sample_config.yaml 101 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855
  1. # This file is maintained as an up-to-date snapshot of the default
  2. # homeserver.yaml configuration generated by Synapse.
  3. #
  4. # It is intended to act as a reference for the default configuration,
  5. # helping admins keep track of new options and other changes, and compare
  6. # their configs with the current default. As such, many of the actual
  7. # config values shown are placeholders.
  8. #
  9. # It is *not* intended to be copied and used as the basis for a real
  10. # homeserver.yaml. Instead, if you are starting from scratch, please generate
  11. # a fresh config using Synapse by following the instructions in
  12. # https://matrix-org.github.io/synapse/latest/setup/installation.html.
  13. # Configuration options that take a time period can be set using a number
  14. # followed by a letter. Letters have the following meanings:
  15. # s = second
  16. # m = minute
  17. # h = hour
  18. # d = day
  19. # w = week
  20. # y = year
  21. # For example, setting redaction_retention_period: 5m would remove redacted
  22. # messages from the database after 5 minutes, rather than 5 months.
  23. ################################################################################
  24. # Configuration file for Synapse.
  25. #
  26. # This is a YAML file: see [1] for a quick introduction. Note in particular
  27. # that *indentation is important*: all the elements of a list or dictionary
  28. # should have the same indentation.
  29. #
  30. # [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
  31. ## Modules ##
  32. # Server admins can expand Synapse's functionality with external modules.
  33. #
  34. # See https://matrix-org.github.io/synapse/latest/modules/index.html for more
  35. # documentation on how to configure or create custom modules for Synapse.
  36. #
  37. modules:
  38. #- module: my_super_module.MySuperClass
  39. # config:
  40. # do_thing: true
  41. #- module: my_other_super_module.SomeClass
  42. # config: {}
  43. ## Server ##
  44. # The public-facing domain of the server
  45. #
  46. # The server_name name will appear at the end of usernames and room addresses
  47. # created on this server. For example if the server_name was example.com,
  48. # usernames on this server would be in the format @user:example.com
  49. #
  50. # In most cases you should avoid using a matrix specific subdomain such as
  51. # matrix.example.com or synapse.example.com as the server_name for the same
  52. # reasons you wouldn't use user@email.example.com as your email address.
  53. # See https://matrix-org.github.io/synapse/latest/delegate.html
  54. # for information on how to host Synapse on a subdomain while preserving
  55. # a clean server_name.
  56. #
  57. # The server_name cannot be changed later so it is important to
  58. # configure this correctly before you start Synapse. It should be all
  59. # lowercase and may contain an explicit port.
  60. # Examples: matrix.org, localhost:8080
  61. #
  62. server_name: "SERVERNAME"
  63. # When running as a daemon, the file to store the pid in
  64. #
  65. pid_file: DATADIR/homeserver.pid
  66. # The absolute URL to the web client which / will redirect to.
  67. #
  68. #web_client_location: https://riot.example.com/
  69. # The public-facing base URL that clients use to access this Homeserver (not
  70. # including _matrix/...). This is the same URL a user might enter into the
  71. # 'Custom Homeserver URL' field on their client. If you use Synapse with a
  72. # reverse proxy, this should be the URL to reach Synapse via the proxy.
  73. # Otherwise, it should be the URL to reach Synapse's client HTTP listener (see
  74. # 'listeners' below).
  75. #
  76. # Defaults to 'https://<server_name>/'.
  77. #
  78. #public_baseurl: https://example.com/
  79. # Uncomment the following to tell other servers to send federation traffic on
  80. # port 443.
  81. #
  82. # By default, other servers will try to reach our server on port 8448, which can
  83. # be inconvenient in some environments.
  84. #
  85. # Provided 'https://<server_name>/' on port 443 is routed to Synapse, this
  86. # option configures Synapse to serve a file at
  87. # 'https://<server_name>/.well-known/matrix/server'. This will tell other
  88. # servers to send traffic to port 443 instead.
  89. #
  90. # See https://matrix-org.github.io/synapse/latest/delegate.html for more
  91. # information.
  92. #
  93. # Defaults to 'false'.
  94. #
  95. #serve_server_wellknown: true
  96. # Set the soft limit on the number of file descriptors synapse can use
  97. # Zero is used to indicate synapse should set the soft limit to the
  98. # hard limit.
  99. #
  100. #soft_file_limit: 0
  101. # Presence tracking allows users to see the state (e.g online/offline)
  102. # of other local and remote users.
  103. #
  104. presence:
  105. # Uncomment to disable presence tracking on this homeserver. This option
  106. # replaces the previous top-level 'use_presence' option.
  107. #
  108. #enabled: false
  109. # Whether to require authentication to retrieve profile data (avatars,
  110. # display names) of other users through the client API. Defaults to
  111. # 'false'. Note that profile data is also available via the federation
  112. # API, unless allow_profile_lookup_over_federation is set to false.
  113. #
  114. #require_auth_for_profile_requests: true
  115. # Uncomment to require a user to share a room with another user in order
  116. # to retrieve their profile information. Only checked on Client-Server
  117. # requests. Profile requests from other servers should be checked by the
  118. # requesting server. Defaults to 'false'.
  119. #
  120. #limit_profile_requests_to_users_who_share_rooms: true
  121. # Uncomment to prevent a user's profile data from being retrieved and
  122. # displayed in a room until they have joined it. By default, a user's
  123. # profile data is included in an invite event, regardless of the values
  124. # of the above two settings, and whether or not the users share a server.
  125. # Defaults to 'true'.
  126. #
  127. #include_profile_data_on_invite: false
  128. # If set to 'true', removes the need for authentication to access the server's
  129. # public rooms directory through the client API, meaning that anyone can
  130. # query the room directory. Defaults to 'false'.
  131. #
  132. #allow_public_rooms_without_auth: true
  133. # If set to 'true', allows any other homeserver to fetch the server's public
  134. # rooms directory via federation. Defaults to 'false'.
  135. #
  136. #allow_public_rooms_over_federation: true
  137. # The default room version for newly created rooms.
  138. #
  139. # Known room versions are listed here:
  140. # https://spec.matrix.org/latest/rooms/#complete-list-of-room-versions
  141. #
  142. # For example, for room version 1, default_room_version should be set
  143. # to "1".
  144. #
  145. #default_room_version: "9"
  146. # The GC threshold parameters to pass to `gc.set_threshold`, if defined
  147. #
  148. #gc_thresholds: [700, 10, 10]
  149. # The minimum time in seconds between each GC for a generation, regardless of
  150. # the GC thresholds. This ensures that we don't do GC too frequently.
  151. #
  152. # A value of `[1s, 10s, 30s]` indicates that a second must pass between consecutive
  153. # generation 0 GCs, etc.
  154. #
  155. # Defaults to `[1s, 10s, 30s]`.
  156. #
  157. #gc_min_interval: [0.5s, 30s, 1m]
  158. # Set the limit on the returned events in the timeline in the get
  159. # and sync operations. The default value is 100. -1 means no upper limit.
  160. #
  161. # Uncomment the following to increase the limit to 5000.
  162. #
  163. #filter_timeline_limit: 5000
  164. # Whether room invites to users on this server should be blocked
  165. # (except those sent by local server admins). The default is False.
  166. #
  167. #block_non_admin_invites: true
  168. # Room searching
  169. #
  170. # If disabled, new messages will not be indexed for searching and users
  171. # will receive errors when searching for messages. Defaults to enabled.
  172. #
  173. #enable_search: false
  174. # Prevent outgoing requests from being sent to the following blacklisted IP address
  175. # CIDR ranges. If this option is not specified then it defaults to private IP
  176. # address ranges (see the example below).
  177. #
  178. # The blacklist applies to the outbound requests for federation, identity servers,
  179. # push servers, and for checking key validity for third-party invite events.
  180. #
  181. # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
  182. # listed here, since they correspond to unroutable addresses.)
  183. #
  184. # This option replaces federation_ip_range_blacklist in Synapse v1.25.0.
  185. #
  186. # Note: The value is ignored when an HTTP proxy is in use
  187. #
  188. #ip_range_blacklist:
  189. # - '127.0.0.0/8'
  190. # - '10.0.0.0/8'
  191. # - '172.16.0.0/12'
  192. # - '192.168.0.0/16'
  193. # - '100.64.0.0/10'
  194. # - '192.0.0.0/24'
  195. # - '169.254.0.0/16'
  196. # - '192.88.99.0/24'
  197. # - '198.18.0.0/15'
  198. # - '192.0.2.0/24'
  199. # - '198.51.100.0/24'
  200. # - '203.0.113.0/24'
  201. # - '224.0.0.0/4'
  202. # - '::1/128'
  203. # - 'fe80::/10'
  204. # - 'fc00::/7'
  205. # - '2001:db8::/32'
  206. # - 'ff00::/8'
  207. # - 'fec0::/10'
  208. # List of IP address CIDR ranges that should be allowed for federation,
  209. # identity servers, push servers, and for checking key validity for
  210. # third-party invite events. This is useful for specifying exceptions to
  211. # wide-ranging blacklisted target IP ranges - e.g. for communication with
  212. # a push server only visible in your network.
  213. #
  214. # This whitelist overrides ip_range_blacklist and defaults to an empty
  215. # list.
  216. #
  217. #ip_range_whitelist:
  218. # - '192.168.1.1'
  219. # List of ports that Synapse should listen on, their purpose and their
  220. # configuration.
  221. #
  222. # Options for each listener include:
  223. #
  224. # port: the TCP port to bind to
  225. #
  226. # bind_addresses: a list of local addresses to listen on. The default is
  227. # 'all local interfaces'.
  228. #
  229. # type: the type of listener. Normally 'http', but other valid options are:
  230. # 'manhole' (see https://matrix-org.github.io/synapse/latest/manhole.html),
  231. # 'metrics' (see https://matrix-org.github.io/synapse/latest/metrics-howto.html),
  232. # 'replication' (see https://matrix-org.github.io/synapse/latest/workers.html).
  233. #
  234. # tls: set to true to enable TLS for this listener. Will use the TLS
  235. # key/cert specified in tls_private_key_path / tls_certificate_path.
  236. #
  237. # x_forwarded: Only valid for an 'http' listener. Set to true to use the
  238. # X-Forwarded-For header as the client IP. Useful when Synapse is
  239. # behind a reverse-proxy.
  240. #
  241. # resources: Only valid for an 'http' listener. A list of resources to host
  242. # on this port. Options for each resource are:
  243. #
  244. # names: a list of names of HTTP resources. See below for a list of
  245. # valid resource names.
  246. #
  247. # compress: set to true to enable HTTP compression for this resource.
  248. #
  249. # additional_resources: Only valid for an 'http' listener. A map of
  250. # additional endpoints which should be loaded via dynamic modules.
  251. #
  252. # Valid resource names are:
  253. #
  254. # client: the client-server API (/_matrix/client), and the synapse admin
  255. # API (/_synapse/admin). Also implies 'media' and 'static'.
  256. #
  257. # consent: user consent forms (/_matrix/consent).
  258. # See https://matrix-org.github.io/synapse/latest/consent_tracking.html.
  259. #
  260. # federation: the server-server API (/_matrix/federation). Also implies
  261. # 'media', 'keys', 'openid'
  262. #
  263. # keys: the key discovery API (/_matrix/key).
  264. #
  265. # media: the media API (/_matrix/media).
  266. #
  267. # metrics: the metrics interface.
  268. # See https://matrix-org.github.io/synapse/latest/metrics-howto.html.
  269. #
  270. # openid: OpenID authentication.
  271. #
  272. # replication: the HTTP replication API (/_synapse/replication).
  273. # See https://matrix-org.github.io/synapse/latest/workers.html.
  274. #
  275. # static: static resources under synapse/static (/_matrix/static). (Mostly
  276. # useful for 'fallback authentication'.)
  277. #
  278. listeners:
  279. # TLS-enabled listener: for when matrix traffic is sent directly to synapse.
  280. #
  281. # Disabled by default. To enable it, uncomment the following. (Note that you
  282. # will also need to give Synapse a TLS key and certificate: see the TLS section
  283. # below.)
  284. #
  285. #- port: 8448
  286. # type: http
  287. # tls: true
  288. # resources:
  289. # - names: [client, federation]
  290. # Unsecure HTTP listener: for when matrix traffic passes through a reverse proxy
  291. # that unwraps TLS.
  292. #
  293. # If you plan to use a reverse proxy, please see
  294. # https://matrix-org.github.io/synapse/latest/reverse_proxy.html.
  295. #
  296. - port: 8008
  297. tls: false
  298. type: http
  299. x_forwarded: true
  300. bind_addresses: ['::1', '127.0.0.1']
  301. resources:
  302. - names: [client, federation]
  303. compress: false
  304. # example additional_resources:
  305. #
  306. #additional_resources:
  307. # "/_matrix/my/custom/endpoint":
  308. # module: my_module.CustomRequestHandler
  309. # config: {}
  310. # Turn on the twisted ssh manhole service on localhost on the given
  311. # port.
  312. #
  313. #- port: 9000
  314. # bind_addresses: ['::1', '127.0.0.1']
  315. # type: manhole
  316. # Connection settings for the manhole
  317. #
  318. manhole_settings:
  319. # The username for the manhole. This defaults to 'matrix'.
  320. #
  321. #username: manhole
  322. # The password for the manhole. This defaults to 'rabbithole'.
  323. #
  324. #password: mypassword
  325. # The private and public SSH key pair used to encrypt the manhole traffic.
  326. # If these are left unset, then hardcoded and non-secret keys are used,
  327. # which could allow traffic to be intercepted if sent over a public network.
