sample_config.yaml 65 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924
  1. # This file is maintained as an up-to-date snapshot of the default
  2. # homeserver.yaml configuration generated by Synapse.
  3. #
  4. # It is intended to act as a reference for the default configuration,
  5. # helping admins keep track of new options and other changes, and compare
  6. # their configs with the current default. As such, many of the actual
  7. # config values shown are placeholders.
  8. #
  9. # It is *not* intended to be copied and used as the basis for a real
  10. # homeserver.yaml. Instead, if you are starting from scratch, please generate
  11. # a fresh config using Synapse by following the instructions in INSTALL.md.
  12. ################################################################################
  13. # Configuration file for Synapse.
  14. #
  15. # This is a YAML file: see [1] for a quick introduction. Note in particular
  16. # that *indentation is important*: all the elements of a list or dictionary
  17. # should have the same indentation.
  18. #
  19. # [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
  20. ## Server ##
  21. # The domain name of the server, with optional explicit port.
  22. # This is used by remote servers to connect to this server,
  23. # e.g. matrix.org, localhost:8080, etc.
  24. # This is also the last part of your UserID.
  25. #
  26. server_name: "SERVERNAME"
  27. # When running as a daemon, the file to store the pid in
  28. #
  29. pid_file: DATADIR/homeserver.pid
  30. # The path to the web client which will be served at /_matrix/client/
  31. # if 'webclient' is configured under the 'listeners' configuration.
  32. #
  33. #web_client_location: "/path/to/web/root"
  34. # The public-facing base URL that clients use to access this HS
  35. # (not including _matrix/...). This is the same URL a user would
  36. # enter into the 'custom HS URL' field on their client. If you
  37. # use synapse with a reverse proxy, this should be the URL to reach
  38. # synapse via the proxy.
  39. #
  40. #public_baseurl: https://example.com/
  41. # Set the soft limit on the number of file descriptors synapse can use
  42. # Zero is used to indicate synapse should set the soft limit to the
  43. # hard limit.
  44. #
  45. #soft_file_limit: 0
  46. # Set to false to disable presence tracking on this homeserver.
  47. #
  48. #use_presence: false
  49. # Whether to require authentication to retrieve profile data (avatars,
  50. # display names) of other users through the client API. Defaults to
  51. # 'false'. Note that profile data is also available via the federation
  52. # API, so this setting is of limited value if federation is enabled on
  53. # the server.
  54. #
  55. #require_auth_for_profile_requests: true
  56. # Uncomment to require a user to share a room with another user in order
  57. # to retrieve their profile information. Only checked on Client-Server
  58. # requests. Profile requests from other servers should be checked by the
  59. # requesting server. Defaults to 'false'.
  60. #
  61. #limit_profile_requests_to_users_who_share_rooms: true
  62. # If set to 'true', removes the need for authentication to access the server's
  63. # public rooms directory through the client API, meaning that anyone can
  64. # query the room directory. Defaults to 'false'.
  65. #
  66. #allow_public_rooms_without_auth: true
  67. # If set to 'true', allows any other homeserver to fetch the server's public
  68. # rooms directory via federation. Defaults to 'false'.
  69. #
  70. #allow_public_rooms_over_federation: true
  71. # The default room version for newly created rooms.
  72. #
  73. # Known room versions are listed here:
  74. # https://matrix.org/docs/spec/#complete-list-of-room-versions
  75. #
  76. # For example, for room version 1, default_room_version should be set
  77. # to "1".
  78. #
  79. #default_room_version: "5"
  80. # The GC threshold parameters to pass to `gc.set_threshold`, if defined
  81. #
  82. #gc_thresholds: [700, 10, 10]
  83. # Set the limit on the returned events in the timeline in the get
  84. # and sync operations. The default value is -1, means no upper limit.
  85. #
  86. #filter_timeline_limit: 5000
  87. # Whether room invites to users on this server should be blocked
  88. # (except those sent by local server admins). The default is False.
  89. #
  90. #block_non_admin_invites: true
  91. # Room searching
  92. #
  93. # If disabled, new messages will not be indexed for searching and users
  94. # will receive errors when searching for messages. Defaults to enabled.
  95. #
  96. #enable_search: false
  97. # Restrict federation to the following whitelist of domains.
  98. # N.B. we recommend also firewalling your federation listener to limit
  99. # inbound federation traffic as early as possible, rather than relying
  100. # purely on this application-layer restriction. If not specified, the
  101. # default is to whitelist everything.
  102. #
  103. #federation_domain_whitelist:
  104. # - lon.example.com
  105. # - nyc.example.com
  106. # - syd.example.com
  107. # Prevent federation requests from being sent to the following
  108. # blacklist IP address CIDR ranges. If this option is not specified, or
  109. # specified with an empty list, no ip range blacklist will be enforced.
  110. #
  111. # As of Synapse v1.4.0 this option also affects any outbound requests to identity
  112. # servers provided by user input.
  113. #
  114. # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
  115. # listed here, since they correspond to unroutable addresses.)
  116. #
  117. federation_ip_range_blacklist:
  118. - '127.0.0.0/8'
  119. - '10.0.0.0/8'
  120. - '172.16.0.0/12'
  121. - '192.168.0.0/16'
  122. - '100.64.0.0/10'
  123. - '169.254.0.0/16'
  124. - '::1/128'
  125. - 'fe80::/64'
  126. - 'fc00::/7'
  127. # List of ports that Synapse should listen on, their purpose and their
  128. # configuration.
  129. #
  130. # Options for each listener include:
  131. #
  132. # port: the TCP port to bind to
  133. #
  134. # bind_addresses: a list of local addresses to listen on. The default is
  135. # 'all local interfaces'.
  136. #
  137. # type: the type of listener. Normally 'http', but other valid options are:
  138. # 'manhole' (see docs/manhole.md),
  139. # 'metrics' (see docs/metrics-howto.md),
  140. # 'replication' (see docs/workers.md).
  141. #
  142. # tls: set to true to enable TLS for this listener. Will use the TLS
  143. # key/cert specified in tls_private_key_path / tls_certificate_path.
  144. #
  145. # x_forwarded: Only valid for an 'http' listener. Set to true to use the
  146. # X-Forwarded-For header as the client IP. Useful when Synapse is
  147. # behind a reverse-proxy.
  148. #
  149. # resources: Only valid for an 'http' listener. A list of resources to host
  150. # on this port. Options for each resource are:
  151. #
  152. # names: a list of names of HTTP resources. See below for a list of
  153. # valid resource names.
  154. #
  155. # compress: set to true to enable HTTP comression for this resource.
  156. #
  157. # additional_resources: Only valid for an 'http' listener. A map of
  158. # additional endpoints which should be loaded via dynamic modules.
  159. #
  160. # Valid resource names are:
  161. #
  162. # client: the client-server API (/_matrix/client), and the synapse admin
  163. # API (/_synapse/admin). Also implies 'media' and 'static'.
  164. #
  165. # consent: user consent forms (/_matrix/consent). See
  166. # docs/consent_tracking.md.
  167. #
  168. # federation: the server-server API (/_matrix/federation). Also implies
  169. # 'media', 'keys', 'openid'
  170. #
  171. # keys: the key discovery API (/_matrix/keys).
  172. #
  173. # media: the media API (/_matrix/media).
  174. #
  175. # metrics: the metrics interface. See docs/metrics-howto.md.
  176. #
  177. # openid: OpenID authentication.
  178. #
  179. # replication: the HTTP replication API (/_synapse/replication). See
  180. # docs/workers.md.
  181. #
  182. # static: static resources under synapse/static (/_matrix/static). (Mostly
  183. # useful for 'fallback authentication'.)
  184. #
  185. # webclient: A web client. Requires web_client_location to be set.
  186. #
  187. listeners:
  188. # TLS-enabled listener: for when matrix traffic is sent directly to synapse.
  189. #
  190. # Disabled by default. To enable it, uncomment the following. (Note that you
  191. # will also need to give Synapse a TLS key and certificate: see the TLS section
  192. # below.)
  193. #
  194. #- port: 8448
  195. # type: http
  196. # tls: true
  197. # resources:
  198. # - names: [client, federation]
  199. # Unsecure HTTP listener: for when matrix traffic passes through a reverse proxy
  200. # that unwraps TLS.
  201. #
  202. # If you plan to use a reverse proxy, please see
  203. # https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md.
  204. #
  205. - port: 8008
  206. tls: false
  207. type: http
  208. x_forwarded: true
  209. bind_addresses: ['::1', '127.0.0.1']
  210. resources:
  211. - names: [client, federation]
  212. compress: false
  213. # example additional_resources:
  214. #
  215. #additional_resources:
  216. # "/_matrix/my/custom/endpoint":
  217. # module: my_module.CustomRequestHandler
  218. # config: {}
  219. # Turn on the twisted ssh manhole service on localhost on the given
  220. # port.
