
367# burst_count: 3
368# account:
369# per_second: 0.17
370# burst_count: 3
371# failed_attempts:
372# per_second: 0.17
373# burst_count: 3
374#
375#rc_admin_redaction:
376# per_second: 1
377# burst_count: 50
378
379
380# Ratelimiting settings for incoming federation
381#
382# The rc_federation configuration is made up of the following settings:
383# - window_size: window size in milliseconds
384# - sleep_limit: number of federation requests from a single server in
385# a window before the server will delay processing the request.
386# - sleep_delay: duration in milliseconds to delay processing events
387# from remote servers by if they go over the sleep limit.
388# - reject_limit: maximum number of concurrent federation requests
389# allowed from a single server
390# - concurrent: number of federation requests to concurrently process
391# from a single server
392#
393# The defaults are as shown below.
394#
395#rc_federation:
396# window_size: 1000
397# sleep_limit: 10
398# sleep_delay: 500
399# reject_limit: 50
400# concurrent: 3
401
402# Target outgoing federation transaction frequency for sending read-receipts,
403# per-room.
404#
405# If we end up trying to send out more read-receipts, they will get buffered up
406# into fewer transactions.
407#
408#federation_rr_transactions_per_room_per_second: 50
409
410
411
412## Media Store ##
413
414# Enable the media store service in the Synapse master. Uncomment the
415# following if you are using a separate media store worker.
416#
417#enable_media_repo: false
418
419# Directory where uploaded images and attachments are stored.
420media_store_path: "/var/lib/matrix-synapse/media"
421
422# Media storage providers allow media to be stored in different
423# locations.
424# media_storage_providers:
425# - module: file_system
426# # Whether to store newly uploaded local files
427# store_local: false
428# # Whether to store newly downloaded remote files
429# store_remote: false
430# # Whether to wait for successful storage for local uploads
431# store_synchronous: false
432# config:
433# directory: /mnt/some/other/directory
434
435# Directory where in-progress uploads are stored.
436uploads_path: "/var/lib/matrix-synapse/uploads"
437
438# The largest allowed upload size in bytes
439max_upload_size: "100M"
440
441# Maximum number of pixels that will be thumbnailed
442max_image_pixels: "32M"
443
444# Whether to generate new thumbnails on the fly to precisely match
445# the resolution requested by the client. If true then whenever
446# a new resolution is requested by the client the server will
447# generate a new thumbnail. If false the server will pick a thumbnail
448# from a precalculated list.
449dynamic_thumbnails: false
450
451# List of thumbnail to precalculate when an image is uploaded.
452thumbnail_sizes:
453- width: 32
454 height: 32
455 method: crop
456- width: 96
457 height: 96
458 method: crop
459- width: 320
460 height: 240
461 method: scale
462- width: 640
463 height: 480
464 method: scale
465- width: 800
466 height: 600
467 method: scale
468
469# Is the preview URL API enabled? If enabled, you *must* specify
470# an explicit url_preview_ip_range_blacklist of IPs that the spider is
471# denied from accessing.
472url_preview_enabled: False
473
474# List of IP address CIDR ranges that the URL preview spider is denied
475# from accessing. There are no defaults: you must explicitly
476# specify a list for URL previewing to work. You should specify any
477# internal services in your network that you do not want synapse to try
478# to connect to, otherwise anyone in any Matrix room could cause your
479# synapse to issue arbitrary GET requests to your internal services,
480# causing serious security issues.
481#
482# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
483# listed here, since they correspond to unroutable addresses.)
484#
485# This must be specified if url_preview_enabled is set. It is recommended that
486# you uncomment the following list as a starting point.
487#
488# url_preview_ip_range_blacklist:
489# - '127.0.0.0/8'
490# - '10.0.0.0/8'
491# - '172.16.0.0/12'
492# - '192.168.0.0/16'
493# - '100.64.0.0/10'
494# - '169.254.0.0/16'
495# - '::1/128'
496# - 'fe80::/64'
497# - 'fc00::/7'
498
499# List of IP address CIDR ranges that the URL preview spider is allowed
500# to access even if they are specified in url_preview_ip_range_blacklist.
501# This is useful for specifying exceptions to wide-ranging blacklisted
502# target IP ranges - e.g. for enabling URL previews for a specific private
503# website only visible in your network.
504#
505# url_preview_ip_range_whitelist:
506# - '192.168.1.1'
507
508# Optional list of URL matches that the URL preview spider is
509# denied from accessing. You should use url_preview_ip_range_blacklist
510# in preference to this, otherwise someone could define a public DNS
511# entry that points to a private IP address and circumvent the blacklist.