  328. #
  329. #ssh_priv_key_path: CONFDIR/id_rsa
  330. #ssh_pub_key_path: CONFDIR/id_rsa.pub
  331. # Forward extremities can build up in a room due to networking delays between
  332. # homeservers. Once this happens in a large room, calculation of the state of
  333. # that room can become quite expensive. To mitigate this, once the number of
  334. # forward extremities reaches a given threshold, Synapse will send an
  335. # org.matrix.dummy_event event, which will reduce the forward extremities
  336. # in the room.
  337. #
  338. # This setting defines the threshold (i.e. number of forward extremities in the
  339. # room) at which dummy events are sent. The default value is 10.
  340. #
  341. #dummy_events_threshold: 5
  342. ## Homeserver blocking ##
  343. # How to reach the server admin, used in ResourceLimitError
  344. #
  345. #admin_contact: 'mailto:admin@server.com'
  346. # Global blocking
  347. #
  348. #hs_disabled: false
  349. #hs_disabled_message: 'Human readable reason for why the HS is blocked'
  350. # Monthly Active User Blocking
  351. #
  352. # Used in cases where the admin or server owner wants to limit to the
  353. # number of monthly active users.
  354. #
  355. # 'limit_usage_by_mau' disables/enables monthly active user blocking. When
  356. # enabled and a limit is reached the server returns a 'ResourceLimitError'
  357. # with error type Codes.RESOURCE_LIMIT_EXCEEDED
  358. #
  359. # 'max_mau_value' is the hard limit of monthly active users above which
  360. # the server will start blocking user actions.
  361. #
  362. # 'mau_trial_days' is a means to add a grace period for active users. It
  363. # means that users must be active for this number of days before they
  364. # can be considered active and guards against the case where lots of users
  365. # sign up in a short space of time never to return after their initial
  366. # session.
  367. #
  368. # The option `mau_appservice_trial_days` is similar to `mau_trial_days`, but
  369. # applies a different trial number if the user was registered by an appservice.
  370. # A value of 0 means no trial days are applied. Appservices not listed in this
  371. # dictionary use the value of `mau_trial_days` instead.
  372. #
  373. # 'mau_limit_alerting' is a means of limiting client side alerting
  374. # should the mau limit be reached. This is useful for small instances
  375. # where the admin has 5 mau seats (say) for 5 specific people and no
  376. # interest increasing the mau limit further. Defaults to True, which
  377. # means that alerting is enabled
  378. #
  379. #limit_usage_by_mau: false
  380. #max_mau_value: 50
  381. #mau_trial_days: 2
  382. #mau_limit_alerting: false
  383. #mau_appservice_trial_days:
  384. # "appservice-id": 1
  385. # If enabled, the metrics for the number of monthly active users will
  386. # be populated, however no one will be limited. If limit_usage_by_mau
  387. # is true, this is implied to be true.
  388. #
  389. #mau_stats_only: false
  390. # Sometimes the server admin will want to ensure certain accounts are
  391. # never blocked by mau checking. These accounts are specified here.
  392. #
  393. #mau_limit_reserved_threepids:
  394. # - medium: 'email'
  395. # address: 'reserved_user@example.com'
  396. # Used by phonehome stats to group together related servers.
  397. #server_context: context
  398. # Resource-constrained homeserver settings
  399. #
  400. # When this is enabled, the room "complexity" will be checked before a user
  401. # joins a new remote room. If it is above the complexity limit, the server will
  402. # disallow joining, or will instantly leave.
  403. #
  404. # Room complexity is an arbitrary measure based on factors such as the number of
  405. # users in the room.
  406. #
  407. limit_remote_rooms:
  408. # Uncomment to enable room complexity checking.
  409. #
  410. #enabled: true
  411. # the limit above which rooms cannot be joined. The default is 1.0.
  412. #
  413. #complexity: 0.5
  414. # override the error which is returned when the room is too complex.
  415. #
  416. #complexity_error: "This room is too complex."
  417. # allow server admins to join complex rooms. Default is false.
  418. #
  419. #admins_can_join: true
  420. # Whether to require a user to be in the room to add an alias to it.
  421. # Defaults to 'true'.
  422. #
  423. #require_membership_for_aliases: false
  424. # Whether to allow per-room membership profiles through the send of membership
  425. # events with profile information that differ from the target's global profile.
  426. # Defaults to 'true'.
  427. #
  428. #allow_per_room_profiles: false
  429. # The largest allowed file size for a user avatar. Defaults to no restriction.
  430. #
  431. # Note that user avatar changes will not work if this is set without
  432. # using Synapse's media repository.
  433. #
  434. #max_avatar_size: 10M
  435. # The MIME types allowed for user avatars. Defaults to no restriction.
  436. #
  437. # Note that user avatar changes will not work if this is set without
  438. # using Synapse's media repository.
  439. #
  440. #allowed_avatar_mimetypes: ["image/png", "image/jpeg", "image/gif"]
  441. # How long to keep redacted events in unredacted form in the database. After
  442. # this period redacted events get replaced with their redacted form in the DB.
  443. #
  444. # Defaults to `7d`. Set to `null` to disable.
  445. #
  446. #redaction_retention_period: 28d
  447. # How long to track users' last seen time and IPs in the database.
  448. #
  449. # Defaults to `28d`. Set to `null` to disable clearing out of old rows.
  450. #
  451. #user_ips_max_age: 14d
  452. # Inhibits the /requestToken endpoints from returning an error that might leak
  453. # information about whether an e-mail address is in use or not on this
  454. # homeserver.
  455. # Note that for some endpoints the error situation is the e-mail already being
  456. # used, and for others the error is entering the e-mail being unused.
  457. # If this option is enabled, instead of returning an error, these endpoints will
  458. # act as if no error happened and return a fake session ID ('sid') to clients.
  459. #
  460. #request_token_inhibit_3pid_errors: true
  461. # A list of domains that the domain portion of 'next_link' parameters
  462. # must match.
  463. #
  464. # This parameter is optionally provided by clients while requesting
  465. # validation of an email or phone number, and maps to a link that
  466. # users will be automatically redirected to after validation
  467. # succeeds. Clients can make use this parameter to aid the validation
  468. # process.
  469. #
  470. # The whitelist is applied whether the homeserver or an
  471. # identity server is handling validation.
  472. #
  473. # The default value is no whitelist functionality; all domains are
  474. # allowed. Setting this value to an empty list will instead disallow
  475. # all domains.
  476. #
  477. #next_link_domain_whitelist: ["matrix.org"]
  478. # Templates to use when generating email or HTML page contents.
  479. #
  480. templates:
  481. # Directory in which Synapse will try to find template files to use to generate
  482. # email or HTML page contents.
  483. # If not set, or a file is not found within the template directory, a default
  484. # template from within the Synapse package will be used.
  485. #
  486. # See https://matrix-org.github.io/synapse/latest/templates.html for more
  487. # information about using custom templates.
  488. #
  489. #custom_template_directory: /path/to/custom/templates/
  490. # List of rooms to exclude from sync responses. This is useful for server
  491. # administrators wishing to group users into a room without these users being able
  492. # to see it from their client.
  493. #
  494. # By default, no room is excluded.
  495. #
  496. #exclude_rooms_from_sync:
  497. # - !foo:example.com
  498. # Message retention policy at the server level.
  499. #
  500. # Room admins and mods can define a retention period for their rooms using the
  501. # 'm.room.retention' state event, and server admins can cap this period by setting
  502. # the 'allowed_lifetime_min' and 'allowed_lifetime_max' config options.
  503. #
  504. # If this feature is enabled, Synapse will regularly look for and purge events
  505. # which are older than the room's maximum retention period. Synapse will also
  506. # filter events received over federation so that events that should have been
  507. # purged are ignored and not stored again.
  508. #
  509. retention:
  510. # The message retention policies feature is disabled by default. Uncomment the
  511. # following line to enable it.
  512. #
  513. #enabled: true
  514. # Default retention policy. If set, Synapse will apply it to rooms that lack the
  515. # 'm.room.retention' state event. Currently, the value of 'min_lifetime' doesn't
  516. # matter much because Synapse doesn't take it into account yet.
  517. #
  518. #default_policy:
  519. # min_lifetime: 1d
  520. # max_lifetime: 1y
  521. # Retention policy limits. If set, and the state of a room contains a
  522. # 'm.room.retention' event in its state which contains a 'min_lifetime' or a
  523. # 'max_lifetime' that's out of these bounds, Synapse will cap the room's policy
  524. # to these limits when running purge jobs.
  525. #
  526. #allowed_lifetime_min: 1d
  527. #allowed_lifetime_max: 1y
  528. # Server admins can define the settings of the background jobs purging the
  529. # events which lifetime has expired under the 'purge_jobs' section.
  530. #
  531. # If no configuration is provided, a single job will be set up to delete expired
  532. # events in every room daily.
  533. #
  534. # Each job's configuration defines which range of message lifetimes the job
  535. # takes care of. For example, if 'shortest_max_lifetime' is '2d' and
  536. # 'longest_max_lifetime' is '3d', the job will handle purging expired events in
  537. # rooms whose state defines a 'max_lifetime' that's both higher than 2 days, and
  538. # lower than or equal to 3 days. Both the minimum and the maximum value of a
  539. # range are optional, e.g. a job with no 'shortest_max_lifetime' and a
  540. # 'longest_max_lifetime' of '3d' will handle every room with a retention policy
  541. # which 'max_lifetime' is lower than or equal to three days.
  542. #
  543. # The rationale for this per-job configuration is that some rooms might have a
  544. # retention policy with a low 'max_lifetime', where history needs to be purged
  545. # of outdated messages on a more frequent basis than for the rest of the rooms
  546. # (e.g. every 12h), but not want that purge to be performed by a job that's
  547. # iterating over every room it knows, which could be heavy on the server.
  548. #
  549. # If any purge job is configured, it is strongly recommended to have at least
  550. # a single job with neither 'shortest_max_lifetime' nor 'longest_max_lifetime'
  551. # set, or one job without 'shortest_max_lifetime' and one job without
  552. # 'longest_max_lifetime' set. Otherwise some rooms might be ignored, even if
  553. # 'allowed_lifetime_min' and 'allowed_lifetime_max' are set, because capping a
  554. # room's policy to these values is done after the policies are retrieved from
  555. # Synapse's database (which is done using the range specified in a purge job's
  556. # configuration).
  557. #
  558. #purge_jobs:
  559. # - longest_max_lifetime: 3d
  560. # interval: 12h
  561. # - shortest_max_lifetime: 3d
  562. # interval: 1d
  563. ## TLS ##
  564. # PEM-encoded X509 certificate for TLS.
  565. # This certificate, as of Synapse 1.0, will need to be a valid and verifiable
  566. # certificate, signed by a recognised Certificate Authority.
  567. #
  568. # Be sure to use a `.pem` file that includes the full certificate chain including
  569. # any intermediate certificates (for instance, if using certbot, use
  570. # `fullchain.pem` as your certificate, not `cert.pem`).
  571. #
  572. #tls_certificate_path: "CONFDIR/SERVERNAME.tls.crt"
  573. # PEM-encoded private key for TLS
  574. #
  575. #tls_private_key_path: "CONFDIR/SERVERNAME.tls.key"
  576. # Whether to verify TLS server certificates for outbound federation requests.
  577. #
  578. # Defaults to `true`. To disable certificate verification, uncomment the
  579. # following line.
  580. #
  581. #federation_verify_certificates: false
  582. # The minimum TLS version that will be used for outbound federation requests.
  583. #
  584. # Defaults to `1`. Configurable to `1`, `1.1`, `1.2`, or `1.3`. Note
  585. # that setting this value higher than `1.2` will prevent federation to most
  586. # of the public Matrix network: only configure it to `1.3` if you have an
  587. # entirely private federation setup and you can ensure TLS 1.3 support.
  588. #
  589. #federation_client_minimum_tls_version: 1.2
  590. # Skip federation certificate verification on the following whitelist
  591. # of domains.
  592. #
  593. # This setting should only be used in very specific cases, such as
  594. # federation over Tor hidden services and similar. For private networks
  595. # of homeservers, you likely want to use a private CA instead.
  596. #
  597. # Only effective if federation_verify_certicates is `true`.
  598. #
  599. #federation_certificate_verification_whitelist:
  600. # - lon.example.com
  601. # - "*.domain.com"
  602. # - "*.onion"
  603. # List of custom certificate authorities for federation traffic.
  604. #
  605. # This setting should only normally be used within a private network of
  606. # homeservers.
  607. #
  608. # Note that this list will replace those that are provided by your
  609. # operating environment. Certificates must be in PEM format.
  610. #
  611. #federation_custom_ca_list:
  612. # - myCA1.pem
  613. # - myCA2.pem
  614. # - myCA3.pem
  615. ## Federation ##
  616. # Restrict federation to the following whitelist of domains.
  617. # N.B. we recommend also firewalling your federation listener to limit
  618. # inbound federation traffic as early as possible, rather than relying
  619. # purely on this application-layer restriction. If not specified, the
  620. # default is to whitelist everything.
  621. #
  622. #federation_domain_whitelist:
  623. # - lon.example.com
  624. # - nyc.example.com
  625. # - syd.example.com
  626. # Report prometheus metrics on the age of PDUs being sent to and received from
  627. # the following domains. This can be used to give an idea of "delay" on inbound
  628. # and outbound federation, though be aware that any delay can be due to problems
  629. # at either end or with the intermediate network.
  630. #
  631. # By default, no domains are monitored in this way.
  632. #
  633. #federation_metrics_domains:
  634. # - matrix.org
  635. # - example.com
  636. # Uncomment to disable profile lookup over federation. By default, the
  637. # Federation API allows other homeservers to obtain profile data of any user
  638. # on this homeserver. Defaults to 'true'.
  639. #
  640. #allow_profile_lookup_over_federation: false
  641. # Uncomment to allow device display name lookup over federation. By default, the
  642. # Federation API prevents other homeservers from obtaining the display names of
  643. # user devices on this homeserver. Defaults to 'false'.