  221. #
  222. #- port: 9000
  223. # bind_addresses: ['::1', '127.0.0.1']
  224. # type: manhole
  225. ## Homeserver blocking ##
  226. # How to reach the server admin, used in ResourceLimitError
  227. #
  228. #admin_contact: 'mailto:admin@server.com'
  229. # Global blocking
  230. #
  231. #hs_disabled: false
  232. #hs_disabled_message: 'Human readable reason for why the HS is blocked'
  233. # Monthly Active User Blocking
  234. #
  235. # Used in cases where the admin or server owner wants to limit to the
  236. # number of monthly active users.
  237. #
  238. # 'limit_usage_by_mau' disables/enables monthly active user blocking. When
  239. # anabled and a limit is reached the server returns a 'ResourceLimitError'
  240. # with error type Codes.RESOURCE_LIMIT_EXCEEDED
  241. #
  242. # 'max_mau_value' is the hard limit of monthly active users above which
  243. # the server will start blocking user actions.
  244. #
  245. # 'mau_trial_days' is a means to add a grace period for active users. It
  246. # means that users must be active for this number of days before they
  247. # can be considered active and guards against the case where lots of users
  248. # sign up in a short space of time never to return after their initial
  249. # session.
  250. #
  251. # 'mau_limit_alerting' is a means of limiting client side alerting
  252. # should the mau limit be reached. This is useful for small instances
  253. # where the admin has 5 mau seats (say) for 5 specific people and no
  254. # interest increasing the mau limit further. Defaults to True, which
  255. # means that alerting is enabled
  256. #
  257. #limit_usage_by_mau: false
  258. #max_mau_value: 50
  259. #mau_trial_days: 2
  260. #mau_limit_alerting: false
  261. # If enabled, the metrics for the number of monthly active users will
  262. # be populated, however no one will be limited. If limit_usage_by_mau
  263. # is true, this is implied to be true.
  264. #
  265. #mau_stats_only: false
  266. # Sometimes the server admin will want to ensure certain accounts are
  267. # never blocked by mau checking. These accounts are specified here.
  268. #
  269. #mau_limit_reserved_threepids:
  270. # - medium: 'email'
  271. # address: 'reserved_user@example.com'
  272. # Used by phonehome stats to group together related servers.
  273. #server_context: context
  274. # Resource-constrained homeserver Settings
  275. #
  276. # If limit_remote_rooms.enabled is True, the room complexity will be
  277. # checked before a user joins a new remote room. If it is above
  278. # limit_remote_rooms.complexity, it will disallow joining or
  279. # instantly leave.
  280. #
  281. # limit_remote_rooms.complexity_error can be set to customise the text
  282. # displayed to the user when a room above the complexity threshold has
  283. # its join cancelled.
  284. #
  285. # Uncomment the below lines to enable:
  286. #limit_remote_rooms:
  287. # enabled: true
  288. # complexity: 1.0
  289. # complexity_error: "This room is too complex."
  290. # Whether to require a user to be in the room to add an alias to it.
  291. # Defaults to 'true'.
  292. #
  293. #require_membership_for_aliases: false
  294. # Whether to allow per-room membership profiles through the send of membership
  295. # events with profile information that differ from the target's global profile.
  296. # Defaults to 'true'.
  297. #
  298. #allow_per_room_profiles: false
  299. # How long to keep redacted events in unredacted form in the database. After
  300. # this period redacted events get replaced with their redacted form in the DB.
  301. #
  302. # Defaults to `7d`. Set to `null` to disable.
  303. #
  304. #redaction_retention_period: 28d
  305. # How long to track users' last seen time and IPs in the database.
  306. #
  307. # Defaults to `28d`. Set to `null` to disable clearing out of old rows.
  308. #
  309. #user_ips_max_age: 14d
  310. # Message retention policy at the server level.
  311. #
  312. # Room admins and mods can define a retention period for their rooms using the
  313. # 'm.room.retention' state event, and server admins can cap this period by setting
  314. # the 'allowed_lifetime_min' and 'allowed_lifetime_max' config options.
  315. #
  316. # If this feature is enabled, Synapse will regularly look for and purge events
  317. # which are older than the room's maximum retention period. Synapse will also
  318. # filter events received over federation so that events that should have been
  319. # purged are ignored and not stored again.
  320. #
  321. retention:
  322. # The message retention policies feature is disabled by default. Uncomment the
  323. # following line to enable it.
  324. #
  325. #enabled: true
  326. # Default retention policy. If set, Synapse will apply it to rooms that lack the
  327. # 'm.room.retention' state event. Currently, the value of 'min_lifetime' doesn't
  328. # matter much because Synapse doesn't take it into account yet.
  329. #
  330. #default_policy:
  331. # min_lifetime: 1d
  332. # max_lifetime: 1y
  333. # Retention policy limits. If set, a user won't be able to send a
  334. # 'm.room.retention' event which features a 'min_lifetime' or a 'max_lifetime'
  335. # that's not within this range. This is especially useful in closed federations,
  336. # in which server admins can make sure every federating server applies the same
  337. # rules.
  338. #
  339. #allowed_lifetime_min: 1d
  340. #allowed_lifetime_max: 1y
  341. # Server admins can define the settings of the background jobs purging the
  342. # events which lifetime has expired under the 'purge_jobs' section.
  343. #
  344. # If no configuration is provided, a single job will be set up to delete expired
  345. # events in every room daily.
  346. #
  347. # Each job's configuration defines which range of message lifetimes the job
  348. # takes care of. For example, if 'shortest_max_lifetime' is '2d' and
  349. # 'longest_max_lifetime' is '3d', the job will handle purging expired events in
  350. # rooms whose state defines a 'max_lifetime' that's both higher than 2 days, and
  351. # lower than or equal to 3 days. Both the minimum and the maximum value of a
  352. # range are optional, e.g. a job with no 'shortest_max_lifetime' and a
  353. # 'longest_max_lifetime' of '3d' will handle every room with a retention policy
  354. # which 'max_lifetime' is lower than or equal to three days.
  355. #
  356. # The rationale for this per-job configuration is that some rooms might have a
  357. # retention policy with a low 'max_lifetime', where history needs to be purged
  358. # of outdated messages on a more frequent basis than for the rest of the rooms
  359. # (e.g. every 12h), but not want that purge to be performed by a job that's
  360. # iterating over every room it knows, which could be heavy on the server.
  361. #
  362. #purge_jobs:
  363. # - shortest_max_lifetime: 1d
  364. # longest_max_lifetime: 3d
  365. # interval: 12h
  366. # - shortest_max_lifetime: 3d
  367. # longest_max_lifetime: 1y
  368. # interval: 1d
  369. ## TLS ##
  370. # PEM-encoded X509 certificate for TLS.
  371. # This certificate, as of Synapse 1.0, will need to be a valid and verifiable
  372. # certificate, signed by a recognised Certificate Authority.
  373. #
  374. # See 'ACME support' below to enable auto-provisioning this certificate via
  375. # Let's Encrypt.
  376. #
  377. # If supplying your own, be sure to use a `.pem` file that includes the
  378. # full certificate chain including any intermediate certificates (for
  379. # instance, if using certbot, use `fullchain.pem` as your certificate,
  380. # not `cert.pem`).
  381. #
  382. #tls_certificate_path: "CONFDIR/SERVERNAME.tls.crt"
  383. # PEM-encoded private key for TLS
  384. #
  385. #tls_private_key_path: "CONFDIR/SERVERNAME.tls.key"
  386. # Whether to verify TLS server certificates for outbound federation requests.
  387. #
  388. # Defaults to `true`. To disable certificate verification, uncomment the
  389. # following line.
  390. #
  391. #federation_verify_certificates: false
  392. # The minimum TLS version that will be used for outbound federation requests.
  393. #
  394. # Defaults to `1`. Configurable to `1`, `1.1`, `1.2`, or `1.3`. Note
  395. # that setting this value higher than `1.2` will prevent federation to most
  396. # of the public Matrix network: only configure it to `1.3` if you have an
  397. # entirely private federation setup and you can ensure TLS 1.3 support.
  398. #
  399. #federation_client_minimum_tls_version: 1.2
  400. # Skip federation certificate verification on the following whitelist
  401. # of domains.
  402. #
  403. # This setting should only be used in very specific cases, such as
  404. # federation over Tor hidden services and similar. For private networks
  405. # of homeservers, you likely want to use a private CA instead.
  406. #
  407. # Only effective if federation_verify_certicates is `true`.
  408. #
  409. #federation_certificate_verification_whitelist:
  410. # - lon.example.com
  411. # - *.domain.com
  412. # - *.onion
  413. # List of custom certificate authorities for federation traffic.
  414. #
  415. # This setting should only normally be used within a private network of
  416. # homeservers.
  417. #
  418. # Note that this list will replace those that are provided by your
  419. # operating environment. Certificates must be in PEM format.
