sample_config.yaml 48 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487
  1. # The config is maintained as an up-to-date snapshot of the default
  2. # homeserver.yaml configuration generated by Synapse.
  3. #
  4. # It is intended to act as a reference for the default configuration,
  5. # helping admins keep track of new options and other changes, and compare
  6. # their configs with the current default. As such, many of the actual
  7. # config values shown are placeholders.
  8. #
  9. # It is *not* intended to be copied and used as the basis for a real
  10. # homeserver.yaml. Instead, if you are starting from scratch, please generate
  11. # a fresh config using Synapse by following the instructions in INSTALL.md.
  12. ## Server ##
  13. # The domain name of the server, with optional explicit port.
  14. # This is used by remote servers to connect to this server,
  15. # e.g. matrix.org, localhost:8080, etc.
  16. # This is also the last part of your UserID.
  17. #
  18. server_name: "SERVERNAME"
  19. # When running as a daemon, the file to store the pid in
  20. #
  21. pid_file: DATADIR/homeserver.pid
  22. # The path to the web client which will be served at /_matrix/client/
  23. # if 'webclient' is configured under the 'listeners' configuration.
  24. #
  25. #web_client_location: "/path/to/web/root"
  26. # The public-facing base URL that clients use to access this HS
  27. # (not including _matrix/...). This is the same URL a user would
  28. # enter into the 'custom HS URL' field on their client. If you
  29. # use synapse with a reverse proxy, this should be the URL to reach
  30. # synapse via the proxy.
  31. #
  32. #public_baseurl: https://example.com/
  33. # Set the soft limit on the number of file descriptors synapse can use
  34. # Zero is used to indicate synapse should set the soft limit to the
  35. # hard limit.
  36. #
  37. #soft_file_limit: 0
  38. # Set to false to disable presence tracking on this homeserver.
  39. #
  40. #use_presence: false
  41. # Whether to require authentication to retrieve profile data (avatars,
  42. # display names) of other users through the client API. Defaults to
  43. # 'false'. Note that profile data is also available via the federation
  44. # API, so this setting is of limited value if federation is enabled on
  45. # the server.
  46. #
  47. #require_auth_for_profile_requests: true
  48. # If set to 'false', requires authentication to access the server's public rooms
  49. # directory through the client API. Defaults to 'true'.
  50. #
  51. #allow_public_rooms_without_auth: false
  52. # If set to 'false', forbids any other homeserver to fetch the server's public
  53. # rooms directory via federation. Defaults to 'true'.
  54. #
  55. #allow_public_rooms_over_federation: false
  56. # The default room version for newly created rooms.
  57. #
  58. # Known room versions are listed here:
  59. # https://matrix.org/docs/spec/#complete-list-of-room-versions
  60. #
  61. # For example, for room version 1, default_room_version should be set
  62. # to "1".
  63. #
  64. #default_room_version: "4"
  65. # The GC threshold parameters to pass to `gc.set_threshold`, if defined
  66. #
  67. #gc_thresholds: [700, 10, 10]
  68. # Set the limit on the returned events in the timeline in the get
  69. # and sync operations. The default value is -1, means no upper limit.
  70. #
  71. #filter_timeline_limit: 5000
  72. # Whether room invites to users on this server should be blocked
  73. # (except those sent by local server admins). The default is False.
  74. #
  75. #block_non_admin_invites: True
  76. # Room searching
  77. #
  78. # If disabled, new messages will not be indexed for searching and users
  79. # will receive errors when searching for messages. Defaults to enabled.
  80. #
  81. #enable_search: false
  82. # Restrict federation to the following whitelist of domains.
  83. # N.B. we recommend also firewalling your federation listener to limit
  84. # inbound federation traffic as early as possible, rather than relying
  85. # purely on this application-layer restriction. If not specified, the
  86. # default is to whitelist everything.
  87. #
  88. #federation_domain_whitelist:
  89. # - lon.example.com
  90. # - nyc.example.com
  91. # - syd.example.com
  92. # Prevent federation requests from being sent to the following
  93. # blacklist IP address CIDR ranges. If this option is not specified, or
  94. # specified with an empty list, no ip range blacklist will be enforced.
  95. #
  96. # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
  97. # listed here, since they correspond to unroutable addresses.)
  98. #
  99. federation_ip_range_blacklist:
  100. - '127.0.0.0/8'
  101. - '10.0.0.0/8'
  102. - '172.16.0.0/12'
  103. - '192.168.0.0/16'
  104. - '100.64.0.0/10'
  105. - '169.254.0.0/16'
  106. - '::1/128'
  107. - 'fe80::/64'
  108. - 'fc00::/7'
  109. # List of ports that Synapse should listen on, their purpose and their
  110. # configuration.