  644. #
  645. #allow_device_name_lookup_over_federation: true
  646. ## Caching ##
  647. # Caching can be configured through the following options.
  648. #
  649. # A cache 'factor' is a multiplier that can be applied to each of
  650. # Synapse's caches in order to increase or decrease the maximum
  651. # number of entries that can be stored.
  652. #
  653. # The configuration for cache factors (caches.global_factor and
  654. # caches.per_cache_factors) can be reloaded while the application is running,
  655. # by sending a SIGHUP signal to the Synapse process. Changes to other parts of
  656. # the caching config will NOT be applied after a SIGHUP is received; a restart
  657. # is necessary.
  658. # The number of events to cache in memory. Not affected by
  659. # caches.global_factor.
  660. #
  661. #event_cache_size: 10K
  662. caches:
  663. # Controls the global cache factor, which is the default cache factor
  664. # for all caches if a specific factor for that cache is not otherwise
  665. # set.
  666. #
  667. # This can also be set by the "SYNAPSE_CACHE_FACTOR" environment
  668. # variable. Setting by environment variable takes priority over
  669. # setting through the config file.
  670. #
  671. # Defaults to 0.5, which will half the size of all caches.
  672. #
  673. #global_factor: 1.0
  674. # A dictionary of cache name to cache factor for that individual
  675. # cache. Overrides the global cache factor for a given cache.
  676. #
  677. # These can also be set through environment variables comprised
  678. # of "SYNAPSE_CACHE_FACTOR_" + the name of the cache in capital
  679. # letters and underscores. Setting by environment variable
  680. # takes priority over setting through the config file.
  681. # Ex. SYNAPSE_CACHE_FACTOR_GET_USERS_WHO_SHARE_ROOM_WITH_USER=2.0
  682. #
  683. # Some caches have '*' and other characters that are not
  684. # alphanumeric or underscores. These caches can be named with or
  685. # without the special characters stripped. For example, to specify
  686. # the cache factor for `*stateGroupCache*` via an environment
  687. # variable would be `SYNAPSE_CACHE_FACTOR_STATEGROUPCACHE=2.0`.
  688. #
  689. per_cache_factors:
  690. #get_users_who_share_room_with_user: 2.0
  691. # Controls whether cache entries are evicted after a specified time
  692. # period. Defaults to true. Uncomment to disable this feature.
  693. #
  694. #expire_caches: false
  695. # If expire_caches is enabled, this flag controls how long an entry can
  696. # be in a cache without having been accessed before being evicted.
  697. # Defaults to 30m. Uncomment to set a different time to live for cache entries.
  698. #
  699. #cache_entry_ttl: 30m
  700. # This flag enables cache autotuning, and is further specified by the sub-options `max_cache_memory_usage`,
  701. # `target_cache_memory_usage`, `min_cache_ttl`. These flags work in conjunction with each other to maintain
  702. # a balance between cache memory usage and cache entry availability. You must be using jemalloc to utilize
  703. # this option, and all three of the options must be specified for this feature to work.
  704. #cache_autotuning:
  705. # This flag sets a ceiling on much memory the cache can use before caches begin to be continuously evicted.
  706. # They will continue to be evicted until the memory usage drops below the `target_memory_usage`, set in
  707. # the flag below, or until the `min_cache_ttl` is hit.
  708. #max_cache_memory_usage: 1024M
  709. # This flag sets a rough target for the desired memory usage of the caches.
  710. #target_cache_memory_usage: 758M
  711. # 'min_cache_ttl` sets a limit under which newer cache entries are not evicted and is only applied when
  712. # caches are actively being evicted/`max_cache_memory_usage` has been exceeded. This is to protect hot caches
  713. # from being emptied while Synapse is evicting due to memory.
  714. #min_cache_ttl: 5m
  715. # Controls how long the results of a /sync request are cached for after
  716. # a successful response is returned. A higher duration can help clients with
  717. # intermittent connections, at the cost of higher memory usage.
  718. #
  719. # By default, this is zero, which means that sync responses are not cached
  720. # at all.
  721. #
  722. #sync_response_cache_duration: 2m
  723. ## Database ##
  724. # The 'database' setting defines the database that synapse uses to store all of
  725. # its data.
  726. #
  727. # 'name' gives the database engine to use: either 'sqlite3' (for SQLite) or
  728. # 'psycopg2' (for PostgreSQL).
  729. #
  730. # 'txn_limit' gives the maximum number of transactions to run per connection
  731. # before reconnecting. Defaults to 0, which means no limit.
  732. #
  733. # 'allow_unsafe_locale' is an option specific to Postgres. Under the default behavior, Synapse will refuse to
  734. # start if the postgres db is set to a non-C locale. You can override this behavior (which is *not* recommended)
  735. # by setting 'allow_unsafe_locale' to true. Note that doing so may corrupt your database. You can find more information
  736. # here: https://matrix-org.github.io/synapse/latest/postgres.html#fixing-incorrect-collate-or-ctype and here:
  737. # https://wiki.postgresql.org/wiki/Locale_data_changes
  738. #
  739. # 'args' gives options which are passed through to the database engine,
  740. # except for options starting 'cp_', which are used to configure the Twisted
  741. # connection pool. For a reference to valid arguments, see:
  742. # * for sqlite: https://docs.python.org/3/library/sqlite3.html#sqlite3.connect
  743. # * for postgres: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
  744. # * for the connection pool: https://twistedmatrix.com/documents/current/api/twisted.enterprise.adbapi.ConnectionPool.html#__init__
  745. #
  746. #
  747. # Example SQLite configuration:
  748. #
  749. #database:
  750. # name: sqlite3
  751. # args:
  752. # database: /path/to/homeserver.db
  753. #
  754. #
  755. # Example Postgres configuration:
  756. #
  757. #database:
  758. # name: psycopg2
  759. # txn_limit: 10000
  760. # args:
  761. # user: synapse_user
  762. # password: secretpassword
  763. # database: synapse
  764. # host: localhost
  765. # port: 5432
  766. # cp_min: 5
  767. # cp_max: 10
  768. #
  769. # For more information on using Synapse with Postgres,
  770. # see https://matrix-org.github.io/synapse/latest/postgres.html.
  771. #
  772. database:
  773. name: sqlite3
  774. args:
  775. database: DATADIR/homeserver.db
  776. ## Logging ##
  777. # A yaml python logging config file as described by
  778. # https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
  779. #
  780. log_config: "CONFDIR/SERVERNAME.log.config"
  781. ## Ratelimiting ##
  782. # Ratelimiting settings for client actions (registration, login, messaging).
  783. #
  784. # Each ratelimiting configuration is made of two parameters:
  785. # - per_second: number of requests a client can send per second.
  786. # - burst_count: number of requests a client can send before being throttled.
  787. #
  788. # Synapse currently uses the following configurations:
  789. # - one for messages that ratelimits sending based on the account the client
  790. # is using
  791. # - one for registration that ratelimits registration requests based on the
  792. # client's IP address.
  793. # - one for checking the validity of registration tokens that ratelimits
  794. # requests based on the client's IP address.
  795. # - one for login that ratelimits login requests based on the client's IP
  796. # address.
  797. # - one for login that ratelimits login requests based on the account the
  798. # client is attempting to log into.
  799. # - one for login that ratelimits login requests based on the account the
  800. # client is attempting to log into, based on the amount of failed login
  801. # attempts for this account.
  802. # - one for ratelimiting redactions by room admins. If this is not explicitly
  803. # set then it uses the same ratelimiting as per rc_message. This is useful
  804. # to allow room admins to deal with abuse quickly.
  805. # - two for ratelimiting number of rooms a user can join, "local" for when
  806. # users are joining rooms the server is already in (this is cheap) vs
  807. # "remote" for when users are trying to join rooms not on the server (which
  808. # can be more expensive)
  809. # - one for ratelimiting how often a user or IP can attempt to validate a 3PID.
  810. # - two for ratelimiting how often invites can be sent in a room or to a
  811. # specific user.
  812. # - one for ratelimiting 3PID invites (i.e. invites sent to a third-party ID
  813. # such as an email address or a phone number) based on the account that's
  814. # sending the invite.
  815. #
  816. # The defaults are as shown below.
  817. #
  818. #rc_message:
  819. # per_second: 0.2
  820. # burst_count: 10
  821. #
  822. #rc_registration:
  823. # per_second: 0.17
  824. # burst_count: 3
  825. #
  826. #rc_registration_token_validity:
  827. # per_second: 0.1
  828. # burst_count: 5
  829. #
  830. #rc_login:
  831. # address:
  832. # per_second: 0.17
  833. # burst_count: 3
  834. # account:
  835. # per_second: 0.17
  836. # burst_count: 3
  837. # failed_attempts:
  838. # per_second: 0.17
  839. # burst_count: 3
  840. #
  841. #rc_admin_redaction:
  842. # per_second: 1
  843. # burst_count: 50
  844. #
  845. #rc_joins:
  846. # local:
  847. # per_second: 0.1
  848. # burst_count: 10
  849. # remote:
  850. # per_second: 0.01
  851. # burst_count: 10
  852. #
  853. #rc_3pid_validation:
  854. # per_second: 0.003
  855. # burst_count: 5
  856. #
  857. #rc_invites:
  858. # per_room:
  859. # per_second: 0.3
  860. # burst_count: 10
  861. # per_user:
  862. # per_second: 0.003
  863. # burst_count: 5
  864. #
  865. #rc_third_party_invite:
  866. # per_second: 0.2
  867. # burst_count: 10
  868. # Ratelimiting settings for incoming federation
  869. #
  870. # The rc_federation configuration is made up of the following settings:
  871. # - window_size: window size in milliseconds
  872. # - sleep_limit: number of federation requests from a single server in
  873. # a window before the server will delay processing the request.
  874. # - sleep_delay: duration in milliseconds to delay processing events
  875. # from remote servers by if they go over the sleep limit.
  876. # - reject_limit: maximum number of concurrent federation requests
  877. # allowed from a single server
  878. # - concurrent: number of federation requests to concurrently process
  879. # from a single server
  880. #
  881. # The defaults are as shown below.
  882. #
  883. #rc_federation:
  884. # window_size: 1000
  885. # sleep_limit: 10
  886. # sleep_delay: 500
  887. # reject_limit: 50
  888. # concurrent: 3
  889. # Target outgoing federation transaction frequency for sending read-receipts,
  890. # per-room.
  891. #
  892. # If we end up trying to send out more read-receipts, they will get buffered up
  893. # into fewer transactions.
  894. #
  895. #federation_rr_transactions_per_room_per_second: 50
  896. ## Media Store ##
  897. # Enable the media store service in the Synapse master. Uncomment the
  898. # following if you are using a separate media store worker.
  899. #
  900. #enable_media_repo: false
  901. # Directory where uploaded images and attachments are stored.
  902. #
  903. media_store_path: "DATADIR/media_store"
  904. # Media storage providers allow media to be stored in different
  905. # locations.
  906. #
  907. #media_storage_providers:
  908. # - module: file_system
  909. # # Whether to store newly uploaded local files
  910. # store_local: false
  911. # # Whether to store newly downloaded remote files
  912. # store_remote: false
  913. # # Whether to wait for successful storage for local uploads
  914. # store_synchronous: false
  915. # config:
  916. # directory: /mnt/some/other/directory
  917. # The largest allowed upload size in bytes
  918. #
  919. # If you are using a reverse proxy you may also need to set this value in
  920. # your reverse proxy's config. Notably Nginx has a small max body size by default.
  921. # See https://matrix-org.github.io/synapse/latest/reverse_proxy.html.
  922. #
  923. #max_upload_size: 50M
  924. # Maximum number of pixels that will be thumbnailed
  925. #
  926. #max_image_pixels: 32M
  927. # Whether to generate new thumbnails on the fly to precisely match
  928. # the resolution requested by the client. If true then whenever
  929. # a new resolution is requested by the client the server will
  930. # generate a new thumbnail. If false the server will pick a thumbnail
  931. # from a precalculated list.
  932. #
  933. #dynamic_thumbnails: false
  934. # List of thumbnails to precalculate when an image is uploaded.
  935. #
  936. #thumbnail_sizes:
  937. # - width: 32
  938. # height: 32
  939. # method: crop
  940. # - width: 96
  941. # height: 96
  942. # method: crop
  943. # - width: 320
  944. # height: 240
  945. # method: scale
  946. # - width: 640
  947. # height: 480
  948. # method: scale
  949. # - width: 800
  950. # height: 600
  951. # method: scale
  952. # Is the preview URL API enabled?
  953. #
  954. # 'false' by default: uncomment the following to enable it (and specify a
  955. # url_preview_ip_range_blacklist blacklist).
  956. #
  957. #url_preview_enabled: true
  958. # List of IP address CIDR ranges that the URL preview spider is denied
  959. # from accessing. There are no defaults: you must explicitly
  960. # specify a list for URL previewing to work. You should specify any
  961. # internal services in your network that you do not want synapse to try
  962. # to connect to, otherwise anyone in any Matrix room could cause your
  963. # synapse to issue arbitrary GET requests to your internal services,
  964. # causing serious security issues.
  965. #
  966. # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
  967. # listed here, since they correspond to unroutable addresses.)
  968. #
  969. # This must be specified if url_preview_enabled is set. It is recommended that
  970. # you uncomment the following list as a starting point.