512# This is more useful if you know there is an entire shape of URL that
513# you know that will never want synapse to try to spider.
514#
515# Each list entry is a dictionary of url component attributes as returned
516# by urlparse.urlsplit as applied to the absolute form of the URL. See
517# https://docs.python.org/2/library/urlparse.html#urlparse.urlsplit
518# The values of the dictionary are treated as an filename match pattern
519# applied to that component of URLs, unless they start with a ^ in which
520# case they are treated as a regular expression match. If all the
521# specified component matches for a given list item succeed, the URL is
522# blacklisted.
523#
524# url_preview_url_blacklist:
525# # blacklist any URL with a username in its URI
526# - username: '*'
527#
528# # blacklist all *.google.com URLs
529# - netloc: 'google.com'
530# - netloc: '*.google.com'
531#
532# # blacklist all plain HTTP URLs
533# - scheme: 'http'
534#
535# # blacklist http(s)://www.acme.com/foo
536# - netloc: 'www.acme.com'
537# path: '/foo'
538#
539# # blacklist any URL with a literal IPv4 address
540# - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
541
542# The largest allowed URL preview spidering size in bytes
543max_spider_size: "10M"
544
545# A list of values for the Accept-Language HTTP header used when
546# downloading webpages during URL preview generation. This allows
547# Synapse to specify the preferred languages that URL previews should
548# be in when communicating with remote servers.
549#
550# Each value is a IETF language tag; a 2-3 letter identifier for a
551# language, optionally followed by subtags separated by '-', specifying
552# a country or region variant.
553#
554# Multiple values can be provided, and a weight can be added to each by
555# using quality value syntax (;q=). '*' translates to any language.
556#
557# Defaults to "en".
558#
559# Example:
560#
561# url_preview_accept_language:
562# - en-UK
563# - en-US;q=0.9
564# - fr;q=0.8
565# - *;q=0.7
566#
567url_preview_accept_language:
568# - en
569
570
571## Captcha ##
572# See docs/CAPTCHA_SETUP.md for full details of configuring this.
573
574# This Home Server's ReCAPTCHA public key.
575recaptcha_public_key: "YOUR_PUBLIC_KEY"
576
577# This Home Server's ReCAPTCHA private key.
578recaptcha_private_key: "YOUR_PRIVATE_KEY"
579
580# Enables ReCaptcha checks when registering, preventing signup
581# unless a captcha is answered. Requires a valid ReCaptcha
582# public/private key.
583enable_registration_captcha: False
584
585# The API endpoint to use for verifying m.login.recaptcha responses.
586recaptcha_siteverify_api: "https://www.google.com/recaptcha/api/siteverify"
587
588
589## TURN ##
590
591# The public URIs of the TURN server to give to clients
592turn_uris: []
593
594# The shared secret used to compute passwords for the TURN server
595turn_shared_secret: "YOUR_SHARED_SECRET"
596
597# The Username and password if the TURN server needs them and
598# does not use a token
599#turn_username: "TURNSERVER_USERNAME"
600#turn_password: "TURNSERVER_PASSWORD"
601
602# How long generated TURN credentials last
603turn_user_lifetime: "1h"
604
605# Whether guests should be allowed to use the TURN server.
606# This defaults to True, otherwise VoIP will be unreliable for guests.
607# However, it does introduce a slight security risk as it allows users to
608# connect to arbitrary endpoints without having first signed up for a
609# valid account (e.g. by passing a CAPTCHA).
610turn_allow_guests: False
611
612
613## Registration ##
614
615# Enable registration for new users.
616#
617enable_registration: false
618
619# Optional account validity configuration. This allows for accounts to be denied
620# any request after a given period.
621#
622# Once this feature is enabled, Synapse will look for registered users without an
623# expiration date at startup and will add one to every account it found using the
624# current settings at that time.
625# This means that, if a validity period is set, and Synapse is restarted (it will
626# then derive an expiration date from the current validity period), and some time
627# after that the validity period changes and Synapse is restarted, the users'
628# expiration dates won't be updated unless their account is manually renewed. This
629# date will be randomly selected within a range [now + period - d ; now + period],
630# where d is equal to 10% of the validity period.
631#
632account_validity:
633 # The account validity feature is disabled by default. Uncomment the
634 # following line to enable it.
635 #
636 #enabled: true
637
638 # The period after which an account is valid after its registration. When
639 # renewing the account, its validity period will be extended by this amount
640 # of time. This parameter is required when using the account validity
641 # feature.