  111. #
  112. # Options for each listener include:
  113. #
  114. # port: the TCP port to bind to
  115. #
  116. # bind_addresses: a list of local addresses to listen on. The default is
  117. # 'all local interfaces'.
  118. #
  119. # type: the type of listener. Normally 'http', but other valid options are:
  120. # 'manhole' (see docs/manhole.md),
  121. # 'metrics' (see docs/metrics-howto.rst),
  122. # 'replication' (see docs/workers.rst).
  123. #
  124. # tls: set to true to enable TLS for this listener. Will use the TLS
  125. # key/cert specified in tls_private_key_path / tls_certificate_path.
  126. #
  127. # x_forwarded: Only valid for an 'http' listener. Set to true to use the
  128. # X-Forwarded-For header as the client IP. Useful when Synapse is
  129. # behind a reverse-proxy.
  130. #
  131. # resources: Only valid for an 'http' listener. A list of resources to host
  132. # on this port. Options for each resource are:
  133. #
  134. # names: a list of names of HTTP resources. See below for a list of
  135. # valid resource names.
  136. #
  137. # compress: set to true to enable HTTP comression for this resource.
  138. #
  139. # additional_resources: Only valid for an 'http' listener. A map of
  140. # additional endpoints which should be loaded via dynamic modules.
  141. #
  142. # Valid resource names are:
  143. #
  144. # client: the client-server API (/_matrix/client), and the synapse admin
  145. # API (/_synapse/admin). Also implies 'media' and 'static'.
  146. #
  147. # consent: user consent forms (/_matrix/consent). See
  148. # docs/consent_tracking.md.
  149. #
  150. # federation: the server-server API (/_matrix/federation). Also implies
  151. # 'media', 'keys', 'openid'
  152. #
  153. # keys: the key discovery API (/_matrix/keys).
  154. #
  155. # media: the media API (/_matrix/media).
  156. #
  157. # metrics: the metrics interface. See docs/metrics-howto.rst.
  158. #
  159. # openid: OpenID authentication.
  160. #
  161. # replication: the HTTP replication API (/_synapse/replication). See
  162. # docs/workers.rst.
  163. #
  164. # static: static resources under synapse/static (/_matrix/static). (Mostly
  165. # useful for 'fallback authentication'.)
  166. #
  167. # webclient: A web client. Requires web_client_location to be set.
  168. #
  169. listeners:
  170. # TLS-enabled listener: for when matrix traffic is sent directly to synapse.
  171. #
  172. # Disabled by default. To enable it, uncomment the following. (Note that you
  173. # will also need to give Synapse a TLS key and certificate: see the TLS section
  174. # below.)
  175. #
  176. #- port: 8448
  177. # type: http
  178. # tls: true
  179. # resources:
  180. # - names: [client, federation]
  181. # Unsecure HTTP listener: for when matrix traffic passes through a reverse proxy
  182. # that unwraps TLS.
  183. #
  184. # If you plan to use a reverse proxy, please see
  185. # https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.rst.
  186. #
  187. - port: 8008
  188. tls: false
  189. type: http
  190. x_forwarded: true
  191. bind_addresses: ['::1', '127.0.0.1']
  192. resources:
  193. - names: [client, federation]
  194. compress: false
  195. # example additional_resources:
  196. #
  197. #additional_resources:
  198. # "/_matrix/my/custom/endpoint":
  199. # module: my_module.CustomRequestHandler
  200. # config: {}
  201. # Turn on the twisted ssh manhole service on localhost on the given
  202. # port.
  203. #
  204. #- port: 9000
  205. # bind_addresses: ['::1', '127.0.0.1']
  206. # type: manhole
  207. ## Homeserver blocking ##
  208. # How to reach the server admin, used in ResourceLimitError
  209. #
  210. #admin_contact: 'mailto:admin@server.com'
  211. # Global blocking
  212. #
  213. #hs_disabled: False
  214. #hs_disabled_message: 'Human readable reason for why the HS is blocked'
  215. #hs_disabled_limit_type: 'error code(str), to help clients decode reason'
  216. # Monthly Active User Blocking
  217. #
  218. # Used in cases where the admin or server owner wants to limit to the
  219. # number of monthly active users.
  220. #
  221. # 'limit_usage_by_mau' disables/enables monthly active user blocking. When
  222. # anabled and a limit is reached the server returns a 'ResourceLimitError'
  223. # with error type Codes.RESOURCE_LIMIT_EXCEEDED
  224. #
  225. # 'max_mau_value' is the hard limit of monthly active users above which
  226. # the server will start blocking user actions.