  971. #
  972. # Note: The value is ignored when an HTTP proxy is in use
  973. #
  974. #url_preview_ip_range_blacklist:
  975. # - '127.0.0.0/8'
  976. # - '10.0.0.0/8'
  977. # - '172.16.0.0/12'
  978. # - '192.168.0.0/16'
  979. # - '100.64.0.0/10'
  980. # - '192.0.0.0/24'
  981. # - '169.254.0.0/16'
  982. # - '192.88.99.0/24'
  983. # - '198.18.0.0/15'
  984. # - '192.0.2.0/24'
  985. # - '198.51.100.0/24'
  986. # - '203.0.113.0/24'
  987. # - '224.0.0.0/4'
  988. # - '::1/128'
  989. # - 'fe80::/10'
  990. # - 'fc00::/7'
  991. # - '2001:db8::/32'
  992. # - 'ff00::/8'
  993. # - 'fec0::/10'
  994. # List of IP address CIDR ranges that the URL preview spider is allowed
  995. # to access even if they are specified in url_preview_ip_range_blacklist.
  996. # This is useful for specifying exceptions to wide-ranging blacklisted
  997. # target IP ranges - e.g. for enabling URL previews for a specific private
  998. # website only visible in your network.
  999. #
  1000. #url_preview_ip_range_whitelist:
  1001. # - '192.168.1.1'
  1002. # Optional list of URL matches that the URL preview spider is
  1003. # denied from accessing. You should use url_preview_ip_range_blacklist
  1004. # in preference to this, otherwise someone could define a public DNS
  1005. # entry that points to a private IP address and circumvent the blacklist.
  1006. # This is more useful if you know there is an entire shape of URL that
  1007. # you know that will never want synapse to try to spider.
  1008. #
  1009. # Each list entry is a dictionary of url component attributes as returned
  1010. # by urlparse.urlsplit as applied to the absolute form of the URL. See
  1011. # https://docs.python.org/2/library/urlparse.html#urlparse.urlsplit
  1012. # The values of the dictionary are treated as an filename match pattern
  1013. # applied to that component of URLs, unless they start with a ^ in which
  1014. # case they are treated as a regular expression match. If all the
  1015. # specified component matches for a given list item succeed, the URL is
  1016. # blacklisted.
  1017. #
  1018. #url_preview_url_blacklist:
  1019. # # blacklist any URL with a username in its URI
  1020. # - username: '*'
  1021. #
  1022. # # blacklist all *.google.com URLs
  1023. # - netloc: 'google.com'
  1024. # - netloc: '*.google.com'
  1025. #
  1026. # # blacklist all plain HTTP URLs
  1027. # - scheme: 'http'
  1028. #
  1029. # # blacklist http(s)://www.acme.com/foo
  1030. # - netloc: 'www.acme.com'
  1031. # path: '/foo'
  1032. #
  1033. # # blacklist any URL with a literal IPv4 address
  1034. # - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
  1035. # The largest allowed URL preview spidering size in bytes
  1036. #
  1037. #max_spider_size: 10M
  1038. # A list of values for the Accept-Language HTTP header used when
  1039. # downloading webpages during URL preview generation. This allows
  1040. # Synapse to specify the preferred languages that URL previews should
  1041. # be in when communicating with remote servers.
  1042. #
  1043. # Each value is a IETF language tag; a 2-3 letter identifier for a
  1044. # language, optionally followed by subtags separated by '-', specifying
  1045. # a country or region variant.
  1046. #
  1047. # Multiple values can be provided, and a weight can be added to each by
  1048. # using quality value syntax (;q=). '*' translates to any language.
  1049. #
  1050. # Defaults to "en".
  1051. #
  1052. # Example:
  1053. #
  1054. # url_preview_accept_language:
  1055. # - en-UK
  1056. # - en-US;q=0.9
  1057. # - fr;q=0.8
  1058. # - *;q=0.7
  1059. #
  1060. url_preview_accept_language:
  1061. # - en
  1062. # oEmbed allows for easier embedding content from a website. It can be
  1063. # used for generating URLs previews of services which support it.
  1064. #
  1065. oembed:
  1066. # A default list of oEmbed providers is included with Synapse.
  1067. #
  1068. # Uncomment the following to disable using these default oEmbed URLs.
  1069. # Defaults to 'false'.
  1070. #
  1071. #disable_default_providers: true
  1072. # Additional files with oEmbed configuration (each should be in the
  1073. # form of providers.json).
  1074. #
  1075. # By default, this list is empty (so only the default providers.json
  1076. # is used).
  1077. #
  1078. #additional_providers:
  1079. # - oembed/my_providers.json
  1080. ## Captcha ##
  1081. # See docs/CAPTCHA_SETUP.md for full details of configuring this.
  1082. # This homeserver's ReCAPTCHA public key. Must be specified if
  1083. # enable_registration_captcha is enabled.
  1084. #
  1085. #recaptcha_public_key: "YOUR_PUBLIC_KEY"
  1086. # This homeserver's ReCAPTCHA private key. Must be specified if
  1087. # enable_registration_captcha is enabled.
  1088. #
  1089. #recaptcha_private_key: "YOUR_PRIVATE_KEY"
  1090. # Uncomment to enable ReCaptcha checks when registering, preventing signup
  1091. # unless a captcha is answered. Requires a valid ReCaptcha
  1092. # public/private key. Defaults to 'false'.
  1093. #
  1094. #enable_registration_captcha: true
  1095. # The API endpoint to use for verifying m.login.recaptcha responses.
  1096. # Defaults to "https://www.recaptcha.net/recaptcha/api/siteverify".
  1097. #
  1098. #recaptcha_siteverify_api: "https://my.recaptcha.site"
  1099. ## TURN ##
  1100. # The public URIs of the TURN server to give to clients
  1101. #
  1102. #turn_uris: []
  1103. # The shared secret used to compute passwords for the TURN server
  1104. #
  1105. #turn_shared_secret: "YOUR_SHARED_SECRET"
  1106. # The Username and password if the TURN server needs them and
  1107. # does not use a token
  1108. #
  1109. #turn_username: "TURNSERVER_USERNAME"
  1110. #turn_password: "TURNSERVER_PASSWORD"
  1111. # How long generated TURN credentials last
  1112. #
  1113. #turn_user_lifetime: 1h
  1114. # Whether guests should be allowed to use the TURN server.
  1115. # This defaults to True, otherwise VoIP will be unreliable for guests.
  1116. # However, it does introduce a slight security risk as it allows users to
  1117. # connect to arbitrary endpoints without having first signed up for a
  1118. # valid account (e.g. by passing a CAPTCHA).
  1119. #
  1120. #turn_allow_guests: true
  1121. ## Registration ##
  1122. #
  1123. # Registration can be rate-limited using the parameters in the "Ratelimiting"
  1124. # section of this file.
  1125. # Enable registration for new users. Defaults to 'false'. It is highly recommended that if you enable registration,
  1126. # you use either captcha, email, or token-based verification to verify that new users are not bots. In order to enable registration
  1127. # without any verification, you must also set `enable_registration_without_verification`, found below.
  1128. #
  1129. #enable_registration: false
  1130. # Enable registration without email or captcha verification. Note: this option is *not* recommended,
  1131. # as registration without verification is a known vector for spam and abuse. Defaults to false. Has no effect
  1132. # unless `enable_registration` is also enabled.
  1133. #
  1134. #enable_registration_without_verification: true
  1135. # Time that a user's session remains valid for, after they log in.
  1136. #
  1137. # Note that this is not currently compatible with guest logins.
  1138. #
  1139. # Note also that this is calculated at login time: changes are not applied
  1140. # retrospectively to users who have already logged in.
  1141. #
  1142. # By default, this is infinite.
  1143. #
  1144. #session_lifetime: 24h
  1145. # Time that an access token remains valid for, if the session is
  1146. # using refresh tokens.
  1147. # For more information about refresh tokens, please see the manual.
  1148. # Note that this only applies to clients which advertise support for
  1149. # refresh tokens.
  1150. #
  1151. # Note also that this is calculated at login time and refresh time:
  1152. # changes are not applied to existing sessions until they are refreshed.
  1153. #
  1154. # By default, this is 5 minutes.
  1155. #
  1156. #refreshable_access_token_lifetime: 5m
  1157. # Time that a refresh token remains valid for (provided that it is not
  1158. # exchanged for another one first).
  1159. # This option can be used to automatically log-out inactive sessions.
  1160. # Please see the manual for more information.
  1161. #
  1162. # Note also that this is calculated at login time and refresh time:
  1163. # changes are not applied to existing sessions until they are refreshed.
  1164. #
  1165. # By default, this is infinite.
  1166. #
  1167. #refresh_token_lifetime: 24h
  1168. # Time that an access token remains valid for, if the session is NOT
  1169. # using refresh tokens.
  1170. # Please note that not all clients support refresh tokens, so setting
  1171. # this to a short value may be inconvenient for some users who will
  1172. # then be logged out frequently.
  1173. #
  1174. # Note also that this is calculated at login time: changes are not applied
  1175. # retrospectively to existing sessions for users that have already logged in.
  1176. #
  1177. # By default, this is infinite.
  1178. #
  1179. #nonrefreshable_access_token_lifetime: 24h
  1180. # The user must provide all of the below types of 3PID when registering.
  1181. #
  1182. #registrations_require_3pid:
  1183. # - email
  1184. # - msisdn
  1185. # Explicitly disable asking for MSISDNs from the registration
  1186. # flow (overrides registrations_require_3pid if MSISDNs are set as required)
  1187. #
  1188. #disable_msisdn_registration: true
  1189. # Mandate that users are only allowed to associate certain formats of
  1190. # 3PIDs with accounts on this server.
  1191. #
  1192. #allowed_local_3pids:
  1193. # - medium: email
  1194. # pattern: '^[^@]+@matrix\.org$'
  1195. # - medium: email
  1196. # pattern: '^[^@]+@vector\.im$'
  1197. # - medium: msisdn
  1198. # pattern: '\+44'
  1199. # Enable 3PIDs lookup requests to identity servers from this server.
  1200. #
  1201. #enable_3pid_lookup: true
  1202. # Require users to submit a token during registration.
  1203. # Tokens can be managed using the admin API:
  1204. # https://matrix-org.github.io/synapse/latest/usage/administration/admin_api/registration_tokens.html
  1205. # Note that `enable_registration` must be set to `true`.
  1206. # Disabling this option will not delete any tokens previously generated.
  1207. # Defaults to false. Uncomment the following to require tokens:
  1208. #
  1209. #registration_requires_token: true
  1210. # Allow users to submit a token during registration to bypass any required 3pid
  1211. # steps configured in `registrations_require_3pid`.
  1212. # Defaults to false, requiring that registration tokens (if enabled) complete a 3pid flow.
  1213. #
  1214. #enable_registration_token_3pid_bypass: false
  1215. # If set, allows registration of standard or admin accounts by anyone who
  1216. # has the shared secret, even if registration is otherwise disabled.
  1217. #
  1218. #registration_shared_secret: <PRIVATE STRING>
  1219. # Set the number of bcrypt rounds used to generate password hash.
  1220. # Larger numbers increase the work factor needed to generate the hash.
  1221. # The default number is 12 (which equates to 2^12 rounds).
  1222. # N.B. that increasing this will exponentially increase the time required
  1223. # to register or login - e.g. 24 => 2^24 rounds which will take >20 mins.
  1224. #
  1225. #bcrypt_rounds: 12
  1226. # Allows users to register as guests without a password/email/etc, and
  1227. # participate in rooms hosted on this server which have been made
  1228. # accessible to anonymous users.
  1229. #
  1230. #allow_guest_access: false
  1231. # The identity server which we suggest that clients should use when users log
  1232. # in on this server.
  1233. #
  1234. # (By default, no suggestion is made, so it is left up to the client.
  1235. # This setting is ignored unless public_baseurl is also explicitly set.)
  1236. #
  1237. #default_identity_server: https://matrix.org
  1238. # Handle threepid (email/phone etc) registration and password resets through a set of
  1239. # *trusted* identity servers. Note that this allows the configured identity server to
  1240. # reset passwords for accounts!
  1241. #
  1242. # Be aware that if `email` is not set, and SMTP options have not been
  1243. # configured in the email config block, registration and user password resets via
  1244. # email will be globally disabled.
  1245. #
  1246. # Additionally, if `msisdn` is not set, registration and password resets via msisdn
  1247. # will be disabled regardless, and users will not be able to associate an msisdn
  1248. # identifier to their account. This is due to Synapse currently not supporting
  1249. # any method of sending SMS messages on its own.
  1250. #
  1251. # To enable using an identity server for operations regarding a particular third-party
  1252. # identifier type, set the value to the URL of that identity server as shown in the
  1253. # examples below.
  1254. #
  1255. # Servers handling the these requests must answer the `/requestToken` endpoints defined
  1256. # by the Matrix Identity Service API specification:
  1257. # https://matrix.org/docs/spec/identity_service/latest
  1258. #
  1259. account_threepid_delegates:
  1260. #email: https://example.com # Delegate email sending to example.com
  1261. #msisdn: http://localhost:8090 # Delegate SMS sending to this local process
  1262. # Whether users are allowed to change their displayname after it has
  1263. # been initially set. Useful when provisioning users based on the
  1264. # contents of a third-party directory.
  1265. #
  1266. # Does not apply to server administrators. Defaults to 'true'
  1267. #
  1268. #enable_set_displayname: false
  1269. # Whether users are allowed to change their avatar after it has been
  1270. # initially set. Useful when provisioning users based on the contents
  1271. # of a third-party directory.
  1272. #
  1273. # Does not apply to server administrators. Defaults to 'true'
  1274. #
  1275. #enable_set_avatar_url: false
  1276. # Whether users can change the 3PIDs associated with their accounts
  1277. # (email address and msisdn).
  1278. #
  1279. # Defaults to 'true'
  1280. #
  1281. #enable_3pid_changes: false
  1282. # Users who register on this homeserver will automatically be joined
  1283. # to these rooms.
  1284. #
  1285. # By default, any room aliases included in this list will be created
  1286. # as a publicly joinable room when the first user registers for the
  1287. # homeserver. This behaviour can be customised with the settings below.