  420. #
  421. #federation_custom_ca_list:
  422. # - myCA1.pem
  423. # - myCA2.pem
  424. # - myCA3.pem
  425. # ACME support: This will configure Synapse to request a valid TLS certificate
  426. # for your configured `server_name` via Let's Encrypt.
  427. #
  428. # Note that ACME v1 is now deprecated, and Synapse currently doesn't support
  429. # ACME v2. This means that this feature currently won't work with installs set
  430. # up after November 2019. For more info, and alternative solutions, see
  431. # https://github.com/matrix-org/synapse/blob/master/docs/ACME.md#deprecation-of-acme-v1
  432. #
  433. # Note that provisioning a certificate in this way requires port 80 to be
  434. # routed to Synapse so that it can complete the http-01 ACME challenge.
  435. # By default, if you enable ACME support, Synapse will attempt to listen on
  436. # port 80 for incoming http-01 challenges - however, this will likely fail
  437. # with 'Permission denied' or a similar error.
  438. #
  439. # There are a couple of potential solutions to this:
  440. #
  441. # * If you already have an Apache, Nginx, or similar listening on port 80,
  442. # you can configure Synapse to use an alternate port, and have your web
  443. # server forward the requests. For example, assuming you set 'port: 8009'
  444. # below, on Apache, you would write:
  445. #
  446. # ProxyPass /.well-known/acme-challenge http://localhost:8009/.well-known/acme-challenge
  447. #
  448. # * Alternatively, you can use something like `authbind` to give Synapse
  449. # permission to listen on port 80.
  450. #
  451. acme:
  452. # ACME support is disabled by default. Set this to `true` and uncomment
  453. # tls_certificate_path and tls_private_key_path above to enable it.
  454. #
  455. enabled: false
  456. # Endpoint to use to request certificates. If you only want to test,
  457. # use Let's Encrypt's staging url:
  458. # https://acme-staging.api.letsencrypt.org/directory
  459. #
  460. #url: https://acme-v01.api.letsencrypt.org/directory
  461. # Port number to listen on for the HTTP-01 challenge. Change this if
  462. # you are forwarding connections through Apache/Nginx/etc.
  463. #
  464. port: 80
  465. # Local addresses to listen on for incoming connections.
  466. # Again, you may want to change this if you are forwarding connections
  467. # through Apache/Nginx/etc.
  468. #
  469. bind_addresses: ['::', '0.0.0.0']
  470. # How many days remaining on a certificate before it is renewed.
  471. #
  472. reprovision_threshold: 30
  473. # The domain that the certificate should be for. Normally this
  474. # should be the same as your Matrix domain (i.e., 'server_name'), but,
  475. # by putting a file at 'https://<server_name>/.well-known/matrix/server',
  476. # you can delegate incoming traffic to another server. If you do that,
  477. # you should give the target of the delegation here.
  478. #
  479. # For example: if your 'server_name' is 'example.com', but
  480. # 'https://example.com/.well-known/matrix/server' delegates to
  481. # 'matrix.example.com', you should put 'matrix.example.com' here.
  482. #
  483. # If not set, defaults to your 'server_name'.
  484. #
  485. domain: matrix.example.com
  486. # file to use for the account key. This will be generated if it doesn't
  487. # exist.
  488. #
  489. # If unspecified, we will use CONFDIR/client.key.
  490. #
  491. account_key_file: DATADIR/acme_account.key
  492. # List of allowed TLS fingerprints for this server to publish along
  493. # with the signing keys for this server. Other matrix servers that
  494. # make HTTPS requests to this server will check that the TLS
  495. # certificates returned by this server match one of the fingerprints.
  496. #
  497. # Synapse automatically adds the fingerprint of its own certificate
  498. # to the list. So if federation traffic is handled directly by synapse
  499. # then no modification to the list is required.
  500. #
  501. # If synapse is run behind a load balancer that handles the TLS then it
  502. # will be necessary to add the fingerprints of the certificates used by
  503. # the loadbalancers to this list if they are different to the one
  504. # synapse is using.
  505. #
  506. # Homeservers are permitted to cache the list of TLS fingerprints
  507. # returned in the key responses up to the "valid_until_ts" returned in
  508. # key. It may be necessary to publish the fingerprints of a new
  509. # certificate and wait until the "valid_until_ts" of the previous key
  510. # responses have passed before deploying it.
  511. #
  512. # You can calculate a fingerprint from a given TLS listener via:
  513. # openssl s_client -connect $host:$port < /dev/null 2> /dev/null |
  514. # openssl x509 -outform DER | openssl sha256 -binary | base64 | tr -d '='
  515. # or by checking matrix.org/federationtester/api/report?server_name=$host
  516. #
  517. #tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
  518. ## Database ##
  519. # The 'database' setting defines the database that synapse uses to store all of
  520. # its data.
  521. #
  522. # 'name' gives the database engine to use: either 'sqlite3' (for SQLite) or
  523. # 'psycopg2' (for PostgreSQL).
  524. #
  525. # 'args' gives options which are passed through to the database engine,
  526. # except for options starting 'cp_', which are used to configure the Twisted
  527. # connection pool. For a reference to valid arguments, see:
  528. # * for sqlite: https://docs.python.org/3/library/sqlite3.html#sqlite3.connect
  529. # * for postgres: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
  530. # * for the connection pool: https://twistedmatrix.com/documents/current/api/twisted.enterprise.adbapi.ConnectionPool.html#__init__
  531. #
  532. #
  533. # Example SQLite configuration:
  534. #
  535. #database:
  536. # name: sqlite3
  537. # args:
  538. # database: /path/to/homeserver.db
  539. #
  540. #
  541. # Example Postgres configuration:
  542. #
  543. #database:
  544. # name: psycopg2
  545. # args:
  546. # user: synapse
  547. # password: secretpassword
  548. # database: synapse
  549. # host: localhost
  550. # cp_min: 5
  551. # cp_max: 10
  552. #
  553. # For more information on using Synapse with Postgres, see `docs/postgres.md`.
  554. #
  555. database:
  556. name: sqlite3
  557. args:
  558. database: DATADIR/homeserver.db
  559. # Number of events to cache in memory.
  560. #
  561. #event_cache_size: 10K
  562. ## Logging ##
  563. # A yaml python logging config file as described by
  564. # https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
  565. #
  566. log_config: "CONFDIR/SERVERNAME.log.config"
  567. ## Ratelimiting ##
  568. # Ratelimiting settings for client actions (registration, login, messaging).
  569. #
  570. # Each ratelimiting configuration is made of two parameters:
  571. # - per_second: number of requests a client can send per second.
  572. # - burst_count: number of requests a client can send before being throttled.
  573. #
  574. # Synapse currently uses the following configurations:
  575. # - one for messages that ratelimits sending based on the account the client
  576. # is using
  577. # - one for registration that ratelimits registration requests based on the
  578. # client's IP address.
  579. # - one for login that ratelimits login requests based on the client's IP
  580. # address.
  581. # - one for login that ratelimits login requests based on the account the
  582. # client is attempting to log into.
  583. # - one for login that ratelimits login requests based on the account the
  584. # client is attempting to log into, based on the amount of failed login
  585. # attempts for this account.
  586. # - one for ratelimiting redactions by room admins. If this is not explicitly
  587. # set then it uses the same ratelimiting as per rc_message. This is useful
  588. # to allow room admins to deal with abuse quickly.
  589. #
  590. # The defaults are as shown below.
  591. #
  592. #rc_message:
  593. # per_second: 0.2
  594. # burst_count: 10
  595. #
  596. #rc_registration:
  597. # per_second: 0.17
  598. # burst_count: 3
  599. #
  600. #rc_login:
  601. # address:
  602. # per_second: 0.17
  603. # burst_count: 3
  604. # account:
  605. # per_second: 0.17
  606. # burst_count: 3
  607. # failed_attempts:
  608. # per_second: 0.17
  609. # burst_count: 3
  610. #
  611. #rc_admin_redaction:
  612. # per_second: 1
  613. # burst_count: 50
  614. # Ratelimiting settings for incoming federation
  615. #
  616. # The rc_federation configuration is made up of the following settings:
  617. # - window_size: window size in milliseconds
  618. # - sleep_limit: number of federation requests from a single server in
  619. # a window before the server will delay processing the request.
  620. # - sleep_delay: duration in milliseconds to delay processing events
  621. # from remote servers by if they go over the sleep limit.
  622. # - reject_limit: maximum number of concurrent federation requests
  623. # allowed from a single server
  624. # - concurrent: number of federation requests to concurrently process
  625. # from a single server
  626. #
  627. # The defaults are as shown below.
  628. #
  629. #rc_federation:
  630. # window_size: 1000
  631. # sleep_limit: 10
  632. # sleep_delay: 500
  633. # reject_limit: 50
  634. # concurrent: 3
  635. # Target outgoing federation transaction frequency for sending read-receipts,
  636. # per-room.
  637. #
  638. # If we end up trying to send out more read-receipts, they will get buffered up
  639. # into fewer transactions.