642 #
643 #period: 6w
644
645 # The amount of time before an account's expiry date at which Synapse will
646 # send an email to the account's email address with a renewal link. By
647 # default, no such emails are sent.
648 #
649 # If you enable this setting, you will also need to fill out the 'email' and
650 # 'public_baseurl' configuration sections.
651 #
652 #renew_at: 1w
653
654 # The subject of the email sent out with the renewal link. '%(app)s' can be
655 # used as a placeholder for the 'app_name' parameter from the 'email'
656 # section.
657 #
658 # Note that the placeholder must be written '%(app)s', including the
659 # trailing 's'.
660 #
661 # If this is not set, a default value is used.
662 #
663 #renew_email_subject: "Renew your %(app)s account"
664
665 # Directory in which Synapse will try to find templates for the HTML files to
666 # serve to the user when trying to renew an account. If not set, default
667 # templates from within the Synapse package will be used.
668 #
669 #template_dir: "res/templates"
670
671 # File within 'template_dir' giving the HTML to be displayed to the user after
672 # they successfully renewed their account. If not set, default text is used.
673 #
674 #account_renewed_html_path: "account_renewed.html"
675
676 # File within 'template_dir' giving the HTML to be displayed when the user
677 # tries to renew an account with an invalid renewal token. If not set,
678 # default text is used.
679 #
680 #invalid_token_html_path: "invalid_token.html"
681
682# Time that a user's session remains valid for, after they log in.
683#
684# Note that this is not currently compatible with guest logins.
685#
686# Note also that this is calculated at login time: changes are not applied
687# retrospectively to users who have already logged in.
688#
689# By default, this is infinite.
690#
691#session_lifetime: 24h
692
693# The user must provide all of the below types of 3PID when registering.
694#
695# registrations_require_3pid:
696# - email
697# - msisdn
698
699# Explicitly disable asking for MSISDNs from the registration
700# flow (overrides registrations_require_3pid if MSISDNs are set as required)
701#
702#disable_msisdn_registration: true
703
704# Mandate that users are only allowed to associate certain formats of
705# 3PIDs with accounts on this server.
706#
707# allowed_local_3pids:
708# - medium: email
709# pattern: ".*@matrix\.org"
710# - medium: email
711# pattern: ".*@vector\.im"
712# - medium: msisdn
713# pattern: "\+44"
714
715# Enable 3PIDs lookup requests to identity servers from this server.
716#
717#enable_3pid_lookup: true
718
719# If set, allows registration of standard or admin accounts by anyone who
720# has the shared secret, even if registration is otherwise disabled.
721#
722registration_shared_secret: "pc2d4lKyg16LSNLxcMtvSjOZfBy5R1a6"
723
724
725# Set the number of bcrypt rounds used to generate password hash.
726# Larger numbers increase the work factor needed to generate the hash.
727# The default number is 12 (which equates to 2^12 rounds).
728# N.B. that increasing this will exponentially increase the time required
729# to register or login - e.g. 24 => 2^24 rounds which will take >20 mins.
730bcrypt_rounds: 12
731
732# Allows users to register as guests without a password/email/etc, and
733# participate in rooms hosted on this server which have been made
734# accessible to anonymous users.
735allow_guest_access: False
736
737# The identity server which we suggest that clients should use when users log
738# in on this server.
739#
740# (By default, no suggestion is made, so it is left up to the client.
741# This setting is ignored unless public_baseurl is also set.)
742#
743#default_identity_server: https://matrix.org
744
745# The list of identity servers trusted to verify third party
746# identifiers by this server.
747#
748# Also defines the ID server which will be called when an account is
749# deactivated (one will be picked arbitrarily).
750#
751# Note: This option is deprecated. Since v0.99.4, Synapse has tracked which identity
752# server a 3PID has been bound to. For 3PIDs bound before then, Synapse runs a
753# background migration script, informing itself that the identity server all of its
754# 3PIDs have been bound to is likely one of the below.
755#
756# As of Synapse v1.4.0, all other functionality of this option has been deprecated, and
757# it is now solely used for the purposes of the background migration script, and can be
758# removed once it has run.
759trusted_third_party_id_servers:
760 - matrix.org
761 - vector.im
762 - riot.im
763
764# Handle threepid (email/phone etc) registration and password resets through a set of
765# *trusted* identity servers. Note that this allows the configured identity server to
766# reset passwords for accounts!
767#
768# Be aware that if `email` is not set, and SMTP options have not been
769# configured in the email config block, registration and user password resets via
770# email will be globally disabled.