  1288. # If the room already exists, make certain it is a publicly joinable
  1289. # room. The join rule of the room must be set to 'public'.
  1290. #
  1291. #auto_join_rooms:
  1292. # - "#example:example.com"
  1293. # Where auto_join_rooms are specified, setting this flag ensures that the
  1294. # the rooms exist by creating them when the first user on the
  1295. # homeserver registers.
  1296. #
  1297. # By default the auto-created rooms are publicly joinable from any federated
  1298. # server. Use the autocreate_auto_join_rooms_federated and
  1299. # autocreate_auto_join_room_preset settings below to customise this behaviour.
  1300. #
  1301. # Setting to false means that if the rooms are not manually created,
  1302. # users cannot be auto-joined since they do not exist.
  1303. #
  1304. # Defaults to true. Uncomment the following line to disable automatically
  1305. # creating auto-join rooms.
  1306. #
  1307. #autocreate_auto_join_rooms: false
  1308. # Whether the auto_join_rooms that are auto-created are available via
  1309. # federation. Only has an effect if autocreate_auto_join_rooms is true.
  1310. #
  1311. # Note that whether a room is federated cannot be modified after
  1312. # creation.
  1313. #
  1314. # Defaults to true: the room will be joinable from other servers.
  1315. # Uncomment the following to prevent users from other homeservers from
  1316. # joining these rooms.
  1317. #
  1318. #autocreate_auto_join_rooms_federated: false
  1319. # The room preset to use when auto-creating one of auto_join_rooms. Only has an
  1320. # effect if autocreate_auto_join_rooms is true.
  1321. #
  1322. # This can be one of "public_chat", "private_chat", or "trusted_private_chat".
  1323. # If a value of "private_chat" or "trusted_private_chat" is used then
  1324. # auto_join_mxid_localpart must also be configured.
  1325. #
  1326. # Defaults to "public_chat", meaning that the room is joinable by anyone, including
  1327. # federated servers if autocreate_auto_join_rooms_federated is true (the default).
  1328. # Uncomment the following to require an invitation to join these rooms.
  1329. #
  1330. #autocreate_auto_join_room_preset: private_chat
  1331. # The local part of the user id which is used to create auto_join_rooms if
  1332. # autocreate_auto_join_rooms is true. If this is not provided then the
  1333. # initial user account that registers will be used to create the rooms.
  1334. #
  1335. # The user id is also used to invite new users to any auto-join rooms which
  1336. # are set to invite-only.
  1337. #
  1338. # It *must* be configured if autocreate_auto_join_room_preset is set to
  1339. # "private_chat" or "trusted_private_chat".
  1340. #
  1341. # Note that this must be specified in order for new users to be correctly
  1342. # invited to any auto-join rooms which have been set to invite-only (either
  1343. # at the time of creation or subsequently).
  1344. #
  1345. # Note that, if the room already exists, this user must be joined and
  1346. # have the appropriate permissions to invite new members.
  1347. #
  1348. #auto_join_mxid_localpart: system
  1349. # When auto_join_rooms is specified, setting this flag to false prevents
  1350. # guest accounts from being automatically joined to the rooms.
  1351. #
  1352. # Defaults to true.
  1353. #
  1354. #auto_join_rooms_for_guests: false
  1355. # Whether to inhibit errors raised when registering a new account if the user ID
  1356. # already exists. If turned on, that requests to /register/available will always
  1357. # show a user ID as available, and Synapse won't raise an error when starting
  1358. # a registration with a user ID that already exists. However, Synapse will still
  1359. # raise an error if the registration completes and the username conflicts.
  1360. #
  1361. # Defaults to false.
  1362. #
  1363. #inhibit_user_in_use_error: true
  1364. ## Metrics ###
  1365. # Enable collection and rendering of performance metrics
  1366. #
  1367. #enable_metrics: false
  1368. # Enable sentry integration
  1369. # NOTE: While attempts are made to ensure that the logs don't contain
  1370. # any sensitive information, this cannot be guaranteed. By enabling
  1371. # this option the sentry server may therefore receive sensitive
  1372. # information, and it in turn may then diseminate sensitive information
  1373. # through insecure notification channels if so configured.
  1374. #
  1375. #sentry:
  1376. # dsn: "..."
  1377. # Flags to enable Prometheus metrics which are not suitable to be
  1378. # enabled by default, either for performance reasons or limited use.
  1379. #
  1380. metrics_flags:
  1381. # Publish synapse_federation_known_servers, a gauge of the number of
  1382. # servers this homeserver knows about, including itself. May cause
  1383. # performance problems on large homeservers.
  1384. #
  1385. #known_servers: true
  1386. # Whether or not to report anonymized homeserver usage statistics.
  1387. #
  1388. #report_stats: true|false
  1389. # The endpoint to report the anonymized homeserver usage statistics to.
  1390. # Defaults to https://matrix.org/report-usage-stats/push
  1391. #
  1392. #report_stats_endpoint: https://example.com/report-usage-stats/push
  1393. ## API Configuration ##
  1394. # Controls for the state that is shared with users who receive an invite
  1395. # to a room
  1396. #
  1397. room_prejoin_state:
  1398. # By default, the following state event types are shared with users who
  1399. # receive invites to the room:
  1400. #
  1401. # - m.room.join_rules
  1402. # - m.room.canonical_alias
  1403. # - m.room.avatar
  1404. # - m.room.encryption
  1405. # - m.room.name
  1406. # - m.room.create
  1407. # - m.room.topic
  1408. #
  1409. # Uncomment the following to disable these defaults (so that only the event
  1410. # types listed in 'additional_event_types' are shared). Defaults to 'false'.
  1411. #
  1412. #disable_default_event_types: true
  1413. # Additional state event types to share with users when they are invited
  1414. # to a room.
  1415. #
  1416. # By default, this list is empty (so only the default event types are shared).
  1417. #
  1418. #additional_event_types:
  1419. # - org.example.custom.event.type
  1420. # We record the IP address of clients used to access the API for various
  1421. # reasons, including displaying it to the user in the "Where you're signed in"
  1422. # dialog.
  1423. #
  1424. # By default, when puppeting another user via the admin API, the client IP
  1425. # address is recorded against the user who created the access token (ie, the
  1426. # admin user), and *not* the puppeted user.
  1427. #
  1428. # Uncomment the following to also record the IP address against the puppeted
  1429. # user. (This also means that the puppeted user will count as an "active" user
  1430. # for the purpose of monthly active user tracking - see 'limit_usage_by_mau' etc
  1431. # above.)
  1432. #
  1433. #track_puppeted_user_ips: true
  1434. # A list of application service config files to use
  1435. #
  1436. #app_service_config_files:
  1437. # - app_service_1.yaml
  1438. # - app_service_2.yaml
  1439. # Uncomment to enable tracking of application service IP addresses. Implicitly
  1440. # enables MAU tracking for application service users.
  1441. #
  1442. #track_appservice_user_ips: true
  1443. # a secret which is used to sign access tokens. If none is specified,
  1444. # the registration_shared_secret is used, if one is given; otherwise,
  1445. # a secret key is derived from the signing key.
  1446. #
  1447. #macaroon_secret_key: <PRIVATE STRING>
  1448. # a secret which is used to calculate HMACs for form values, to stop
  1449. # falsification of values. Must be specified for the User Consent
  1450. # forms to work.
  1451. #
  1452. #form_secret: <PRIVATE STRING>
  1453. ## Signing Keys ##
  1454. # Path to the signing key to sign messages with
  1455. #
  1456. signing_key_path: "CONFDIR/SERVERNAME.signing.key"
  1457. # The keys that the server used to sign messages with but won't use
  1458. # to sign new messages.
  1459. #
  1460. old_signing_keys:
  1461. # For each key, `key` should be the base64-encoded public key, and
  1462. # `expired_ts`should be the time (in milliseconds since the unix epoch) that
  1463. # it was last used.
  1464. #
  1465. # It is possible to build an entry from an old signing.key file using the
  1466. # `export_signing_key` script which is provided with synapse.
  1467. #
  1468. # For example:
  1469. #
  1470. #"ed25519:id": { key: "base64string", expired_ts: 123456789123 }
  1471. # How long key response published by this server is valid for.
  1472. # Used to set the valid_until_ts in /key/v2 APIs.
  1473. # Determines how quickly servers will query to check which keys
  1474. # are still valid.
  1475. #
  1476. #key_refresh_interval: 1d
  1477. # The trusted servers to download signing keys from.
  1478. #
  1479. # When we need to fetch a signing key, each server is tried in parallel.
  1480. #
  1481. # Normally, the connection to the key server is validated via TLS certificates.
  1482. # Additional security can be provided by configuring a `verify key`, which
  1483. # will make synapse check that the response is signed by that key.
  1484. #
  1485. # This setting supercedes an older setting named `perspectives`. The old format
  1486. # is still supported for backwards-compatibility, but it is deprecated.
  1487. #
  1488. # 'trusted_key_servers' defaults to matrix.org, but using it will generate a
  1489. # warning on start-up. To suppress this warning, set
  1490. # 'suppress_key_server_warning' to true.
  1491. #
  1492. # Options for each entry in the list include:
  1493. #
  1494. # server_name: the name of the server. required.
  1495. #
  1496. # verify_keys: an optional map from key id to base64-encoded public key.
  1497. # If specified, we will check that the response is signed by at least
  1498. # one of the given keys.
  1499. #
  1500. # accept_keys_insecurely: a boolean. Normally, if `verify_keys` is unset,
  1501. # and federation_verify_certificates is not `true`, synapse will refuse
  1502. # to start, because this would allow anyone who can spoof DNS responses
  1503. # to masquerade as the trusted key server. If you know what you are doing
  1504. # and are sure that your network environment provides a secure connection
  1505. # to the key server, you can set this to `true` to override this
  1506. # behaviour.
  1507. #
  1508. # An example configuration might look like:
  1509. #
  1510. #trusted_key_servers:
  1511. # - server_name: "my_trusted_server.example.com"
  1512. # verify_keys:
  1513. # "ed25519:auto": "abcdefghijklmnopqrstuvwxyzabcdefghijklmopqr"
  1514. # - server_name: "my_other_trusted_server.example.com"
  1515. #
  1516. trusted_key_servers:
  1517. - server_name: "matrix.org"
  1518. # Uncomment the following to disable the warning that is emitted when the
  1519. # trusted_key_servers include 'matrix.org'. See above.
  1520. #
  1521. #suppress_key_server_warning: true
  1522. # The signing keys to use when acting as a trusted key server. If not specified
  1523. # defaults to the server signing key.
  1524. #
  1525. # Can contain multiple keys, one per line.
  1526. #
  1527. #key_server_signing_keys_path: "key_server_signing_keys.key"
  1528. ## Single sign-on integration ##
  1529. # The following settings can be used to make Synapse use a single sign-on
  1530. # provider for authentication, instead of its internal password database.
  1531. #
  1532. # You will probably also want to set the following options to `false` to
  1533. # disable the regular login/registration flows:
  1534. # * enable_registration
  1535. # * password_config.enabled
  1536. #
  1537. # You will also want to investigate the settings under the "sso" configuration
  1538. # section below.
  1539. # Enable SAML2 for registration and login. Uses pysaml2.
  1540. #
  1541. # At least one of `sp_config` or `config_path` must be set in this section to
  1542. # enable SAML login.
  1543. #
  1544. # Once SAML support is enabled, a metadata file will be exposed at
  1545. # https://<server>:<port>/_synapse/client/saml2/metadata.xml, which you may be able to
  1546. # use to configure your SAML IdP with. Alternatively, you can manually configure
  1547. # the IdP to use an ACS location of
  1548. # https://<server>:<port>/_synapse/client/saml2/authn_response.
  1549. #
  1550. saml2_config:
  1551. # `sp_config` is the configuration for the pysaml2 Service Provider.
  1552. # See pysaml2 docs for format of config.
  1553. #
  1554. # Default values will be used for the 'entityid' and 'service' settings,
  1555. # so it is not normally necessary to specify them unless you need to
  1556. # override them.
  1557. #
  1558. sp_config:
  1559. # Point this to the IdP's metadata. You must provide either a local
  1560. # file via the `local` attribute or (preferably) a URL via the
  1561. # `remote` attribute.
  1562. #
  1563. #metadata:
  1564. # local: ["saml2/idp.xml"]
  1565. # remote:
  1566. # - url: https://our_idp/metadata.xml
  1567. # Allowed clock difference in seconds between the homeserver and IdP.
  1568. #
  1569. # Uncomment the below to increase the accepted time difference from 0 to 3 seconds.
  1570. #
  1571. #accepted_time_diff: 3
  1572. # By default, the user has to go to our login page first. If you'd like
  1573. # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
  1574. # 'service.sp' section:
  1575. #
  1576. #service:
  1577. # sp:
  1578. # allow_unsolicited: true
  1579. # The examples below are just used to generate our metadata xml, and you
  1580. # may well not need them, depending on your setup. Alternatively you
  1581. # may need a whole lot more detail - see the pysaml2 docs!
  1582. #description: ["My awesome SP", "en"]
  1583. #name: ["Test SP", "en"]
  1584. #ui_info:
  1585. # display_name:
  1586. # - lang: en
  1587. # text: "Display Name is the descriptive name of your service."
  1588. # description:
  1589. # - lang: en
  1590. # text: "Description should be a short paragraph explaining the purpose of the service."