  227. #
  228. # 'mau_trial_days' is a means to add a grace period for active users. It
  229. # means that users must be active for this number of days before they
  230. # can be considered active and guards against the case where lots of users
  231. # sign up in a short space of time never to return after their initial
  232. # session.
  233. #
  234. #limit_usage_by_mau: False
  235. #max_mau_value: 50
  236. #mau_trial_days: 2
  237. # If enabled, the metrics for the number of monthly active users will
  238. # be populated, however no one will be limited. If limit_usage_by_mau
  239. # is true, this is implied to be true.
  240. #
  241. #mau_stats_only: False
  242. # Sometimes the server admin will want to ensure certain accounts are
  243. # never blocked by mau checking. These accounts are specified here.
  244. #
  245. #mau_limit_reserved_threepids:
  246. # - medium: 'email'
  247. # address: 'reserved_user@example.com'
  248. # Used by phonehome stats to group together related servers.
  249. #server_context: context
  250. # Resource-constrained Homeserver Settings
  251. #
  252. # If limit_remote_rooms.enabled is True, the room complexity will be
  253. # checked before a user joins a new remote room. If it is above
  254. # limit_remote_rooms.complexity, it will disallow joining or
  255. # instantly leave.
  256. #
  257. # limit_remote_rooms.complexity_error can be set to customise the text
  258. # displayed to the user when a room above the complexity threshold has
  259. # its join cancelled.
  260. #
  261. # Uncomment the below lines to enable:
  262. #limit_remote_rooms:
  263. # enabled: True
  264. # complexity: 1.0
  265. # complexity_error: "This room is too complex."
  266. # Whether to require a user to be in the room to add an alias to it.
  267. # Defaults to 'true'.
  268. #
  269. #require_membership_for_aliases: false
  270. # Whether to allow per-room membership profiles through the send of membership
  271. # events with profile information that differ from the target's global profile.
  272. # Defaults to 'true'.
  273. #
  274. #allow_per_room_profiles: false
  275. ## TLS ##
  276. # PEM-encoded X509 certificate for TLS.
  277. # This certificate, as of Synapse 1.0, will need to be a valid and verifiable
  278. # certificate, signed by a recognised Certificate Authority.
  279. #
  280. # See 'ACME support' below to enable auto-provisioning this certificate via
  281. # Let's Encrypt.
  282. #
  283. # If supplying your own, be sure to use a `.pem` file that includes the
  284. # full certificate chain including any intermediate certificates (for
  285. # instance, if using certbot, use `fullchain.pem` as your certificate,
  286. # not `cert.pem`).
  287. #
  288. #tls_certificate_path: "CONFDIR/SERVERNAME.tls.crt"
  289. # PEM-encoded private key for TLS
  290. #
  291. #tls_private_key_path: "CONFDIR/SERVERNAME.tls.key"
  292. # Whether to verify TLS server certificates for outbound federation requests.
  293. #
  294. # Defaults to `true`. To disable certificate verification, uncomment the
  295. # following line.
  296. #
  297. #federation_verify_certificates: false
  298. # The minimum TLS version that will be used for outbound federation requests.
  299. #
  300. # Defaults to `1`. Configurable to `1`, `1.1`, `1.2`, or `1.3`. Note
  301. # that setting this value higher than `1.2` will prevent federation to most
  302. # of the public Matrix network: only configure it to `1.3` if you have an
  303. # entirely private federation setup and you can ensure TLS 1.3 support.
  304. #
  305. #federation_client_minimum_tls_version: 1.2
  306. # Skip federation certificate verification on the following whitelist
  307. # of domains.
  308. #
  309. # This setting should only be used in very specific cases, such as
  310. # federation over Tor hidden services and similar. For private networks
  311. # of homeservers, you likely want to use a private CA instead.
  312. #
  313. # Only effective if federation_verify_certicates is `true`.
  314. #
  315. #federation_certificate_verification_whitelist:
  316. # - lon.example.com
  317. # - *.domain.com
  318. # - *.onion
  319. # List of custom certificate authorities for federation traffic.
  320. #
  321. # This setting should only normally be used within a private network of
  322. # homeservers.
  323. #
  324. # Note that this list will replace those that are provided by your
  325. # operating environment. Certificates must be in PEM format.
  326. #
  327. #federation_custom_ca_list:
  328. # - myCA1.pem
  329. # - myCA2.pem
  330. # - myCA3.pem
  331. # ACME support: This will configure Synapse to request a valid TLS certificate
  332. # for your configured `server_name` via Let's Encrypt.
  333. #
  334. # Note that provisioning a certificate in this way requires port 80 to be
  335. # routed to Synapse so that it can complete the http-01 ACME challenge.