771#
772# Additionally, if `msisdn` is not set, registration and password resets via msisdn
773# will be disabled regardless. This is due to Synapse currently not supporting any
774# method of sending SMS messages on its own.
775#
776# To enable using an identity server for operations regarding a particular third-party
777# identifier type, set the value to the URL of that identity server as shown in the
778# examples below.
779#
780# Servers handling the these requests must answer the `/requestToken` endpoints defined
781# by the Matrix Identity Service API specification:
782# https://matrix.org/docs/spec/identity_service/latest
783#
784# If a delegate is specified, the config option public_baseurl must also be filled out.
785#
786account_threepid_delegates:
787 #email: https://example.com # Delegate email sending to example.com
788 #msisdn: http://localhost:8090 # Delegate SMS sending to this local process
789
790# Whether users are allowed to change their displayname after it has
791# been initially set. Useful when provisioning users based on the
792# contents of a third-party directory.
793#
794# Does not apply to server administrators. Defaults to 'true'
795#
796#enable_set_displayname: false
797
798# Whether users are allowed to change their avatar after it has been
799# initially set. Useful when provisioning users based on the contents
800# of a third-party directory.
801#
802# Does not apply to server administrators. Defaults to 'true'
803#
804#enable_set_avatar_url: false
805
806# Whether users can change the 3PIDs associated with their accounts
807# (email address and msisdn).
808#
809# Defaults to 'true'
810#
811#enable_3pid_changes: false
812
813# Users who register on this homeserver will automatically be joined
814# to these rooms
815#auto_join_rooms:
816# - "#example:example.com"
817
818
819## Metrics ###
820
821# Enable collection and rendering of performance metrics
822enable_metrics: False
823
824## API Configuration ##
825
826# A list of event types that will be included in the room_invite_state
827room_invite_state_types:
828 - "m.room.join_rules"
829 - "m.room.canonical_alias"
830 - "m.room.avatar"
831 - "m.room.encryption"
832 - "m.room.name"
833
834
835# A list of application service config file to use
836app_service_config_files: []
837
838
839# macaroon_secret_key: <PRIVATE STRING>
840
841# Used to enable access token expiration.
842expire_access_token: False
843
844## Signing Keys ##
845
846# Path to the signing key to sign messages with
847signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"
848
849# The keys that the server used to sign messages with but won't use
850# to sign new messages. E.g. it has lost its private key
851old_signing_keys: {}
852# "ed25519:auto":
853# # Base64 encoded public key
854# key: "The public part of your old signing key."
855# # Millisecond POSIX timestamp when the key expired.
856# expired_ts: 123456789123
857
858# How long key response published by this server is valid for.
859# Used to set the valid_until_ts in /key/v2 APIs.
860# Determines how quickly servers will query to check which keys
861# are still valid.
862key_refresh_interval: "1d" # 1 Day.
863
864# The trusted servers to download signing keys from.
865#
866# When we need to fetch a signing key, each server is tried in parallel.
867#
868# Normally, the connection to the key server is validated via TLS certificates.
869# Additional security can be provided by configuring a `verify key`, which
870# will make synapse check that the response is signed by that key.
871#
872# This setting supercedes an older setting named `perspectives`. The old format
873# is still supported for backwards-compatibility, but it is deprecated.
874#
875# 'trusted_key_servers' defaults to matrix.org, but using it will generate a
876# warning on start-up. To suppress this warning, set
877# 'suppress_key_server_warning' to true.
878#
879# Options for each entry in the list include:
880#
881# server_name: the name of the server. required.
882#
883# verify_keys: an optional map from key id to base64-encoded public key.
884# If specified, we will check that the response is signed by at least
885# one of the given keys.
886#
887# accept_keys_insecurely: a boolean. Normally, if `verify_keys` is unset,
888# and federation_verify_certificates is not `true`, synapse will refuse
889# to start, because this would allow anyone who can spoof DNS responses
890# to masquerade as the trusted key server. If you know what you are doing
891# and are sure that your network environment provides a secure connection
892# to the key server, you can set this to `true` to override this
893# behaviour.
894#
895# An example configuration might look like:
896#
897#trusted_key_servers:
898# - server_name: "my_trusted_server.example.com"
899# verify_keys:
900# "ed25519:auto": "abcdefghijklmnopqrstuvwxyzabcdefghijklmopqr"
901# - server_name: "my_other_trusted_server.example.com"
902#
903trusted_key_servers:
904 - server_name: "matrix.org"
905
906# Uncomment the following to disable the warning that is emitted when the
907# trusted_key_servers include 'matrix.org'. See above.