  1591. # information_url:
  1592. # - lang: en
  1593. # text: "https://example.com/terms-of-service"
  1594. # privacy_statement_url:
  1595. # - lang: en
  1596. # text: "https://example.com/privacy-policy"
  1597. # keywords:
  1598. # - lang: en
  1599. # text: ["Matrix", "Element"]
  1600. # logo:
  1601. # - lang: en
  1602. # text: "https://example.com/logo.svg"
  1603. # width: "200"
  1604. # height: "80"
  1605. #organization:
  1606. # name: Example com
  1607. # display_name:
  1608. # - ["Example co", "en"]
  1609. # url: "http://example.com"
  1610. #contact_person:
  1611. # - given_name: Bob
  1612. # sur_name: "the Sysadmin"
  1613. # email_address": ["admin@example.com"]
  1614. # contact_type": technical
  1615. # Instead of putting the config inline as above, you can specify a
  1616. # separate pysaml2 configuration file:
  1617. #
  1618. #config_path: "CONFDIR/sp_conf.py"
  1619. # The lifetime of a SAML session. This defines how long a user has to
  1620. # complete the authentication process, if allow_unsolicited is unset.
  1621. # The default is 15 minutes.
  1622. #
  1623. #saml_session_lifetime: 5m
  1624. # An external module can be provided here as a custom solution to
  1625. # mapping attributes returned from a saml provider onto a matrix user.
  1626. #
  1627. user_mapping_provider:
  1628. # The custom module's class. Uncomment to use a custom module.
  1629. #
  1630. #module: mapping_provider.SamlMappingProvider
  1631. # Custom configuration values for the module. Below options are
  1632. # intended for the built-in provider, they should be changed if
  1633. # using a custom module. This section will be passed as a Python
  1634. # dictionary to the module's `parse_config` method.
  1635. #
  1636. config:
  1637. # The SAML attribute (after mapping via the attribute maps) to use
  1638. # to derive the Matrix ID from. 'uid' by default.
  1639. #
  1640. # Note: This used to be configured by the
  1641. # saml2_config.mxid_source_attribute option. If that is still
  1642. # defined, its value will be used instead.
  1643. #
  1644. #mxid_source_attribute: displayName
  1645. # The mapping system to use for mapping the saml attribute onto a
  1646. # matrix ID.
  1647. #
  1648. # Options include:
  1649. # * 'hexencode' (which maps unpermitted characters to '=xx')
  1650. # * 'dotreplace' (which replaces unpermitted characters with
  1651. # '.').
  1652. # The default is 'hexencode'.
  1653. #
  1654. # Note: This used to be configured by the
  1655. # saml2_config.mxid_mapping option. If that is still defined, its
  1656. # value will be used instead.
  1657. #
  1658. #mxid_mapping: dotreplace
  1659. # In previous versions of synapse, the mapping from SAML attribute to
  1660. # MXID was always calculated dynamically rather than stored in a
  1661. # table. For backwards- compatibility, we will look for user_ids
  1662. # matching such a pattern before creating a new account.
  1663. #
  1664. # This setting controls the SAML attribute which will be used for this
  1665. # backwards-compatibility lookup. Typically it should be 'uid', but if
  1666. # the attribute maps are changed, it may be necessary to change it.
  1667. #
  1668. # The default is 'uid'.
  1669. #
  1670. #grandfathered_mxid_source_attribute: upn
  1671. # It is possible to configure Synapse to only allow logins if SAML attributes
  1672. # match particular values. The requirements can be listed under
  1673. # `attribute_requirements` as shown below. All of the listed attributes must
  1674. # match for the login to be permitted.
  1675. #
  1676. #attribute_requirements:
  1677. # - attribute: userGroup
  1678. # value: "staff"
  1679. # - attribute: department
  1680. # value: "sales"
  1681. # If the metadata XML contains multiple IdP entities then the `idp_entityid`
  1682. # option must be set to the entity to redirect users to.
  1683. #
  1684. # Most deployments only have a single IdP entity and so should omit this
  1685. # option.
  1686. #
  1687. #idp_entityid: 'https://our_idp/entityid'
  1688. # List of OpenID Connect (OIDC) / OAuth 2.0 identity providers, for registration
  1689. # and login.
  1690. #
  1691. # Options for each entry include:
  1692. #
  1693. # idp_id: a unique identifier for this identity provider. Used internally
  1694. # by Synapse; should be a single word such as 'github'.
  1695. #
  1696. # Note that, if this is changed, users authenticating via that provider
  1697. # will no longer be recognised as the same user!
  1698. #
  1699. # (Use "oidc" here if you are migrating from an old "oidc_config"
  1700. # configuration.)
  1701. #
  1702. # idp_name: A user-facing name for this identity provider, which is used to
  1703. # offer the user a choice of login mechanisms.
  1704. #
  1705. # idp_icon: An optional icon for this identity provider, which is presented
  1706. # by clients and Synapse's own IdP picker page. If given, must be an
  1707. # MXC URI of the format mxc://<server-name>/<media-id>. (An easy way to
  1708. # obtain such an MXC URI is to upload an image to an (unencrypted) room
  1709. # and then copy the "url" from the source of the event.)
  1710. #
  1711. # idp_brand: An optional brand for this identity provider, allowing clients
  1712. # to style the login flow according to the identity provider in question.
  1713. # See the spec for possible options here.
  1714. #
  1715. # discover: set to 'false' to disable the use of the OIDC discovery mechanism
  1716. # to discover endpoints. Defaults to true.
  1717. #
  1718. # issuer: Required. The OIDC issuer. Used to validate tokens and (if discovery
  1719. # is enabled) to discover the provider's endpoints.
  1720. #
  1721. # client_id: Required. oauth2 client id to use.
  1722. #
  1723. # client_secret: oauth2 client secret to use. May be omitted if
  1724. # client_secret_jwt_key is given, or if client_auth_method is 'none'.
  1725. #
  1726. # client_secret_jwt_key: Alternative to client_secret: details of a key used
  1727. # to create a JSON Web Token to be used as an OAuth2 client secret. If
  1728. # given, must be a dictionary with the following properties:
  1729. #
  1730. # key: a pem-encoded signing key. Must be a suitable key for the
  1731. # algorithm specified. Required unless 'key_file' is given.
  1732. #
  1733. # key_file: the path to file containing a pem-encoded signing key file.
  1734. # Required unless 'key' is given.
  1735. #
  1736. # jwt_header: a dictionary giving properties to include in the JWT
  1737. # header. Must include the key 'alg', giving the algorithm used to
  1738. # sign the JWT, such as "ES256", using the JWA identifiers in
  1739. # RFC7518.
  1740. #
  1741. # jwt_payload: an optional dictionary giving properties to include in
  1742. # the JWT payload. Normally this should include an 'iss' key.
  1743. #
  1744. # client_auth_method: auth method to use when exchanging the token. Valid
  1745. # values are 'client_secret_basic' (default), 'client_secret_post' and
  1746. # 'none'.
  1747. #
  1748. # scopes: list of scopes to request. This should normally include the "openid"
  1749. # scope. Defaults to ["openid"].
  1750. #
  1751. # authorization_endpoint: the oauth2 authorization endpoint. Required if
  1752. # provider discovery is disabled.
  1753. #
  1754. # token_endpoint: the oauth2 token endpoint. Required if provider discovery is
  1755. # disabled.
  1756. #
  1757. # userinfo_endpoint: the OIDC userinfo endpoint. Required if discovery is
  1758. # disabled and the 'openid' scope is not requested.
  1759. #
  1760. # jwks_uri: URI where to fetch the JWKS. Required if discovery is disabled and
  1761. # the 'openid' scope is used.
  1762. #
  1763. # skip_verification: set to 'true' to skip metadata verification. Use this if
  1764. # you are connecting to a provider that is not OpenID Connect compliant.
  1765. # Defaults to false. Avoid this in production.
  1766. #
  1767. # user_profile_method: Whether to fetch the user profile from the userinfo
  1768. # endpoint, or to rely on the data returned in the id_token from the
  1769. # token_endpoint.
  1770. #
  1771. # Valid values are: 'auto' or 'userinfo_endpoint'.
  1772. #
  1773. # Defaults to 'auto', which uses the userinfo endpoint if 'openid' is
  1774. # not included in 'scopes'. Set to 'userinfo_endpoint' to always use the
  1775. # userinfo endpoint.
  1776. #
  1777. # allow_existing_users: set to 'true' to allow a user logging in via OIDC to
  1778. # match a pre-existing account instead of failing. This could be used if
  1779. # switching from password logins to OIDC. Defaults to false.
  1780. #
  1781. # user_mapping_provider: Configuration for how attributes returned from a OIDC
  1782. # provider are mapped onto a matrix user. This setting has the following
  1783. # sub-properties:
  1784. #
  1785. # module: The class name of a custom mapping module. Default is
  1786. # 'synapse.handlers.oidc.JinjaOidcMappingProvider'.
  1787. # See https://matrix-org.github.io/synapse/latest/sso_mapping_providers.html#openid-mapping-providers
  1788. # for information on implementing a custom mapping provider.
  1789. #
  1790. # config: Configuration for the mapping provider module. This section will
  1791. # be passed as a Python dictionary to the user mapping provider
  1792. # module's `parse_config` method.
  1793. #
  1794. # For the default provider, the following settings are available:
  1795. #
  1796. # subject_claim: name of the claim containing a unique identifier
  1797. # for the user. Defaults to 'sub', which OpenID Connect
  1798. # compliant providers should provide.
  1799. #
  1800. # localpart_template: Jinja2 template for the localpart of the MXID.
  1801. # If this is not set, the user will be prompted to choose their
  1802. # own username (see the documentation for the
  1803. # 'sso_auth_account_details.html' template). This template can
  1804. # use the 'localpart_from_email' filter.
  1805. #
  1806. # confirm_localpart: Whether to prompt the user to validate (or
  1807. # change) the generated localpart (see the documentation for the
  1808. # 'sso_auth_account_details.html' template), instead of
  1809. # registering the account right away.
  1810. #
  1811. # display_name_template: Jinja2 template for the display name to set
  1812. # on first login. If unset, no displayname will be set.
  1813. #
  1814. # email_template: Jinja2 template for the email address of the user.
  1815. # If unset, no email address will be added to the account.
  1816. #
  1817. # extra_attributes: a map of Jinja2 templates for extra attributes
  1818. # to send back to the client during login.
  1819. # Note that these are non-standard and clients will ignore them
  1820. # without modifications.
  1821. #
  1822. # When rendering, the Jinja2 templates are given a 'user' variable,
  1823. # which is set to the claims returned by the UserInfo Endpoint and/or
  1824. # in the ID Token.
  1825. #
  1826. # It is possible to configure Synapse to only allow logins if certain attributes
  1827. # match particular values in the OIDC userinfo. The requirements can be listed under
  1828. # `attribute_requirements` as shown below. All of the listed attributes must
  1829. # match for the login to be permitted. Additional attributes can be added to
  1830. # userinfo by expanding the `scopes` section of the OIDC config to retrieve
  1831. # additional information from the OIDC provider.
  1832. #
  1833. # If the OIDC claim is a list, then the attribute must match any value in the list.
  1834. # Otherwise, it must exactly match the value of the claim. Using the example
  1835. # below, the `family_name` claim MUST be "Stephensson", but the `groups`
  1836. # claim MUST contain "admin".
  1837. #
  1838. # attribute_requirements:
  1839. # - attribute: family_name
  1840. # value: "Stephensson"
  1841. # - attribute: groups
  1842. # value: "admin"
  1843. #
  1844. # See https://matrix-org.github.io/synapse/latest/openid.html
  1845. # for information on how to configure these options.
  1846. #
  1847. # For backwards compatibility, it is also possible to configure a single OIDC
  1848. # provider via an 'oidc_config' setting. This is now deprecated and admins are
  1849. # advised to migrate to the 'oidc_providers' format. (When doing that migration,
  1850. # use 'oidc' for the idp_id to ensure that existing users continue to be
  1851. # recognised.)
  1852. #
  1853. oidc_providers:
  1854. # Generic example
  1855. #
  1856. #- idp_id: my_idp
  1857. # idp_name: "My OpenID provider"
  1858. # idp_icon: "mxc://example.com/mediaid"
  1859. # discover: false
  1860. # issuer: "https://accounts.example.com/"
  1861. # client_id: "provided-by-your-issuer"
  1862. # client_secret: "provided-by-your-issuer"
  1863. # client_auth_method: client_secret_post
  1864. # scopes: ["openid", "profile"]
  1865. # authorization_endpoint: "https://accounts.example.com/oauth2/auth"
  1866. # token_endpoint: "https://accounts.example.com/oauth2/token"
  1867. # userinfo_endpoint: "https://accounts.example.com/userinfo"
  1868. # jwks_uri: "https://accounts.example.com/.well-known/jwks.json"
  1869. # skip_verification: true
  1870. # user_mapping_provider:
  1871. # config:
  1872. # subject_claim: "id"
  1873. # localpart_template: "{{ user.login }}"
  1874. # display_name_template: "{{ user.name }}"
  1875. # email_template: "{{ user.email }}"
  1876. # attribute_requirements:
  1877. # - attribute: userGroup
  1878. # value: "synapseUsers"
  1879. # Enable Central Authentication Service (CAS) for registration and login.
  1880. #
  1881. cas_config:
  1882. # Uncomment the following to enable authorization against a CAS server.
  1883. # Defaults to false.
  1884. #
  1885. #enabled: true
  1886. # The URL of the CAS authorization endpoint.
  1887. #
  1888. #server_url: "https://cas-server.com"
  1889. # The attribute of the CAS response to use as the display name.
  1890. #
  1891. # If unset, no displayname will be set.
  1892. #
  1893. #displayname_attribute: name
  1894. # It is possible to configure Synapse to only allow logins if CAS attributes
  1895. # match particular values. All of the keys in the mapping below must exist
  1896. # and the values must match the given value. Alternately if the given value
  1897. # is None then any value is allowed (the attribute just must exist).
  1898. # All of the listed attributes must match for the login to be permitted.
  1899. #
  1900. #required_attributes:
  1901. # userGroup: "staff"
  1902. # department: None
  1903. # Additional settings to use with single-sign on systems such as OpenID Connect,
  1904. # SAML2 and CAS.