  640. #
  641. #federation_rr_transactions_per_room_per_second: 50
  642. ## Media Store ##
  643. # Enable the media store service in the Synapse master. Uncomment the
  644. # following if you are using a separate media store worker.
  645. #
  646. #enable_media_repo: false
  647. # Directory where uploaded images and attachments are stored.
  648. #
  649. media_store_path: "DATADIR/media_store"
  650. # Media storage providers allow media to be stored in different
  651. # locations.
  652. #
  653. #media_storage_providers:
  654. # - module: file_system
  655. # # Whether to write new local files.
  656. # store_local: false
  657. # # Whether to write new remote media
  658. # store_remote: false
  659. # # Whether to block upload requests waiting for write to this
  660. # # provider to complete
  661. # store_synchronous: false
  662. # config:
  663. # directory: /mnt/some/other/directory
  664. # The largest allowed upload size in bytes
  665. #
  666. #max_upload_size: 10M
  667. # Maximum number of pixels that will be thumbnailed
  668. #
  669. #max_image_pixels: 32M
  670. # Whether to generate new thumbnails on the fly to precisely match
  671. # the resolution requested by the client. If true then whenever
  672. # a new resolution is requested by the client the server will
  673. # generate a new thumbnail. If false the server will pick a thumbnail
  674. # from a precalculated list.
  675. #
  676. #dynamic_thumbnails: false
  677. # List of thumbnails to precalculate when an image is uploaded.
  678. #
  679. #thumbnail_sizes:
  680. # - width: 32
  681. # height: 32
  682. # method: crop
  683. # - width: 96
  684. # height: 96
  685. # method: crop
  686. # - width: 320
  687. # height: 240
  688. # method: scale
  689. # - width: 640
  690. # height: 480
  691. # method: scale
  692. # - width: 800
  693. # height: 600
  694. # method: scale
  695. # Is the preview URL API enabled?
  696. #
  697. # 'false' by default: uncomment the following to enable it (and specify a
  698. # url_preview_ip_range_blacklist blacklist).
  699. #
  700. #url_preview_enabled: true
  701. # List of IP address CIDR ranges that the URL preview spider is denied
  702. # from accessing. There are no defaults: you must explicitly
  703. # specify a list for URL previewing to work. You should specify any
  704. # internal services in your network that you do not want synapse to try
  705. # to connect to, otherwise anyone in any Matrix room could cause your
  706. # synapse to issue arbitrary GET requests to your internal services,
  707. # causing serious security issues.
  708. #
  709. # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
  710. # listed here, since they correspond to unroutable addresses.)
  711. #
  712. # This must be specified if url_preview_enabled is set. It is recommended that
  713. # you uncomment the following list as a starting point.
  714. #
  715. #url_preview_ip_range_blacklist:
  716. # - '127.0.0.0/8'
  717. # - '10.0.0.0/8'
  718. # - '172.16.0.0/12'
  719. # - '192.168.0.0/16'
  720. # - '100.64.0.0/10'
  721. # - '169.254.0.0/16'
  722. # - '::1/128'
  723. # - 'fe80::/64'
  724. # - 'fc00::/7'
  725. # List of IP address CIDR ranges that the URL preview spider is allowed
  726. # to access even if they are specified in url_preview_ip_range_blacklist.
  727. # This is useful for specifying exceptions to wide-ranging blacklisted
  728. # target IP ranges - e.g. for enabling URL previews for a specific private
  729. # website only visible in your network.
  730. #
  731. #url_preview_ip_range_whitelist:
  732. # - '192.168.1.1'
  733. # Optional list of URL matches that the URL preview spider is
  734. # denied from accessing. You should use url_preview_ip_range_blacklist
  735. # in preference to this, otherwise someone could define a public DNS
  736. # entry that points to a private IP address and circumvent the blacklist.
  737. # This is more useful if you know there is an entire shape of URL that
  738. # you know that will never want synapse to try to spider.
  739. #
  740. # Each list entry is a dictionary of url component attributes as returned
  741. # by urlparse.urlsplit as applied to the absolute form of the URL. See
  742. # https://docs.python.org/2/library/urlparse.html#urlparse.urlsplit
  743. # The values of the dictionary are treated as an filename match pattern
  744. # applied to that component of URLs, unless they start with a ^ in which
  745. # case they are treated as a regular expression match. If all the
  746. # specified component matches for a given list item succeed, the URL is
  747. # blacklisted.
  748. #
  749. #url_preview_url_blacklist:
  750. # # blacklist any URL with a username in its URI
  751. # - username: '*'
  752. #
  753. # # blacklist all *.google.com URLs
  754. # - netloc: 'google.com'
  755. # - netloc: '*.google.com'
  756. #
  757. # # blacklist all plain HTTP URLs
  758. # - scheme: 'http'
  759. #
  760. # # blacklist http(s)://www.acme.com/foo
  761. # - netloc: 'www.acme.com'
  762. # path: '/foo'
  763. #
  764. # # blacklist any URL with a literal IPv4 address
  765. # - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
  766. # The largest allowed URL preview spidering size in bytes
  767. #
  768. #max_spider_size: 10M
  769. ## Captcha ##
  770. # See docs/CAPTCHA_SETUP for full details of configuring this.
  771. # This homeserver's ReCAPTCHA public key.
  772. #
  773. #recaptcha_public_key: "YOUR_PUBLIC_KEY"
  774. # This homeserver's ReCAPTCHA private key.
  775. #
  776. #recaptcha_private_key: "YOUR_PRIVATE_KEY"
  777. # Enables ReCaptcha checks when registering, preventing signup
  778. # unless a captcha is answered. Requires a valid ReCaptcha
  779. # public/private key.
  780. #
  781. #enable_registration_captcha: false
  782. # The API endpoint to use for verifying m.login.recaptcha responses.
  783. #
  784. #recaptcha_siteverify_api: "https://www.recaptcha.net/recaptcha/api/siteverify"
  785. ## TURN ##
  786. # The public URIs of the TURN server to give to clients
  787. #
  788. #turn_uris: []
  789. # The shared secret used to compute passwords for the TURN server
  790. #
  791. #turn_shared_secret: "YOUR_SHARED_SECRET"
  792. # The Username and password if the TURN server needs them and
  793. # does not use a token
  794. #
  795. #turn_username: "TURNSERVER_USERNAME"
  796. #turn_password: "TURNSERVER_PASSWORD"
  797. # How long generated TURN credentials last
  798. #
  799. #turn_user_lifetime: 1h
  800. # Whether guests should be allowed to use the TURN server.
  801. # This defaults to True, otherwise VoIP will be unreliable for guests.
  802. # However, it does introduce a slight security risk as it allows users to
  803. # connect to arbitrary endpoints without having first signed up for a
  804. # valid account (e.g. by passing a CAPTCHA).
  805. #
  806. #turn_allow_guests: true
  807. ## Registration ##
  808. #
  809. # Registration can be rate-limited using the parameters in the "Ratelimiting"
  810. # section of this file.
  811. # Enable registration for new users.
  812. #
  813. #enable_registration: false
  814. # Optional account validity configuration. This allows for accounts to be denied
  815. # any request after a given period.
  816. #
  817. # Once this feature is enabled, Synapse will look for registered users without an
  818. # expiration date at startup and will add one to every account it found using the
  819. # current settings at that time.
  820. # This means that, if a validity period is set, and Synapse is restarted (it will
  821. # then derive an expiration date from the current validity period), and some time
  822. # after that the validity period changes and Synapse is restarted, the users'
  823. # expiration dates won't be updated unless their account is manually renewed. This
  824. # date will be randomly selected within a range [now + period - d ; now + period],
  825. # where d is equal to 10% of the validity period.
  826. #
  827. account_validity:
  828. # The account validity feature is disabled by default. Uncomment the
  829. # following line to enable it.
  830. #
  831. #enabled: true
  832. # The period after which an account is valid after its registration. When
  833. # renewing the account, its validity period will be extended by this amount
  834. # of time. This parameter is required when using the account validity
  835. # feature.
  836. #
  837. #period: 6w
  838. # The amount of time before an account's expiry date at which Synapse will
  839. # send an email to the account's email address with a renewal link. By
  840. # default, no such emails are sent.
  841. #
  842. # If you enable this setting, you will also need to fill out the 'email' and
  843. # 'public_baseurl' configuration sections.
  844. #
  845. #renew_at: 1w
  846. # The subject of the email sent out with the renewal link. '%(app)s' can be
  847. # used as a placeholder for the 'app_name' parameter from the 'email'
  848. # section.
  849. #
  850. # Note that the placeholder must be written '%(app)s', including the
  851. # trailing 's'.
  852. #
  853. # If this is not set, a default value is used.
  854. #
  855. #renew_email_subject: "Renew your %(app)s account"
  856. # Directory in which Synapse will try to find templates for the HTML files to
  857. # serve to the user when trying to renew an account. If not set, default
  858. # templates from within the Synapse package will be used.