908#
909#suppress_key_server_warning: true
910
911# The signing keys to use when acting as a trusted key server. If not specified
912# defaults to the server signing key.
913#
914# Can contain multiple keys, one per line.
915#
916#key_server_signing_keys_path: "key_server_signing_keys.key"
917
918
919## Single sign-on integration ##
920
921# Enable SAML2 for registration and login. Uses pysaml2.
922#
923# At least one of `sp_config` or `config_path` must be set in this section to
924# enable SAML login.
925#
926# (You will probably also want to set the following options to `false` to
927# disable the regular login/registration flows:
928# * enable_registration
929# * password_config.enabled
930#
931# Once SAML support is enabled, a metadata file will be exposed at
932# https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
933# use to configure your SAML IdP with. Alternatively, you can manually configure
934# the IdP to use an ACS location of
935# https://<server>:<port>/_matrix/saml2/authn_response.
936#
937saml2_config:
938 # `sp_config` is the configuration for the pysaml2 Service Provider.
939 # See pysaml2 docs for format of config.
940 #
941 # Default values will be used for the 'entityid' and 'service' settings,
942 # so it is not normally necessary to specify them unless you need to
943 # override them.
944 #
945 #sp_config:
946 # # point this to the IdP's metadata. You can use either a local file or
947 # # (preferably) a URL.
948 # metadata:
949 # #local: ["saml2/idp.xml"]
950 # remote:
951 # - url: https://our_idp/metadata.xml
952 #
953 # # By default, the user has to go to our login page first. If you'd like
954 # # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
955 # # 'service.sp' section:
956 # #
957 # #service:
958 # # sp:
959 # # allow_unsolicited: true
960 #
961 # # The examples below are just used to generate our metadata xml, and you
962 # # may well not need them, depending on your setup. Alternatively you
963 # # may need a whole lot more detail - see the pysaml2 docs!
964 #
965 # description: ["My awesome SP", "en"]
966 # name: ["Test SP", "en"]
967 #
968 # organization:
969 # name: Example com
970 # display_name:
971 # - ["Example co", "en"]
972 # url: "http://example.com"
973 #
974 # contact_person:
975 # - given_name: Bob
976 # sur_name: "the Sysadmin"
977 # email_address": ["admin@example.com"]
978 # contact_type": technical
979
980 # Instead of putting the config inline as above, you can specify a
981 # separate pysaml2 configuration file:
982 #
983 #config_path: "CONFDIR/sp_conf.py"
984
985 # the lifetime of a SAML session. This defines how long a user has to
986 # complete the authentication process, if allow_unsolicited is unset.
987 # The default is 5 minutes.
988 #
989 #saml_session_lifetime: 5m
990
991 # An external module can be provided here as a custom solution to
992 # mapping attributes returned from a saml provider onto a matrix user.
993 #
994 user_mapping_provider:
995 # The custom module's class. Uncomment to use a custom module.
996 #
997 #module: mapping_provider.SamlMappingProvider
998
999 # Custom configuration values for the module. Below options are
1000 # intended for the built-in provider, they should be changed if
1001 # using a custom module. This section will be passed as a Python
1002 # dictionary to the module's `parse_config` method.
1003 #
1004 config:
1005 # The SAML attribute (after mapping via the attribute maps) to use
1006 # to derive the Matrix ID from. 'uid' by default.
1007 #
1008 # Note: This used to be configured by the
1009 # saml2_config.mxid_source_attribute option. If that is still
1010 # defined, its value will be used instead.
1011 #
1012 #mxid_source_attribute: displayName
1013
1014 # The mapping system to use for mapping the saml attribute onto a
1015 # matrix ID.
1016 #
1017 # Options include:
1018 # * 'hexencode' (which maps unpermitted characters to '=xx')
1019 # * 'dotreplace' (which replaces unpermitted characters with
1020 # '.').
1021 # The default is 'hexencode'.
1022 #
1023 # Note: This used to be configured by the
1024 # saml2_config.mxid_mapping option. If that is still defined, its
1025 # value will be used instead.
1026 #
1027 #mxid_mapping: dotreplace
1028
1029 # In previous versions of synapse, the mapping from SAML attribute to MXID was
1030 # always calculated dynamically rather than stored in a table. For backwards-
1031 # compatibility, we will look for user_ids matching such a pattern before
1032 # creating a new account.
1033 #
1034 # This setting controls the SAML attribute which will be used for this
1035 # backwards-compatibility lookup. Typically it should be 'uid', but if the
1036 # attribute maps are changed, it may be necessary to change it.