  1905. #
  1906. # Server admins can configure custom templates for pages related to SSO. See
  1907. # https://matrix-org.github.io/synapse/latest/templates.html for more information.
  1908. #
  1909. sso:
  1910. # A list of client URLs which are whitelisted so that the user does not
  1911. # have to confirm giving access to their account to the URL. Any client
  1912. # whose URL starts with an entry in the following list will not be subject
  1913. # to an additional confirmation step after the SSO login is completed.
  1914. #
  1915. # WARNING: An entry such as "https://my.client" is insecure, because it
  1916. # will also match "https://my.client.evil.site", exposing your users to
  1917. # phishing attacks from evil.site. To avoid this, include a slash after the
  1918. # hostname: "https://my.client/".
  1919. #
  1920. # The login fallback page (used by clients that don't natively support the
  1921. # required login flows) is whitelisted in addition to any URLs in this list.
  1922. #
  1923. # By default, this list contains only the login fallback page.
  1924. #
  1925. #client_whitelist:
  1926. # - https://riot.im/develop
  1927. # - https://my.custom.client/
  1928. # Uncomment to keep a user's profile fields in sync with information from
  1929. # the identity provider. Currently only syncing the displayname is
  1930. # supported. Fields are checked on every SSO login, and are updated
  1931. # if necessary.
  1932. #
  1933. # Note that enabling this option will override user profile information,
  1934. # regardless of whether users have opted-out of syncing that
  1935. # information when first signing in. Defaults to false.
  1936. #
  1937. #update_profile_information: true
  1938. # JSON web token integration. The following settings can be used to make
  1939. # Synapse JSON web tokens for authentication, instead of its internal
  1940. # password database.
  1941. #
  1942. # Each JSON Web Token needs to contain a "sub" (subject) claim, which is
  1943. # used as the localpart of the mxid.
  1944. #
  1945. # Additionally, the expiration time ("exp"), not before time ("nbf"),
  1946. # and issued at ("iat") claims are validated if present.
  1947. #
  1948. # Note that this is a non-standard login type and client support is
  1949. # expected to be non-existent.
  1950. #
  1951. # See https://matrix-org.github.io/synapse/latest/jwt.html.
  1952. #
  1953. #jwt_config:
  1954. # Uncomment the following to enable authorization using JSON web
  1955. # tokens. Defaults to false.
  1956. #
  1957. #enabled: true
  1958. # This is either the private shared secret or the public key used to
  1959. # decode the contents of the JSON web token.
  1960. #
  1961. # Required if 'enabled' is true.
  1962. #
  1963. #secret: "provided-by-your-issuer"
  1964. # The algorithm used to sign the JSON web token.
  1965. #
  1966. # Supported algorithms are listed at
  1967. # https://pyjwt.readthedocs.io/en/latest/algorithms.html
  1968. #
  1969. # Required if 'enabled' is true.
  1970. #
  1971. #algorithm: "provided-by-your-issuer"
  1972. # Name of the claim containing a unique identifier for the user.
  1973. #
  1974. # Optional, defaults to `sub`.
  1975. #
  1976. #subject_claim: "sub"
  1977. # The issuer to validate the "iss" claim against.
  1978. #
  1979. # Optional, if provided the "iss" claim will be required and
  1980. # validated for all JSON web tokens.
  1981. #
  1982. #issuer: "provided-by-your-issuer"
  1983. # A list of audiences to validate the "aud" claim against.
  1984. #
  1985. # Optional, if provided the "aud" claim will be required and
  1986. # validated for all JSON web tokens.
  1987. #
  1988. # Note that if the "aud" claim is included in a JSON web token then
  1989. # validation will fail without configuring audiences.
  1990. #
  1991. #audiences:
  1992. # - "provided-by-your-issuer"
  1993. password_config:
  1994. # Uncomment to disable password login.
  1995. # Set to `only_for_reauth` to permit reauthentication for users that
  1996. # have passwords and are already logged in.
  1997. #
  1998. #enabled: false
  1999. # Uncomment to disable authentication against the local password
  2000. # database. This is ignored if `enabled` is false, and is only useful
  2001. # if you have other password_providers.
  2002. #
  2003. #localdb_enabled: false
  2004. # Uncomment and change to a secret random string for extra security.
  2005. # DO NOT CHANGE THIS AFTER INITIAL SETUP!
  2006. #
  2007. #pepper: "EVEN_MORE_SECRET"
  2008. # Define and enforce a password policy. Each parameter is optional.
  2009. # This is an implementation of MSC2000.
  2010. #
  2011. policy:
  2012. # Whether to enforce the password policy.
  2013. # Defaults to 'false'.
  2014. #
  2015. #enabled: true
  2016. # Minimum accepted length for a password.
  2017. # Defaults to 0.
  2018. #
  2019. #minimum_length: 15
  2020. # Whether a password must contain at least one digit.
  2021. # Defaults to 'false'.
  2022. #
  2023. #require_digit: true
  2024. # Whether a password must contain at least one symbol.
  2025. # A symbol is any character that's not a number or a letter.
  2026. # Defaults to 'false'.
  2027. #
  2028. #require_symbol: true
  2029. # Whether a password must contain at least one lowercase letter.
  2030. # Defaults to 'false'.
  2031. #
  2032. #require_lowercase: true
  2033. # Whether a password must contain at least one uppercase letter.
  2034. # Defaults to 'false'.
  2035. #
  2036. #require_uppercase: true
  2037. ui_auth:
  2038. # The amount of time to allow a user-interactive authentication session
  2039. # to be active.
  2040. #
  2041. # This defaults to 0, meaning the user is queried for their credentials
  2042. # before every action, but this can be overridden to allow a single
  2043. # validation to be re-used. This weakens the protections afforded by
  2044. # the user-interactive authentication process, by allowing for multiple
  2045. # (and potentially different) operations to use the same validation session.
  2046. #
  2047. # This is ignored for potentially "dangerous" operations (including
  2048. # deactivating an account, modifying an account password, and
  2049. # adding a 3PID).
  2050. #
  2051. # Uncomment below to allow for credential validation to last for 15
  2052. # seconds.
  2053. #
  2054. #session_timeout: "15s"
  2055. # Configuration for sending emails from Synapse.
  2056. #
  2057. # Server admins can configure custom templates for email content. See
  2058. # https://matrix-org.github.io/synapse/latest/templates.html for more information.
  2059. #
  2060. email:
  2061. # The hostname of the outgoing SMTP server to use. Defaults to 'localhost'.
  2062. #
  2063. #smtp_host: mail.server
  2064. # The port on the mail server for outgoing SMTP. Defaults to 25.
  2065. #
  2066. #smtp_port: 587
  2067. # Username/password for authentication to the SMTP server. By default, no
  2068. # authentication is attempted.
  2069. #
  2070. #smtp_user: "exampleusername"
  2071. #smtp_pass: "examplepassword"
  2072. # Uncomment the following to require TLS transport security for SMTP.
  2073. # By default, Synapse will connect over plain text, and will then switch to
  2074. # TLS via STARTTLS *if the SMTP server supports it*. If this option is set,
  2075. # Synapse will refuse to connect unless the server supports STARTTLS.
  2076. #
  2077. #require_transport_security: true
  2078. # Uncomment the following to disable TLS for SMTP.
  2079. #
  2080. # By default, if the server supports TLS, it will be used, and the server
  2081. # must present a certificate that is valid for 'smtp_host'. If this option
  2082. # is set to false, TLS will not be used.
  2083. #
  2084. #enable_tls: false
  2085. # notif_from defines the "From" address to use when sending emails.
  2086. # It must be set if email sending is enabled.
  2087. #
  2088. # The placeholder '%(app)s' will be replaced by the application name,
  2089. # which is normally 'app_name' (below), but may be overridden by the
  2090. # Matrix client application.
  2091. #
  2092. # Note that the placeholder must be written '%(app)s', including the
  2093. # trailing 's'.
  2094. #
  2095. #notif_from: "Your Friendly %(app)s homeserver <noreply@example.com>"
  2096. # app_name defines the default value for '%(app)s' in notif_from and email
  2097. # subjects. It defaults to 'Matrix'.
  2098. #
  2099. #app_name: my_branded_matrix_server
  2100. # Uncomment the following to enable sending emails for messages that the user
  2101. # has missed. Disabled by default.
  2102. #
  2103. #enable_notifs: true
  2104. # Uncomment the following to disable automatic subscription to email
  2105. # notifications for new users. Enabled by default.
  2106. #
  2107. #notif_for_new_users: false
  2108. # Custom URL for client links within the email notifications. By default
  2109. # links will be based on "https://matrix.to".
  2110. #
  2111. # (This setting used to be called riot_base_url; the old name is still
  2112. # supported for backwards-compatibility but is now deprecated.)
  2113. #
  2114. #client_base_url: "http://localhost/riot"
  2115. # Configure the time that a validation email will expire after sending.
  2116. # Defaults to 1h.
  2117. #
  2118. #validation_token_lifetime: 15m
  2119. # The web client location to direct users to during an invite. This is passed
  2120. # to the identity server as the org.matrix.web_client_location key. Defaults
  2121. # to unset, giving no guidance to the identity server.
  2122. #
  2123. #invite_client_location: https://app.element.io
  2124. # Subjects to use when sending emails from Synapse.
  2125. #
  2126. # The placeholder '%(app)s' will be replaced with the value of the 'app_name'
  2127. # setting above, or by a value dictated by the Matrix client application.
  2128. #
  2129. # If a subject isn't overridden in this configuration file, the value used as
  2130. # its example will be used.
  2131. #
  2132. #subjects:
  2133. # Subjects for notification emails.
  2134. #
  2135. # On top of the '%(app)s' placeholder, these can use the following
  2136. # placeholders:
  2137. #
  2138. # * '%(person)s', which will be replaced by the display name of the user(s)
  2139. # that sent the message(s), e.g. "Alice and Bob".
  2140. # * '%(room)s', which will be replaced by the name of the room the
  2141. # message(s) have been sent to, e.g. "My super room".
  2142. #
  2143. # See the example provided for each setting to see which placeholder can be
  2144. # used and how to use them.
  2145. #
  2146. # Subject to use to notify about one message from one or more user(s) in a
  2147. # room which has a name.
  2148. #message_from_person_in_room: "[%(app)s] You have a message on %(app)s from %(person)s in the %(room)s room..."
  2149. #
  2150. # Subject to use to notify about one message from one or more user(s) in a
  2151. # room which doesn't have a name.
  2152. #message_from_person: "[%(app)s] You have a message on %(app)s from %(person)s..."
  2153. #
  2154. # Subject to use to notify about multiple messages from one or more users in
  2155. # a room which doesn't have a name.
  2156. #messages_from_person: "[%(app)s] You have messages on %(app)s from %(person)s..."
  2157. #
  2158. # Subject to use to notify about multiple messages in a room which has a
  2159. # name.
  2160. #messages_in_room: "[%(app)s] You have messages on %(app)s in the %(room)s room..."
  2161. #
  2162. # Subject to use to notify about multiple messages in multiple rooms.
  2163. #messages_in_room_and_others: "[%(app)s] You have messages on %(app)s in the %(room)s room and others..."
  2164. #
  2165. # Subject to use to notify about multiple messages from multiple persons in
  2166. # multiple rooms. This is similar to the setting above except it's used when
  2167. # the room in which the notification was triggered has no name.
  2168. #messages_from_person_and_others: "[%(app)s] You have messages on %(app)s from %(person)s and others..."
  2169. #
  2170. # Subject to use to notify about an invite to a room which has a name.
  2171. #invite_from_person_to_room: "[%(app)s] %(person)s has invited you to join the %(room)s room on %(app)s..."
  2172. #
  2173. # Subject to use to notify about an invite to a room which doesn't have a
  2174. # name.
  2175. #invite_from_person: "[%(app)s] %(person)s has invited you to chat on %(app)s..."
  2176. # Subject for emails related to account administration.
  2177. #
  2178. # On top of the '%(app)s' placeholder, these one can use the
  2179. # '%(server_name)s' placeholder, which will be replaced by the value of the
  2180. # 'server_name' setting in your Synapse configuration.
  2181. #
  2182. # Subject to use when sending a password reset email.
  2183. #password_reset: "[%(server_name)s] Password reset"
  2184. #
  2185. # Subject to use when sending a verification email to assert an address's
  2186. # ownership.
  2187. #email_validation: "[%(server_name)s] Validate your email"
  2188. ## Push ##
  2189. push:
  2190. # Clients requesting push notifications can either have the body of
  2191. # the message sent in the notification poke along with other details
  2192. # like the sender, or just the event ID and room ID (`event_id_only`).
  2193. # If clients choose the former, this option controls whether the
  2194. # notification request includes the content of the event (other details
  2195. # like the sender are still included). For `event_id_only` push, it
  2196. # has no effect.
  2197. #
  2198. # For modern android devices the notification content will still appear
  2199. # because it is loaded by the app. iPhone, however will send a
  2200. # notification saying only that a message arrived and who it came from.
  2201. #
  2202. # The default value is "true" to include message details. Uncomment to only
  2203. # include the event ID and room ID in push notification payloads.
  2204. #
  2205. #include_content: false
  2206. # When a push notification is received, an unread count is also sent.
  2207. # This number can either be calculated as the number of unread messages
  2208. # for the user, or the number of *rooms* the user has unread messages in.
  2209. #
  2210. # The default value is "true", meaning push clients will see the number of
  2211. # rooms with unread messages in them. Uncomment to instead send the number
  2212. # of unread messages.
  2213. #
  2214. #group_unread_count_by_room: false
  2215. ## Rooms ##
  2216. # Controls whether locally-created rooms should be end-to-end encrypted by
  2217. # default.