  859. #
  860. #template_dir: "res/templates"
  861. # File within 'template_dir' giving the HTML to be displayed to the user after
  862. # they successfully renewed their account. If not set, default text is used.
  863. #
  864. #account_renewed_html_path: "account_renewed.html"
  865. # File within 'template_dir' giving the HTML to be displayed when the user
  866. # tries to renew an account with an invalid renewal token. If not set,
  867. # default text is used.
  868. #
  869. #invalid_token_html_path: "invalid_token.html"
  870. # Time that a user's session remains valid for, after they log in.
  871. #
  872. # Note that this is not currently compatible with guest logins.
  873. #
  874. # Note also that this is calculated at login time: changes are not applied
  875. # retrospectively to users who have already logged in.
  876. #
  877. # By default, this is infinite.
  878. #
  879. #session_lifetime: 24h
  880. # The user must provide all of the below types of 3PID when registering.
  881. #
  882. #registrations_require_3pid:
  883. # - email
  884. # - msisdn
  885. # Explicitly disable asking for MSISDNs from the registration
  886. # flow (overrides registrations_require_3pid if MSISDNs are set as required)
  887. #
  888. #disable_msisdn_registration: true
  889. # Mandate that users are only allowed to associate certain formats of
  890. # 3PIDs with accounts on this server.
  891. #
  892. #allowed_local_3pids:
  893. # - medium: email
  894. # pattern: '.*@matrix\.org'
  895. # - medium: email
  896. # pattern: '.*@vector\.im'
  897. # - medium: msisdn
  898. # pattern: '\+44'
  899. # Enable 3PIDs lookup requests to identity servers from this server.
  900. #
  901. #enable_3pid_lookup: true
  902. # If set, allows registration of standard or admin accounts by anyone who
  903. # has the shared secret, even if registration is otherwise disabled.
  904. #
  905. # registration_shared_secret: <PRIVATE STRING>
  906. # Set the number of bcrypt rounds used to generate password hash.
  907. # Larger numbers increase the work factor needed to generate the hash.
  908. # The default number is 12 (which equates to 2^12 rounds).
  909. # N.B. that increasing this will exponentially increase the time required
  910. # to register or login - e.g. 24 => 2^24 rounds which will take >20 mins.
  911. #
  912. #bcrypt_rounds: 12
  913. # Allows users to register as guests without a password/email/etc, and
  914. # participate in rooms hosted on this server which have been made
  915. # accessible to anonymous users.
  916. #
  917. #allow_guest_access: false
  918. # The identity server which we suggest that clients should use when users log
  919. # in on this server.
  920. #
  921. # (By default, no suggestion is made, so it is left up to the client.
  922. # This setting is ignored unless public_baseurl is also set.)
  923. #
  924. #default_identity_server: https://matrix.org
  925. # The list of identity servers trusted to verify third party
  926. # identifiers by this server.
  927. #
  928. # Also defines the ID server which will be called when an account is
  929. # deactivated (one will be picked arbitrarily).
  930. #
  931. # Note: This option is deprecated. Since v0.99.4, Synapse has tracked which identity
  932. # server a 3PID has been bound to. For 3PIDs bound before then, Synapse runs a
  933. # background migration script, informing itself that the identity server all of its
  934. # 3PIDs have been bound to is likely one of the below.
  935. #
  936. # As of Synapse v1.4.0, all other functionality of this option has been deprecated, and
  937. # it is now solely used for the purposes of the background migration script, and can be
  938. # removed once it has run.
  939. #trusted_third_party_id_servers:
  940. # - matrix.org
  941. # - vector.im
  942. # Handle threepid (email/phone etc) registration and password resets through a set of
  943. # *trusted* identity servers. Note that this allows the configured identity server to
  944. # reset passwords for accounts!
  945. #
  946. # Be aware that if `email` is not set, and SMTP options have not been
  947. # configured in the email config block, registration and user password resets via
  948. # email will be globally disabled.
  949. #
  950. # Additionally, if `msisdn` is not set, registration and password resets via msisdn
  951. # will be disabled regardless. This is due to Synapse currently not supporting any
  952. # method of sending SMS messages on its own.
  953. #
  954. # To enable using an identity server for operations regarding a particular third-party
  955. # identifier type, set the value to the URL of that identity server as shown in the
  956. # examples below.
  957. #
  958. # Servers handling the these requests must answer the `/requestToken` endpoints defined
  959. # by the Matrix Identity Service API specification:
  960. # https://matrix.org/docs/spec/identity_service/latest
  961. #
  962. # If a delegate is specified, the config option public_baseurl must also be filled out.
  963. #
  964. account_threepid_delegates:
  965. #email: https://example.com # Delegate email sending to example.com
  966. #msisdn: http://localhost:8090 # Delegate SMS sending to this local process
  967. # Whether users are allowed to change their displayname after it has
  968. # been initially set. Useful when provisioning users based on the
  969. # contents of a third-party directory.
  970. #
  971. # Does not apply to server administrators. Defaults to 'true'
  972. #
  973. #enable_set_displayname: false
  974. # Whether users are allowed to change their avatar after it has been
  975. # initially set. Useful when provisioning users based on the contents
  976. # of a third-party directory.
  977. #
  978. # Does not apply to server administrators. Defaults to 'true'
  979. #
  980. #enable_set_avatar_url: false
  981. # Whether users can change the 3PIDs associated with their accounts
  982. # (email address and msisdn).
  983. #
  984. # Defaults to 'true'
  985. #
  986. #enable_3pid_changes: false
  987. # Users who register on this homeserver will automatically be joined
  988. # to these rooms
  989. #
  990. #auto_join_rooms:
  991. # - "#example:example.com"
  992. # Where auto_join_rooms are specified, setting this flag ensures that the
  993. # the rooms exist by creating them when the first user on the
  994. # homeserver registers.
  995. # Setting to false means that if the rooms are not manually created,
  996. # users cannot be auto-joined since they do not exist.
  997. #
  998. #autocreate_auto_join_rooms: true
  999. ## Metrics ###
  1000. # Enable collection and rendering of performance metrics
  1001. #
  1002. #enable_metrics: false
  1003. # Enable sentry integration
  1004. # NOTE: While attempts are made to ensure that the logs don't contain
  1005. # any sensitive information, this cannot be guaranteed. By enabling
  1006. # this option the sentry server may therefore receive sensitive
  1007. # information, and it in turn may then diseminate sensitive information
  1008. # through insecure notification channels if so configured.
  1009. #
  1010. #sentry:
  1011. # dsn: "..."
  1012. # Flags to enable Prometheus metrics which are not suitable to be
  1013. # enabled by default, either for performance reasons or limited use.
  1014. #
  1015. metrics_flags:
  1016. # Publish synapse_federation_known_servers, a g auge of the number of
  1017. # servers this homeserver knows about, including itself. May cause
  1018. # performance problems on large homeservers.
  1019. #
  1020. #known_servers: true
  1021. # Whether or not to report anonymized homeserver usage statistics.
  1022. # report_stats: true|false
  1023. # The endpoint to report the anonymized homeserver usage statistics to.
  1024. # Defaults to https://matrix.org/report-usage-stats/push
  1025. #
  1026. #report_stats_endpoint: https://example.com/report-usage-stats/push
  1027. ## API Configuration ##
  1028. # A list of event types that will be included in the room_invite_state
  1029. #
  1030. #room_invite_state_types:
  1031. # - "m.room.join_rules"
  1032. # - "m.room.canonical_alias"
  1033. # - "m.room.avatar"
  1034. # - "m.room.encryption"
  1035. # - "m.room.name"
  1036. # A list of application service config files to use
  1037. #
  1038. #app_service_config_files:
  1039. # - app_service_1.yaml
  1040. # - app_service_2.yaml
  1041. # Uncomment to enable tracking of application service IP addresses. Implicitly
  1042. # enables MAU tracking for application service users.
  1043. #
  1044. #track_appservice_user_ips: true
  1045. # a secret which is used to sign access tokens. If none is specified,
  1046. # the registration_shared_secret is used, if one is given; otherwise,
  1047. # a secret key is derived from the signing key.
  1048. #
  1049. # macaroon_secret_key: <PRIVATE STRING>
  1050. # a secret which is used to calculate HMACs for form values, to stop
  1051. # falsification of values. Must be specified for the User Consent
  1052. # forms to work.
  1053. #
  1054. # form_secret: <PRIVATE STRING>
  1055. ## Signing Keys ##
  1056. # Path to the signing key to sign messages with
  1057. #
  1058. signing_key_path: "CONFDIR/SERVERNAME.signing.key"
  1059. # The keys that the server used to sign messages with but won't use
  1060. # to sign new messages.
  1061. #
  1062. old_signing_keys:
  1063. # For each key, `key` should be the base64-encoded public key, and
  1064. # `expired_ts`should be the time (in milliseconds since the unix epoch) that
  1065. # it was last used.