1037 #
1038 # The default is 'uid'.
1039 #
1040 #grandfathered_mxid_source_attribute: upn
1041
1042 # Directory in which Synapse will try to find the template files below.
1043 # If not set, default templates from within the Synapse package will be used.
1044 #
1045 # DO NOT UNCOMMENT THIS SETTING unless you want to customise the templates.
1046 # If you *do* uncomment it, you will need to make sure that all the templates
1047 # below are in the directory.
1048 #
1049 # Synapse will look for the following templates in this directory:
1050 #
1051 # * HTML page to display to users if something goes wrong during the
1052 # authentication process: 'saml_error.html'.
1053 #
1054 # When rendering, this template is given the following variables:
1055 # * code: an HTML error code corresponding to the error that is being
1056 # returned (typically 400 or 500)
1057 #
1058 # * msg: a textual message describing the error.
1059 #
1060 # The variables will automatically be HTML-escaped.
1061 #
1062 # You can see the default templates at:
1063 # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
1064 #
1065 #template_dir: "res/templates"
1066
1067
1068# OpenID Connect integration. The following settings can be used to make Synapse
1069# use an OpenID Connect Provider for authentication, instead of its internal
1070# password database.
1071#
1072# See https://github.com/matrix-org/synapse/blob/master/openid.md.
1073#
1074oidc_config:
1075 # Uncomment the following to enable authorization against an OpenID Connect
1076 # server. Defaults to false.
1077 #
1078 #enabled: true
1079
1080 # Uncomment the following to disable use of the OIDC discovery mechanism to
1081 # discover endpoints. Defaults to true.
1082 #
1083 #discover: false
1084
1085 # the OIDC issuer. Used to validate tokens and (if discovery is enabled) to
1086 # discover the provider's endpoints.
1087 #
1088 # Required if 'enabled' is true.
1089 #
1090 #issuer: "https://accounts.example.com/"
1091
1092 # oauth2 client id to use.
1093 #
1094 # Required if 'enabled' is true.
1095 #
1096 #client_id: "provided-by-your-issuer"
1097
1098 # oauth2 client secret to use.
1099 #
1100 # Required if 'enabled' is true.
1101 #
1102 #client_secret: "provided-by-your-issuer"
1103
1104 # auth method to use when exchanging the token.
1105 # Valid values are 'client_secret_basic' (default), 'client_secret_post' and
1106 # 'none'.
1107 #
1108 #client_auth_method: client_secret_post
1109
1110 # list of scopes to request. This should normally include the "openid" scope.
1111 # Defaults to ["openid"].
1112 #
1113 #scopes: ["openid", "profile"]
1114
1115 # the oauth2 authorization endpoint. Required if provider discovery is disabled.
1116 #
1117 #authorization_endpoint: "https://accounts.example.com/oauth2/auth"
1118
1119 # the oauth2 token endpoint. Required if provider discovery is disabled.
1120 #
1121 #token_endpoint: "https://accounts.example.com/oauth2/token"
1122
1123 # the OIDC userinfo endpoint. Required if discovery is disabled and the
1124 # "openid" scope is not requested.
1125 #
1126 #userinfo_endpoint: "https://accounts.example.com/userinfo"
1127
1128 # URI where to fetch the JWKS. Required if discovery is disabled and the
1129 # "openid" scope is used.
1130 #
1131 #jwks_uri: "https://accounts.example.com/.well-known/jwks.json"
1132
1133 # Uncomment to skip metadata verification. Defaults to false.
1134 #
1135 # Use this if you are connecting to a provider that is not OpenID Connect
1136 # compliant.
1137 # Avoid this in production.
1138 #
1139 #skip_verification: true
1140
1141 # An external module can be provided here as a custom solution to mapping
1142 # attributes returned from a OIDC provider onto a matrix user.
1143 #
1144 user_mapping_provider:
1145 # The custom module's class. Uncomment to use a custom module.
1146 # Default is 'synapse.handlers.oidc_handler.JinjaOidcMappingProvider'.
1147 #
1148 # See https://github.com/matrix-org/synapse/blob/master/docs/sso_mapping_providers.md#openid-mapping-providers
1149 # for information on implementing a custom mapping provider.
1150 #
1151 #module: mapping_provider.OidcMappingProvider
1152
1153 # Custom configuration values for the module. This section will be passed as
1154 # a Python dictionary to the user mapping provider module's `parse_config`
1155 # method.
1156 #
1157 # The examples below are intended for the default provider: they should be
1158 # changed if using a custom provider.
1159 #
1160 config:
1161 # name of the claim containing a unique identifier for the user.