  2218. #
  2219. # Possible options are "all", "invite", and "off". They are defined as:
  2220. #
  2221. # * "all": any locally-created room
  2222. # * "invite": any room created with the "private_chat" or "trusted_private_chat"
  2223. # room creation presets
  2224. # * "off": this option will take no effect
  2225. #
  2226. # The default value is "off".
  2227. #
  2228. # Note that this option will only affect rooms created after it is set. It
  2229. # will also not affect rooms created by other servers.
  2230. #
  2231. #encryption_enabled_by_default_for_room_type: invite
  2232. # Override the default power levels for rooms created on this server, per
  2233. # room creation preset.
  2234. #
  2235. # The appropriate dictionary for the room preset will be applied on top
  2236. # of the existing power levels content.
  2237. #
  2238. # Useful if you know that your users need special permissions in rooms
  2239. # that they create (e.g. to send particular types of state events without
  2240. # needing an elevated power level). This takes the same shape as the
  2241. # `power_level_content_override` parameter in the /createRoom API, but
  2242. # is applied before that parameter.
  2243. #
  2244. # Valid keys are some or all of `private_chat`, `trusted_private_chat`
  2245. # and `public_chat`. Inside each of those should be any of the
  2246. # properties allowed in `power_level_content_override` in the
  2247. # /createRoom API. If any property is missing, its default value will
  2248. # continue to be used. If any property is present, it will overwrite
  2249. # the existing default completely (so if the `events` property exists,
  2250. # the default event power levels will be ignored).
  2251. #
  2252. #default_power_level_content_override:
  2253. # private_chat:
  2254. # "events":
  2255. # "com.example.myeventtype" : 0
  2256. # "m.room.avatar": 50
  2257. # "m.room.canonical_alias": 50
  2258. # "m.room.encryption": 100
  2259. # "m.room.history_visibility": 100
  2260. # "m.room.name": 50
  2261. # "m.room.power_levels": 100
  2262. # "m.room.server_acl": 100
  2263. # "m.room.tombstone": 100
  2264. # "events_default": 1
  2265. # User Directory configuration
  2266. #
  2267. user_directory:
  2268. # Defines whether users can search the user directory. If false then
  2269. # empty responses are returned to all queries. Defaults to true.
  2270. #
  2271. # Uncomment to disable the user directory.
  2272. #
  2273. #enabled: false
  2274. # Defines whether to search all users visible to your HS when searching
  2275. # the user directory. If false, search results will only contain users
  2276. # visible in public rooms and users sharing a room with the requester.
  2277. # Defaults to false.
  2278. #
  2279. # NB. If you set this to true, and the last time the user_directory search
  2280. # indexes were (re)built was before Synapse 1.44, you'll have to
  2281. # rebuild the indexes in order to search through all known users.
  2282. # These indexes are built the first time Synapse starts; admins can
  2283. # manually trigger a rebuild via API following the instructions at
  2284. # https://matrix-org.github.io/synapse/latest/usage/administration/admin_api/background_updates.html#run
  2285. #
  2286. # Uncomment to return search results containing all known users, even if that
  2287. # user does not share a room with the requester.
  2288. #
  2289. #search_all_users: true
  2290. # Defines whether to prefer local users in search query results.
  2291. # If True, local users are more likely to appear above remote users
  2292. # when searching the user directory. Defaults to false.
  2293. #
  2294. # Uncomment to prefer local over remote users in user directory search
  2295. # results.
  2296. #
  2297. #prefer_local_users: true
  2298. # User Consent configuration
  2299. #
  2300. # for detailed instructions, see
  2301. # https://matrix-org.github.io/synapse/latest/consent_tracking.html
  2302. #
  2303. # Parts of this section are required if enabling the 'consent' resource under
  2304. # 'listeners', in particular 'template_dir' and 'version'.
  2305. #
  2306. # 'template_dir' gives the location of the templates for the HTML forms.
  2307. # This directory should contain one subdirectory per language (eg, 'en', 'fr'),
  2308. # and each language directory should contain the policy document (named as
  2309. # '<version>.html') and a success page (success.html).
  2310. #
  2311. # 'version' specifies the 'current' version of the policy document. It defines
  2312. # the version to be served by the consent resource if there is no 'v'
  2313. # parameter.
  2314. #
  2315. # 'server_notice_content', if enabled, will send a user a "Server Notice"
  2316. # asking them to consent to the privacy policy. The 'server_notices' section
  2317. # must also be configured for this to work. Notices will *not* be sent to
  2318. # guest users unless 'send_server_notice_to_guests' is set to true.
  2319. #
  2320. # 'block_events_error', if set, will block any attempts to send events
  2321. # until the user consents to the privacy policy. The value of the setting is
  2322. # used as the text of the error.
  2323. #
  2324. # 'require_at_registration', if enabled, will add a step to the registration
  2325. # process, similar to how captcha works. Users will be required to accept the
  2326. # policy before their account is created.
  2327. #
  2328. # 'policy_name' is the display name of the policy users will see when registering
  2329. # for an account. Has no effect unless `require_at_registration` is enabled.
  2330. # Defaults to "Privacy Policy".
  2331. #
  2332. #user_consent:
  2333. # template_dir: res/templates/privacy
  2334. # version: 1.0
  2335. # server_notice_content:
  2336. # msgtype: m.text
  2337. # body: >-
  2338. # To continue using this homeserver you must review and agree to the
  2339. # terms and conditions at %(consent_uri)s
  2340. # send_server_notice_to_guests: true
  2341. # block_events_error: >-
  2342. # To continue using this homeserver you must review and agree to the
  2343. # terms and conditions at %(consent_uri)s
  2344. # require_at_registration: false
  2345. # policy_name: Privacy Policy
  2346. #
  2347. # Settings for local room and user statistics collection. See
  2348. # https://matrix-org.github.io/synapse/latest/room_and_user_statistics.html.
  2349. #
  2350. stats:
  2351. # Uncomment the following to disable room and user statistics. Note that doing
  2352. # so may cause certain features (such as the room directory) not to work
  2353. # correctly.
  2354. #
  2355. #enabled: false
  2356. # Server Notices room configuration
  2357. #
  2358. # Uncomment this section to enable a room which can be used to send notices
  2359. # from the server to users. It is a special room which cannot be left; notices
  2360. # come from a special "notices" user id.
  2361. #
  2362. # If you uncomment this section, you *must* define the system_mxid_localpart
  2363. # setting, which defines the id of the user which will be used to send the
  2364. # notices.
  2365. #
  2366. # It's also possible to override the room name, the display name of the
  2367. # "notices" user, and the avatar for the user.
  2368. #
  2369. #server_notices:
  2370. # system_mxid_localpart: notices
  2371. # system_mxid_display_name: "Server Notices"
  2372. # system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
  2373. # room_name: "Server Notices"
  2374. # Uncomment to disable searching the public room list. When disabled
  2375. # blocks searching local and remote room lists for local and remote
  2376. # users by always returning an empty list for all queries.
  2377. #
  2378. #enable_room_list_search: false
  2379. # The `alias_creation` option controls who's allowed to create aliases
  2380. # on this server.
  2381. #
  2382. # The format of this option is a list of rules that contain globs that
  2383. # match against user_id, room_id and the new alias (fully qualified with
  2384. # server name). The action in the first rule that matches is taken,
  2385. # which can currently either be "allow" or "deny".
  2386. #
  2387. # Missing user_id/room_id/alias fields default to "*".
  2388. #
  2389. # If no rules match the request is denied. An empty list means no one
  2390. # can create aliases.
  2391. #
  2392. # Options for the rules include:
  2393. #
  2394. # user_id: Matches against the creator of the alias
  2395. # alias: Matches against the alias being created
  2396. # room_id: Matches against the room ID the alias is being pointed at
  2397. # action: Whether to "allow" or "deny" the request if the rule matches
  2398. #
  2399. # The default is:
  2400. #
  2401. #alias_creation_rules:
  2402. # - user_id: "*"
  2403. # alias: "*"
  2404. # room_id: "*"
  2405. # action: allow
  2406. # The `room_list_publication_rules` option controls who can publish and
  2407. # which rooms can be published in the public room list.
  2408. #
  2409. # The format of this option is the same as that for
  2410. # `alias_creation_rules`.
  2411. #
  2412. # If the room has one or more aliases associated with it, only one of
  2413. # the aliases needs to match the alias rule. If there are no aliases
  2414. # then only rules with `alias: *` match.
  2415. #
  2416. # If no rules match the request is denied. An empty list means no one
  2417. # can publish rooms.
  2418. #
  2419. # Options for the rules include:
  2420. #
  2421. # user_id: Matches against the creator of the alias
  2422. # room_id: Matches against the room ID being published
  2423. # alias: Matches against any current local or canonical aliases
  2424. # associated with the room
  2425. # action: Whether to "allow" or "deny" the request if the rule matches
  2426. #
  2427. # The default is:
  2428. #
  2429. #room_list_publication_rules:
  2430. # - user_id: "*"
  2431. # alias: "*"
  2432. # room_id: "*"
  2433. # action: allow
  2434. ## Opentracing ##
  2435. # These settings enable opentracing, which implements distributed tracing.
  2436. # This allows you to observe the causal chains of events across servers
  2437. # including requests, key lookups etc., across any server running
  2438. # synapse or any other other services which supports opentracing
  2439. # (specifically those implemented with Jaeger).
  2440. #
  2441. opentracing:
  2442. # tracing is disabled by default. Uncomment the following line to enable it.
  2443. #
  2444. #enabled: true
  2445. # The list of homeservers we wish to send and receive span contexts and span baggage.
  2446. # See https://matrix-org.github.io/synapse/latest/opentracing.html.
  2447. #
  2448. # This is a list of regexes which are matched against the server_name of the
  2449. # homeserver.
  2450. #
  2451. # By default, it is empty, so no servers are matched.
  2452. #
  2453. #homeserver_whitelist:
  2454. # - ".*"
  2455. # A list of the matrix IDs of users whose requests will always be traced,
  2456. # even if the tracing system would otherwise drop the traces due to
  2457. # probabilistic sampling.
  2458. #
  2459. # By default, the list is empty.
  2460. #
  2461. #force_tracing_for_users:
  2462. # - "@user1:server_name"
  2463. # - "@user2:server_name"
  2464. # Jaeger can be configured to sample traces at different rates.
  2465. # All configuration options provided by Jaeger can be set here.
  2466. # Jaeger's configuration is mostly related to trace sampling which
  2467. # is documented here:
  2468. # https://www.jaegertracing.io/docs/latest/sampling/.
  2469. #
  2470. #jaeger_config:
  2471. # sampler:
  2472. # type: const
  2473. # param: 1
  2474. # logging:
  2475. # false
  2476. ## Workers ##
  2477. # Disables sending of outbound federation transactions on the main process.
  2478. # Uncomment if using a federation sender worker.
  2479. #
  2480. #send_federation: false
  2481. # It is possible to run multiple federation sender workers, in which case the
  2482. # work is balanced across them.
  2483. #
  2484. # This configuration must be shared between all federation sender workers, and if
  2485. # changed all federation sender workers must be stopped at the same time and then
  2486. # started, to ensure that all instances are running with the same config (otherwise
  2487. # events may be dropped).
  2488. #
  2489. #federation_sender_instances:
  2490. # - federation_sender1
  2491. # When using workers this should be a map from `worker_name` to the
  2492. # HTTP replication listener of the worker, if configured.
  2493. #
  2494. #instance_map:
  2495. # worker1:
  2496. # host: localhost
  2497. # port: 8034
  2498. # Experimental: When using workers you can define which workers should
  2499. # handle event persistence and typing notifications. Any worker
  2500. # specified here must also be in the `instance_map`.
  2501. #
  2502. #stream_writers:
  2503. # events: worker1
  2504. # typing: worker1
  2505. # The worker that is used to run background tasks (e.g. cleaning up expired
  2506. # data). If not provided this defaults to the main process.
  2507. #
  2508. #run_background_tasks_on: worker1
  2509. # A shared secret used by the replication APIs to authenticate HTTP requests
  2510. # from workers.
  2511. #
  2512. # By default this is unused and traffic is not authenticated.
  2513. #
  2514. #worker_replication_secret: ""
  2515. # Configuration for Redis when using workers. This *must* be enabled when
  2516. # using workers (unless using old style direct TCP configuration).
  2517. #
  2518. redis:
  2519. # Uncomment the below to enable Redis support.
  2520. #
  2521. #enabled: true
  2522. # Optional host and port to use to connect to redis. Defaults to
  2523. # localhost and 6379
  2524. #
  2525. #host: localhost
  2526. #port: 6379
  2527. # Optional password if configured on the Redis instance
  2528. #
  2529. #password: <secret_password>
  2530. ## Background Updates ##
  2531. # Background updates are database updates that are run in the background in batches.
  2532. # The duration, minimum batch size, default batch size, whether to sleep between batches and if so, how long to
  2533. # sleep can all be configured. This is helpful to speed up or slow down the updates.
  2534. #
  2535. background_updates:
  2536. # How long in milliseconds to run a batch of background updates for. Defaults to 100. Uncomment and set
  2537. # a time to change the default.
  2538. #
  2539. #background_update_duration_ms: 500
  2540. # Whether to sleep between updates. Defaults to True. Uncomment to change the default.
  2541. #
  2542. #sleep_enabled: false
  2543. # If sleeping between updates, how long in milliseconds to sleep for. Defaults to 1000. Uncomment
  2544. # and set a duration to change the default.
  2545. #
  2546. #sleep_duration_ms: 300
  2547. # Minimum size a batch of background updates can be. Must be greater than 0. Defaults to 1. Uncomment and
  2548. # set a size to change the default.
  2549. #
  2550. #min_batch_size: 10
  2551. # The batch size to use for the first iteration of a new background update. The default is 100.
  2552. # Uncomment and set a size to change the default.
  2553. #
  2554. #default_batch_size: 50