  1066. #
  1067. # It is possible to build an entry from an old signing.key file using the
  1068. # `export_signing_key` script which is provided with synapse.
  1069. #
  1070. # For example:
  1071. #
  1072. #"ed25519:id": { key: "base64string", expired_ts: 123456789123 }
  1073. # How long key response published by this server is valid for.
  1074. # Used to set the valid_until_ts in /key/v2 APIs.
  1075. # Determines how quickly servers will query to check which keys
  1076. # are still valid.
  1077. #
  1078. #key_refresh_interval: 1d
  1079. # The trusted servers to download signing keys from.
  1080. #
  1081. # When we need to fetch a signing key, each server is tried in parallel.
  1082. #
  1083. # Normally, the connection to the key server is validated via TLS certificates.
  1084. # Additional security can be provided by configuring a `verify key`, which
  1085. # will make synapse check that the response is signed by that key.
  1086. #
  1087. # This setting supercedes an older setting named `perspectives`. The old format
  1088. # is still supported for backwards-compatibility, but it is deprecated.
  1089. #
  1090. # 'trusted_key_servers' defaults to matrix.org, but using it will generate a
  1091. # warning on start-up. To suppress this warning, set
  1092. # 'suppress_key_server_warning' to true.
  1093. #
  1094. # Options for each entry in the list include:
  1095. #
  1096. # server_name: the name of the server. required.
  1097. #
  1098. # verify_keys: an optional map from key id to base64-encoded public key.
  1099. # If specified, we will check that the response is signed by at least
  1100. # one of the given keys.
  1101. #
  1102. # accept_keys_insecurely: a boolean. Normally, if `verify_keys` is unset,
  1103. # and federation_verify_certificates is not `true`, synapse will refuse
  1104. # to start, because this would allow anyone who can spoof DNS responses
  1105. # to masquerade as the trusted key server. If you know what you are doing
  1106. # and are sure that your network environment provides a secure connection
  1107. # to the key server, you can set this to `true` to override this
  1108. # behaviour.
  1109. #
  1110. # An example configuration might look like:
  1111. #
  1112. #trusted_key_servers:
  1113. # - server_name: "my_trusted_server.example.com"
  1114. # verify_keys:
  1115. # "ed25519:auto": "abcdefghijklmnopqrstuvwxyzabcdefghijklmopqr"
  1116. # - server_name: "my_other_trusted_server.example.com"
  1117. #
  1118. trusted_key_servers:
  1119. - server_name: "matrix.org"
  1120. # Uncomment the following to disable the warning that is emitted when the
  1121. # trusted_key_servers include 'matrix.org'. See above.
  1122. #
  1123. #suppress_key_server_warning: true
  1124. # The signing keys to use when acting as a trusted key server. If not specified
  1125. # defaults to the server signing key.
  1126. #
  1127. # Can contain multiple keys, one per line.
  1128. #
  1129. #key_server_signing_keys_path: "key_server_signing_keys.key"
  1130. # Enable SAML2 for registration and login. Uses pysaml2.
  1131. #
  1132. # At least one of `sp_config` or `config_path` must be set in this section to
  1133. # enable SAML login.
  1134. #
  1135. # (You will probably also want to set the following options to `false` to
  1136. # disable the regular login/registration flows:
  1137. # * enable_registration
  1138. # * password_config.enabled
  1139. #
  1140. # Once SAML support is enabled, a metadata file will be exposed at
  1141. # https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
  1142. # use to configure your SAML IdP with. Alternatively, you can manually configure
  1143. # the IdP to use an ACS location of
  1144. # https://<server>:<port>/_matrix/saml2/authn_response.
  1145. #
  1146. saml2_config:
  1147. # `sp_config` is the configuration for the pysaml2 Service Provider.
  1148. # See pysaml2 docs for format of config.
  1149. #
  1150. # Default values will be used for the 'entityid' and 'service' settings,
  1151. # so it is not normally necessary to specify them unless you need to
  1152. # override them.
  1153. #
  1154. #sp_config:
  1155. # # point this to the IdP's metadata. You can use either a local file or
  1156. # # (preferably) a URL.
  1157. # metadata:
  1158. # #local: ["saml2/idp.xml"]
  1159. # remote:
  1160. # - url: https://our_idp/metadata.xml
  1161. #
  1162. # # By default, the user has to go to our login page first. If you'd like
  1163. # # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
  1164. # # 'service.sp' section:
  1165. # #
  1166. # #service:
  1167. # # sp:
  1168. # # allow_unsolicited: true
  1169. #
  1170. # # The examples below are just used to generate our metadata xml, and you
  1171. # # may well not need them, depending on your setup. Alternatively you
  1172. # # may need a whole lot more detail - see the pysaml2 docs!
  1173. #
  1174. # description: ["My awesome SP", "en"]
  1175. # name: ["Test SP", "en"]
  1176. #
  1177. # organization:
  1178. # name: Example com
  1179. # display_name:
  1180. # - ["Example co", "en"]
  1181. # url: "http://example.com"
  1182. #
  1183. # contact_person:
  1184. # - given_name: Bob
  1185. # sur_name: "the Sysadmin"
  1186. # email_address": ["admin@example.com"]
  1187. # contact_type": technical
  1188. # Instead of putting the config inline as above, you can specify a
  1189. # separate pysaml2 configuration file:
  1190. #
  1191. #config_path: "CONFDIR/sp_conf.py"
  1192. # The lifetime of a SAML session. This defines how long a user has to
  1193. # complete the authentication process, if allow_unsolicited is unset.
  1194. # The default is 5 minutes.
  1195. #
  1196. #saml_session_lifetime: 5m
  1197. # An external module can be provided here as a custom solution to
  1198. # mapping attributes returned from a saml provider onto a matrix user.
  1199. #
  1200. user_mapping_provider:
  1201. # The custom module's class. Uncomment to use a custom module.
  1202. #
  1203. #module: mapping_provider.SamlMappingProvider
  1204. # Custom configuration values for the module. Below options are
  1205. # intended for the built-in provider, they should be changed if
  1206. # using a custom module. This section will be passed as a Python
  1207. # dictionary to the module's `parse_config` method.
  1208. #
  1209. config:
  1210. # The SAML attribute (after mapping via the attribute maps) to use
  1211. # to derive the Matrix ID from. 'uid' by default.
  1212. #
  1213. # Note: This used to be configured by the
  1214. # saml2_config.mxid_source_attribute option. If that is still
  1215. # defined, its value will be used instead.
  1216. #
  1217. #mxid_source_attribute: displayName
  1218. # The mapping system to use for mapping the saml attribute onto a
  1219. # matrix ID.
  1220. #
  1221. # Options include:
  1222. # * 'hexencode' (which maps unpermitted characters to '=xx')
  1223. # * 'dotreplace' (which replaces unpermitted characters with
  1224. # '.').
  1225. # The default is 'hexencode'.
  1226. #
  1227. # Note: This used to be configured by the
  1228. # saml2_config.mxid_mapping option. If that is still defined, its
  1229. # value will be used instead.
  1230. #
  1231. #mxid_mapping: dotreplace
  1232. # In previous versions of synapse, the mapping from SAML attribute to
  1233. # MXID was always calculated dynamically rather than stored in a
  1234. # table. For backwards- compatibility, we will look for user_ids
  1235. # matching such a pattern before creating a new account.
  1236. #
  1237. # This setting controls the SAML attribute which will be used for this
  1238. # backwards-compatibility lookup. Typically it should be 'uid', but if
  1239. # the attribute maps are changed, it may be necessary to change it.
  1240. #
  1241. # The default is 'uid'.
  1242. #
  1243. #grandfathered_mxid_source_attribute: upn
  1244. # Directory in which Synapse will try to find the template files below.
  1245. # If not set, default templates from within the Synapse package will be used.
  1246. #
  1247. # DO NOT UNCOMMENT THIS SETTING unless you want to customise the templates.
  1248. # If you *do* uncomment it, you will need to make sure that all the templates
  1249. # below are in the directory.
  1250. #
  1251. # Synapse will look for the following templates in this directory:
  1252. #
  1253. # * HTML page to display to users if something goes wrong during the
  1254. # authentication process: 'saml_error.html'.
  1255. #
  1256. # This template doesn't currently need any variable to render.
  1257. #
  1258. # You can see the default templates at:
  1259. # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
  1260. #
  1261. #template_dir: "res/templates"
  1262. # Enable CAS for registration and login.
  1263. #
  1264. #cas_config:
  1265. # enabled: true
  1266. # server_url: "https://cas-server.com"
  1267. # service_url: "https://homeserver.domain.com:8448"
  1268. # #displayname_attribute: name
  1269. # #required_attributes:
  1270. # # name: value
  1271. # Additional settings to use with single-sign on systems such as SAML2 and CAS.
  1272. #
  1273. sso:
  1274. # A list of client URLs which are whitelisted so that the user does not
  1275. # have to confirm giving access to their account to the URL. Any client
  1276. # whose URL starts with an entry in the following list will not be subject
  1277. # to an additional confirmation step after the SSO login is completed.