1162 # Defaults to `sub`, which OpenID Connect compliant providers should provide.
1163 #
1164 #subject_claim: "sub"
1165
1166 # Jinja2 template for the localpart of the MXID.
1167 #
1168 # When rendering, this template is given the following variables:
1169 # * user: The claims returned by the UserInfo Endpoint and/or in the ID
1170 # Token
1171 #
1172 # This must be configured if using the default mapping provider.
1173 #
1174 localpart_template: "{{ user.preferred_username }}"
1175
1176 # Jinja2 template for the display name to set on first login.
1177 #
1178 # If unset, no displayname will be set.
1179 #
1180 #display_name_template: "{{ user.given_name }} {{ user.last_name }}"
1181
1182
1183
1184# Enable CAS for registration and login.
1185#cas_config:
1186# enabled: true
1187# server_url: "https://cas-server.com"
1188# service_url: "https://homeserver.domain.com:8448"
1189# #displayname_attribute: name
1190# #required_attributes:
1191# # name: value
1192
1193
1194# Additional settings to use with single-sign on systems such as OpenID Connect,
1195# SAML2 and CAS.
1196#
1197sso:
1198 # A list of client URLs which are whitelisted so that the user does not
1199 # have to confirm giving access to their account to the URL. Any client
1200 # whose URL starts with an entry in the following list will not be subject
1201 # to an additional confirmation step after the SSO login is completed.
1202 #
1203 # WARNING: An entry such as "https://my.client" is insecure, because it
1204 # will also match "https://my.client.evil.site", exposing your users to
1205 # phishing attacks from evil.site. To avoid this, include a slash after the
1206 # hostname: "https://my.client/".
1207 #
1208 # If public_baseurl is set, then the login fallback page (used by clients
1209 # that don't natively support the required login flows) is whitelisted in
1210 # addition to any URLs in this list.
1211 #
1212 # By default, this list is empty.
1213 #
1214 #client_whitelist:
1215 # - https://riot.im/develop
1216 # - https://my.custom.client/
1217
1218 # Directory in which Synapse will try to find the template files below.
1219 # If not set, default templates from within the Synapse package will be used.
1220 #
1221 # DO NOT UNCOMMENT THIS SETTING unless you want to customise the templates.
1222 # If you *do* uncomment it, you will need to make sure that all the templates
1223 # below are in the directory.
1224 #
1225 # Synapse will look for the following templates in this directory:
1226 #
1227 # * HTML page for a confirmation step before redirecting back to the client
1228 # with the login token: 'sso_redirect_confirm.html'.
1229 #
1230 # When rendering, this template is given three variables:
1231 # * redirect_url: the URL the user is about to be redirected to. Needs
1232 # manual escaping (see
1233 # https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
1234 #
1235 # * display_url: the same as `redirect_url`, but with the query
1236 # parameters stripped. The intention is to have a
1237 # human-readable URL to show to users, not to use it as
1238 # the final address to redirect to. Needs manual escaping
1239 # (see https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
1240 #
1241 # * server_name: the homeserver's name.
1242 #
1243 # * HTML page which notifies the user that they are authenticating to confirm
1244 # an operation on their account during the user interactive authentication
1245 # process: 'sso_auth_confirm.html'.
1246 #
1247 # When rendering, this template is given the following variables:
1248 # * redirect_url: the URL the user is about to be redirected to. Needs
1249 # manual escaping (see
1250 # https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
1251 #
1252 # * description: the operation which the user is being asked to confirm
1253 #
1254 # * HTML page shown after a successful user interactive authentication session:
1255 # 'sso_auth_success.html'.
1256 #
1257 # Note that this page must include the JavaScript which notifies of a successful authentication
1258 # (see https://matrix.org/docs/spec/client_server/r0.6.0#fallback).
1259 #
1260 # This template has no additional variables.
1261 #
1262 # * HTML page shown during single sign-on if a deactivated user (according to Synapse's database)
1263 # attempts to login: 'sso_account_deactivated.html'.
1264 #
1265 # This template has no additional variables.
1266 #
1267 # * HTML page to display to users if something goes wrong during the
1268 # OpenID Connect authentication process: 'sso_error.html'.
1269 #
1270 # When rendering, this template is given two variables:
1271 # * error: the technical name of the error
1272 # * error_description: a human-readable message for the error
1273 #
1274 # You can see the default templates at:
1275 # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
1276 #
1277 #template_dir: "res/templates"
1278
1279
1280# The JWT needs to contain a globally unique "sub" (subject) claim.