  1278. #
  1279. # WARNING: An entry such as "https://my.client" is insecure, because it
  1280. # will also match "https://my.client.evil.site", exposing your users to
  1281. # phishing attacks from evil.site. To avoid this, include a slash after the
  1282. # hostname: "https://my.client/".
  1283. #
  1284. # If public_baseurl is set, then the login fallback page (used by clients
  1285. # that don't natively support the required login flows) is whitelisted in
  1286. # addition to any URLs in this list.
  1287. #
  1288. # By default, this list is empty.
  1289. #
  1290. #client_whitelist:
  1291. # - https://riot.im/develop
  1292. # - https://my.custom.client/
  1293. # Directory in which Synapse will try to find the template files below.
  1294. # If not set, default templates from within the Synapse package will be used.
  1295. #
  1296. # DO NOT UNCOMMENT THIS SETTING unless you want to customise the templates.
  1297. # If you *do* uncomment it, you will need to make sure that all the templates
  1298. # below are in the directory.
  1299. #
  1300. # Synapse will look for the following templates in this directory:
  1301. #
  1302. # * HTML page for a confirmation step before redirecting back to the client
  1303. # with the login token: 'sso_redirect_confirm.html'.
  1304. #
  1305. # When rendering, this template is given three variables:
  1306. # * redirect_url: the URL the user is about to be redirected to. Needs
  1307. # manual escaping (see
  1308. # https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
  1309. #
  1310. # * display_url: the same as `redirect_url`, but with the query
  1311. # parameters stripped. The intention is to have a
  1312. # human-readable URL to show to users, not to use it as
  1313. # the final address to redirect to. Needs manual escaping
  1314. # (see https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
  1315. #
  1316. # * server_name: the homeserver's name.
  1317. #
  1318. # You can see the default templates at:
  1319. # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
  1320. #
  1321. #template_dir: "res/templates"
  1322. # The JWT needs to contain a globally unique "sub" (subject) claim.
  1323. #
  1324. #jwt_config:
  1325. # enabled: true
  1326. # secret: "a secret"
  1327. # algorithm: "HS256"
  1328. password_config:
  1329. # Uncomment to disable password login
  1330. #
  1331. #enabled: false
  1332. # Uncomment to disable authentication against the local password
  1333. # database. This is ignored if `enabled` is false, and is only useful
  1334. # if you have other password_providers.
  1335. #
  1336. #localdb_enabled: false
  1337. # Uncomment and change to a secret random string for extra security.
  1338. # DO NOT CHANGE THIS AFTER INITIAL SETUP!
  1339. #
  1340. #pepper: "EVEN_MORE_SECRET"
  1341. # Define and enforce a password policy. Each parameter is optional.
  1342. # This is an implementation of MSC2000.
  1343. #
  1344. policy:
  1345. # Whether to enforce the password policy.
  1346. # Defaults to 'false'.
  1347. #
  1348. #enabled: true
  1349. # Minimum accepted length for a password.
  1350. # Defaults to 0.
  1351. #
  1352. #minimum_length: 15
  1353. # Whether a password must contain at least one digit.
  1354. # Defaults to 'false'.
  1355. #
  1356. #require_digit: true
  1357. # Whether a password must contain at least one symbol.
  1358. # A symbol is any character that's not a number or a letter.
  1359. # Defaults to 'false'.
  1360. #
  1361. #require_symbol: true
  1362. # Whether a password must contain at least one lowercase letter.
  1363. # Defaults to 'false'.
  1364. #
  1365. #require_lowercase: true
  1366. # Whether a password must contain at least one lowercase letter.
  1367. # Defaults to 'false'.
  1368. #
  1369. #require_uppercase: true
  1370. # Configuration for sending emails from Synapse.
  1371. #
  1372. email:
  1373. # The hostname of the outgoing SMTP server to use. Defaults to 'localhost'.
  1374. #
  1375. #smtp_host: mail.server
  1376. # The port on the mail server for outgoing SMTP. Defaults to 25.
  1377. #
  1378. #smtp_port: 587
  1379. # Username/password for authentication to the SMTP server. By default, no
  1380. # authentication is attempted.
  1381. #
  1382. # smtp_user: "exampleusername"
  1383. # smtp_pass: "examplepassword"
  1384. # Uncomment the following to require TLS transport security for SMTP.
  1385. # By default, Synapse will connect over plain text, and will then switch to
  1386. # TLS via STARTTLS *if the SMTP server supports it*. If this option is set,
  1387. # Synapse will refuse to connect unless the server supports STARTTLS.
  1388. #
  1389. #require_transport_security: true
  1390. # notif_from defines the "From" address to use when sending emails.
  1391. # It must be set if email sending is enabled.
  1392. #
  1393. # The placeholder '%(app)s' will be replaced by the application name,
  1394. # which is normally 'app_name' (below), but may be overridden by the
  1395. # Matrix client application.
  1396. #
  1397. # Note that the placeholder must be written '%(app)s', including the
  1398. # trailing 's'.
  1399. #
  1400. #notif_from: "Your Friendly %(app)s homeserver <noreply@example.com>"
  1401. # app_name defines the default value for '%(app)s' in notif_from. It
  1402. # defaults to 'Matrix'.
  1403. #
  1404. #app_name: my_branded_matrix_server
  1405. # Uncomment the following to enable sending emails for messages that the user
  1406. # has missed. Disabled by default.
  1407. #
  1408. #enable_notifs: true
  1409. # Uncomment the following to disable automatic subscription to email
  1410. # notifications for new users. Enabled by default.
  1411. #
  1412. #notif_for_new_users: false
  1413. # Custom URL for client links within the email notifications. By default
  1414. # links will be based on "https://matrix.to".
  1415. #
  1416. # (This setting used to be called riot_base_url; the old name is still
  1417. # supported for backwards-compatibility but is now deprecated.)
  1418. #
  1419. #client_base_url: "http://localhost/riot"
  1420. # Configure the time that a validation email will expire after sending.
  1421. # Defaults to 1h.
  1422. #
  1423. #validation_token_lifetime: 15m
  1424. # Directory in which Synapse will try to find the template files below.
  1425. # If not set, default templates from within the Synapse package will be used.
  1426. #
  1427. # DO NOT UNCOMMENT THIS SETTING unless you want to customise the templates.
  1428. # If you *do* uncomment it, you will need to make sure that all the templates
  1429. # below are in the directory.
  1430. #
  1431. # Synapse will look for the following templates in this directory:
  1432. #
  1433. # * The contents of email notifications of missed events: 'notif_mail.html' and
  1434. # 'notif_mail.txt'.
  1435. #
  1436. # * The contents of account expiry notice emails: 'notice_expiry.html' and
  1437. # 'notice_expiry.txt'.
  1438. #
  1439. # * The contents of password reset emails sent by the homeserver:
  1440. # 'password_reset.html' and 'password_reset.txt'
  1441. #
  1442. # * HTML pages for success and failure that a user will see when they follow
  1443. # the link in the password reset email: 'password_reset_success.html' and
  1444. # 'password_reset_failure.html'
  1445. #
  1446. # * The contents of address verification emails sent during registration:
  1447. # 'registration.html' and 'registration.txt'
  1448. #
  1449. # * HTML pages for success and failure that a user will see when they follow
  1450. # the link in an address verification email sent during registration:
  1451. # 'registration_success.html' and 'registration_failure.html'
  1452. #
  1453. # * The contents of address verification emails sent when an address is added
  1454. # to a Matrix account: 'add_threepid.html' and 'add_threepid.txt'
  1455. #
  1456. # * HTML pages for success and failure that a user will see when they follow
  1457. # the link in an address verification email sent when an address is added
  1458. # to a Matrix account: 'add_threepid_success.html' and
  1459. # 'add_threepid_failure.html'
  1460. #
  1461. # You can see the default templates at:
  1462. # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
  1463. #
  1464. #template_dir: "res/templates"
  1465. #password_providers:
  1466. # - module: "ldap_auth_provider.LdapAuthProvider"
  1467. # config:
  1468. # enabled: true
  1469. # uri: "ldap://ldap.example.com:389"
  1470. # start_tls: true
  1471. # base: "ou=users,dc=example,dc=com"
  1472. # attributes:
  1473. # uid: "cn"
  1474. # mail: "email"
  1475. # name: "givenName"
  1476. # #bind_dn:
  1477. # #bind_password:
  1478. # #filter: "(objectClass=posixAccount)"
  1479. # Clients requesting push notifications can either have the body of
  1480. # the message sent in the notification poke along with other details
  1481. # like the sender, or just the event ID and room ID (`event_id_only`).
  1482. # If clients choose the former, this option controls whether the
  1483. # notification request includes the content of the event (other details
  1484. # like the sender are still included). For `event_id_only` push, it
  1485. # has no effect.