1281#
1282# jwt_config:
1283# enabled: true
1284# secret: "a secret"
1285# algorithm: "HS256"
1286
1287
1288
1289# Enable password for login.
1290password_config:
1291 enabled: true
1292 # Uncomment and change to a secret random string for extra security.
1293 # DO NOT CHANGE THIS AFTER INITIAL SETUP!
1294 #
1295 #pepper: "EVEN_MORE_SECRET"
1296
1297 # Define and enforce a password policy. Each parameter is optional.
1298 # This is an implementation of MSC2000.
1299 #
1300 policy:
1301 # Whether to enforce the password policy.
1302 # Defaults to 'false'.
1303 #
1304 #enabled: true
1305
1306 # Minimum accepted length for a password.
1307 # Defaults to 0.
1308 #
1309 #minimum_length: 15
1310
1311 # Whether a password must contain at least one digit.
1312 # Defaults to 'false'.
1313 #
1314 #require_digit: true
1315
1316 # Whether a password must contain at least one symbol.
1317 # A symbol is any character that's not a number or a letter.
1318 # Defaults to 'false'.
1319 #
1320 #require_symbol: true
1321
1322 # Whether a password must contain at least one lowercase letter.
1323 # Defaults to 'false'.
1324 #
1325 #require_lowercase: true
1326
1327 # Whether a password must contain at least one lowercase letter.
1328 # Defaults to 'false'.
1329 #
1330 #require_uppercase: true
1331
1332# Enable sending emails for notification events
1333# Defining a custom URL for Riot is only needed if email notifications
1334# should contain links to a self-hosted installation of Riot; when set
1335# the "app_name" setting is ignored.
1336#
1337# If your SMTP server requires authentication, the optional smtp_user &
1338# smtp_pass variables should be used
1339#
1340#email:
1341# enable_notifs: false
1342# smtp_host: "localhost"
1343# smtp_port: 25
1344# smtp_user: "exampleusername"
1345# smtp_pass: "examplepassword"
1346# require_transport_security: False
1347# notif_from: "Your Friendly %(app)s Home Server <noreply@example.com>"
1348# app_name: Matrix
1349# template_dir: res/templates
1350# notif_template_html: notif_mail.html
1351# notif_template_text: notif_mail.txt
1352# notif_for_new_users: True
1353# riot_base_url: "http://localhost/riot"
1354
1355
1356# password_providers:
1357# - module: "ldap_auth_provider.LdapAuthProvider"
1358# config:
1359# enabled: true
1360# uri: "ldap://ldap.example.com:389"
1361# start_tls: true
1362# base: "ou=users,dc=example,dc=com"
1363# attributes:
1364# uid: "cn"
1365# mail: "email"
1366# name: "givenName"
1367# #bind_dn:
1368# #bind_password:
1369# #filter: "(objectClass=posixAccount)"
1370
1371
1372
1373# Clients requesting push notifications can either have the body of
1374# the message sent in the notification poke along with other details
1375# like the sender, or just the event ID and room ID (`event_id_only`).
1376# If clients choose the former, this option controls whether the
1377# notification request includes the content of the event (other details
1378# like the sender are still included). For `event_id_only` push, it
1379# has no effect.
1380
1381# For modern android devices the notification content will still appear
1382# because it is loaded by the app. iPhone, however will send a
1383# notification saying only that a message arrived and who it came from.
1384#
1385#push:
1386# include_content: true
1387
1388
1389# Spam checkers are third-party modules that can block specific actions
1390# of local users, such as creating rooms and registering undesirable
1391# usernames, as well as remote users by redacting incoming events.
1392#
1393spam_checker:
1394 #- module: "my_custom_project.SuperSpamChecker"
1395 # config:
1396 # example_option: 'things'
1397 #- module: "some_other_project.BadEventStopper"
1398 # config:
1399 # example_stop_events_from: ['@bad:example.com']
1400
1401
1402# Whether to allow non server admins to create groups on this server
1403enable_group_creation: false
1404
1405# If enabled, non server admins can only create groups with local parts
1406# starting with this prefix
1407# group_creation_prefix: "unofficial/"
1408
1409
1410
1411# User Directory configuration
1412#
1413# 'search_all_users' defines whether to search all users visible to your HS
1414# when searching the user directory, rather than limiting to users visible
1415# in public rooms. Defaults to false. If you set it True, you'll have to run
1416# UPDATE user_directory_stream_pos SET stream_id = NULL;
1417# on your database to tell it to rebuild the user_directory search indexes.
1418#
1419#user_directory:
1420# search_all_users: false
1421