  1486. #
  1487. # For modern android devices the notification content will still appear
  1488. # because it is loaded by the app. iPhone, however will send a
  1489. # notification saying only that a message arrived and who it came from.
  1490. #
  1491. #push:
  1492. # include_content: true
  1493. #spam_checker:
  1494. # module: "my_custom_project.SuperSpamChecker"
  1495. # config:
  1496. # example_option: 'things'
  1497. # Uncomment to allow non-server-admin users to create groups on this server
  1498. #
  1499. #enable_group_creation: true
  1500. # If enabled, non server admins can only create groups with local parts
  1501. # starting with this prefix
  1502. #
  1503. #group_creation_prefix: "unofficial/"
  1504. # User Directory configuration
  1505. #
  1506. # 'enabled' defines whether users can search the user directory. If
  1507. # false then empty responses are returned to all queries. Defaults to
  1508. # true.
  1509. #
  1510. # 'search_all_users' defines whether to search all users visible to your HS
  1511. # when searching the user directory, rather than limiting to users visible
  1512. # in public rooms. Defaults to false. If you set it True, you'll have to
  1513. # rebuild the user_directory search indexes, see
  1514. # https://github.com/matrix-org/synapse/blob/master/docs/user_directory.md
  1515. #
  1516. #user_directory:
  1517. # enabled: true
  1518. # search_all_users: false
  1519. # User Consent configuration
  1520. #
  1521. # for detailed instructions, see
  1522. # https://github.com/matrix-org/synapse/blob/master/docs/consent_tracking.md
  1523. #
  1524. # Parts of this section are required if enabling the 'consent' resource under
  1525. # 'listeners', in particular 'template_dir' and 'version'.
  1526. #
  1527. # 'template_dir' gives the location of the templates for the HTML forms.
  1528. # This directory should contain one subdirectory per language (eg, 'en', 'fr'),
  1529. # and each language directory should contain the policy document (named as
  1530. # '<version>.html') and a success page (success.html).
  1531. #
  1532. # 'version' specifies the 'current' version of the policy document. It defines
  1533. # the version to be served by the consent resource if there is no 'v'
  1534. # parameter.
  1535. #
  1536. # 'server_notice_content', if enabled, will send a user a "Server Notice"
  1537. # asking them to consent to the privacy policy. The 'server_notices' section
  1538. # must also be configured for this to work. Notices will *not* be sent to
  1539. # guest users unless 'send_server_notice_to_guests' is set to true.
  1540. #
  1541. # 'block_events_error', if set, will block any attempts to send events
  1542. # until the user consents to the privacy policy. The value of the setting is
  1543. # used as the text of the error.
  1544. #
  1545. # 'require_at_registration', if enabled, will add a step to the registration
  1546. # process, similar to how captcha works. Users will be required to accept the
  1547. # policy before their account is created.
  1548. #
  1549. # 'policy_name' is the display name of the policy users will see when registering
  1550. # for an account. Has no effect unless `require_at_registration` is enabled.
  1551. # Defaults to "Privacy Policy".
  1552. #
  1553. #user_consent:
  1554. # template_dir: res/templates/privacy
  1555. # version: 1.0
  1556. # server_notice_content:
  1557. # msgtype: m.text
  1558. # body: >-
  1559. # To continue using this homeserver you must review and agree to the
  1560. # terms and conditions at %(consent_uri)s
  1561. # send_server_notice_to_guests: true
  1562. # block_events_error: >-
  1563. # To continue using this homeserver you must review and agree to the
  1564. # terms and conditions at %(consent_uri)s
  1565. # require_at_registration: false
  1566. # policy_name: Privacy Policy
  1567. #
  1568. # Local statistics collection. Used in populating the room directory.
  1569. #
  1570. # 'bucket_size' controls how large each statistics timeslice is. It can
  1571. # be defined in a human readable short form -- e.g. "1d", "1y".
  1572. #
  1573. # 'retention' controls how long historical statistics will be kept for.
  1574. # It can be defined in a human readable short form -- e.g. "1d", "1y".
  1575. #
  1576. #
  1577. #stats:
  1578. # enabled: true
  1579. # bucket_size: 1d
  1580. # retention: 1y
  1581. # Server Notices room configuration
  1582. #
  1583. # Uncomment this section to enable a room which can be used to send notices
  1584. # from the server to users. It is a special room which cannot be left; notices
  1585. # come from a special "notices" user id.
  1586. #
  1587. # If you uncomment this section, you *must* define the system_mxid_localpart
  1588. # setting, which defines the id of the user which will be used to send the
  1589. # notices.
  1590. #
  1591. # It's also possible to override the room name, the display name of the
  1592. # "notices" user, and the avatar for the user.
  1593. #
  1594. #server_notices:
  1595. # system_mxid_localpart: notices
  1596. # system_mxid_display_name: "Server Notices"
  1597. # system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
  1598. # room_name: "Server Notices"
  1599. # Uncomment to disable searching the public room list. When disabled
  1600. # blocks searching local and remote room lists for local and remote
  1601. # users by always returning an empty list for all queries.
  1602. #
  1603. #enable_room_list_search: false
  1604. # The `alias_creation` option controls who's allowed to create aliases
  1605. # on this server.
  1606. #
  1607. # The format of this option is a list of rules that contain globs that
  1608. # match against user_id, room_id and the new alias (fully qualified with
  1609. # server name). The action in the first rule that matches is taken,
  1610. # which can currently either be "allow" or "deny".
  1611. #
  1612. # Missing user_id/room_id/alias fields default to "*".
  1613. #
  1614. # If no rules match the request is denied. An empty list means no one
  1615. # can create aliases.
  1616. #
  1617. # Options for the rules include:
  1618. #
  1619. # user_id: Matches against the creator of the alias
  1620. # alias: Matches against the alias being created
  1621. # room_id: Matches against the room ID the alias is being pointed at
  1622. # action: Whether to "allow" or "deny" the request if the rule matches
  1623. #
  1624. # The default is:
  1625. #
  1626. #alias_creation_rules:
  1627. # - user_id: "*"
  1628. # alias: "*"
  1629. # room_id: "*"
  1630. # action: allow
  1631. # The `room_list_publication_rules` option controls who can publish and
  1632. # which rooms can be published in the public room list.
  1633. #
  1634. # The format of this option is the same as that for
  1635. # `alias_creation_rules`.
  1636. #
  1637. # If the room has one or more aliases associated with it, only one of
  1638. # the aliases needs to match the alias rule. If there are no aliases
  1639. # then only rules with `alias: *` match.
  1640. #
  1641. # If no rules match the request is denied. An empty list means no one
  1642. # can publish rooms.
  1643. #
  1644. # Options for the rules include:
  1645. #
  1646. # user_id: Matches agaisnt the creator of the alias
  1647. # room_id: Matches against the room ID being published
  1648. # alias: Matches against any current local or canonical aliases
  1649. # associated with the room
  1650. # action: Whether to "allow" or "deny" the request if the rule matches
  1651. #
  1652. # The default is:
  1653. #
  1654. #room_list_publication_rules:
  1655. # - user_id: "*"
  1656. # alias: "*"
  1657. # room_id: "*"
  1658. # action: allow
  1659. # Server admins can define a Python module that implements extra rules for
  1660. # allowing or denying incoming events. In order to work, this module needs to
  1661. # override the methods defined in synapse/events/third_party_rules.py.
  1662. #
  1663. # This feature is designed to be used in closed federations only, where each
  1664. # participating server enforces the same rules.
  1665. #
  1666. #third_party_event_rules:
  1667. # module: "my_custom_project.SuperRulesSet"
  1668. # config:
  1669. # example_option: 'things'
  1670. ## Opentracing ##
  1671. # These settings enable opentracing, which implements distributed tracing.
  1672. # This allows you to observe the causal chains of events across servers
  1673. # including requests, key lookups etc., across any server running
  1674. # synapse or any other other services which supports opentracing
  1675. # (specifically those implemented with Jaeger).
  1676. #
  1677. opentracing:
  1678. # tracing is disabled by default. Uncomment the following line to enable it.
  1679. #
  1680. #enabled: true
  1681. # The list of homeservers we wish to send and receive span contexts and span baggage.
  1682. # See docs/opentracing.rst
  1683. # This is a list of regexes which are matched against the server_name of the
  1684. # homeserver.
  1685. #
  1686. # By defult, it is empty, so no servers are matched.
  1687. #
  1688. #homeserver_whitelist:
  1689. # - ".*"
  1690. # Jaeger can be configured to sample traces at different rates.
  1691. # All configuration options provided by Jaeger can be set here.
  1692. # Jaeger's configuration mostly related to trace sampling which
  1693. # is documented here:
  1694. # https://www.jaegertracing.io/docs/1.13/sampling/.
  1695. #
  1696. #jaeger_config:
  1697. # sampler:
  1698. # type: const
  1699. # param: 1
  1700. # Logging whether spans were started and reported
  1701. #
  1702. # logging:
  1703. # false