  336. # By default, if you enable ACME support, Synapse will attempt to listen on
  337. # port 80 for incoming http-01 challenges - however, this will likely fail
  338. # with 'Permission denied' or a similar error.
  339. #
  340. # There are a couple of potential solutions to this:
  341. #
  342. # * If you already have an Apache, Nginx, or similar listening on port 80,
  343. # you can configure Synapse to use an alternate port, and have your web
  344. # server forward the requests. For example, assuming you set 'port: 8009'
  345. # below, on Apache, you would write:
  346. #
  347. # ProxyPass /.well-known/acme-challenge http://localhost:8009/.well-known/acme-challenge
  348. #
  349. # * Alternatively, you can use something like `authbind` to give Synapse
  350. # permission to listen on port 80.
  351. #
  352. acme:
  353. # ACME support is disabled by default. Set this to `true` and uncomment
  354. # tls_certificate_path and tls_private_key_path above to enable it.
  355. #
  356. enabled: False
  357. # Endpoint to use to request certificates. If you only want to test,
  358. # use Let's Encrypt's staging url:
  359. # https://acme-staging.api.letsencrypt.org/directory
  360. #
  361. #url: https://acme-v01.api.letsencrypt.org/directory
  362. # Port number to listen on for the HTTP-01 challenge. Change this if
  363. # you are forwarding connections through Apache/Nginx/etc.
  364. #
  365. port: 80
  366. # Local addresses to listen on for incoming connections.
  367. # Again, you may want to change this if you are forwarding connections
  368. # through Apache/Nginx/etc.
  369. #
  370. bind_addresses: ['::', '0.0.0.0']
  371. # How many days remaining on a certificate before it is renewed.
  372. #
  373. reprovision_threshold: 30
  374. # The domain that the certificate should be for. Normally this
  375. # should be the same as your Matrix domain (i.e., 'server_name'), but,
  376. # by putting a file at 'https://<server_name>/.well-known/matrix/server',
  377. # you can delegate incoming traffic to another server. If you do that,
  378. # you should give the target of the delegation here.
  379. #
  380. # For example: if your 'server_name' is 'example.com', but
  381. # 'https://example.com/.well-known/matrix/server' delegates to
  382. # 'matrix.example.com', you should put 'matrix.example.com' here.
  383. #
  384. # If not set, defaults to your 'server_name'.
  385. #
  386. domain: matrix.example.com
  387. # file to use for the account key. This will be generated if it doesn't
  388. # exist.
  389. #
  390. # If unspecified, we will use CONFDIR/client.key.
  391. #
  392. account_key_file: DATADIR/acme_account.key
  393. # List of allowed TLS fingerprints for this server to publish along
  394. # with the signing keys for this server. Other matrix servers that
  395. # make HTTPS requests to this server will check that the TLS
  396. # certificates returned by this server match one of the fingerprints.
  397. #
  398. # Synapse automatically adds the fingerprint of its own certificate
  399. # to the list. So if federation traffic is handled directly by synapse
  400. # then no modification to the list is required.
  401. #
  402. # If synapse is run behind a load balancer that handles the TLS then it
  403. # will be necessary to add the fingerprints of the certificates used by
  404. # the loadbalancers to this list if they are different to the one
  405. # synapse is using.
  406. #
  407. # Homeservers are permitted to cache the list of TLS fingerprints
  408. # returned in the key responses up to the "valid_until_ts" returned in
  409. # key. It may be necessary to publish the fingerprints of a new
  410. # certificate and wait until the "valid_until_ts" of the previous key
  411. # responses have passed before deploying it.
  412. #
  413. # You can calculate a fingerprint from a given TLS listener via:
  414. # openssl s_client -connect $host:$port < /dev/null 2> /dev/null |
  415. # openssl x509 -outform DER | openssl sha256 -binary | base64 | tr -d '='
  416. # or by checking matrix.org/federationtester/api/report?server_name=$host
  417. #
  418. #tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
  419. ## Database ##
  420. database:
  421. # The database engine name
  422. name: "sqlite3"
  423. # Arguments to pass to the engine
  424. args:
  425. # Path to the database
  426. database: "DATADIR/homeserver.db"
  427. # Number of events to cache in memory.
  428. #
  429. #event_cache_size: 10K
  430. ## Logging ##
  431. # A yaml python logging config file as described by
  432. # https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
  433. #
  434. log_config: "CONFDIR/SERVERNAME.log.config"
  435. ## Ratelimiting ##
  436. # Ratelimiting settings for client actions (registration, login, messaging).
  437. #
  438. # Each ratelimiting configuration is made of two parameters:
  439. # - per_second: number of requests a client can send per second.
  440. # - burst_count: number of requests a client can send before being throttled.
  441. #
  442. # Synapse currently uses the following configurations:
  443. # - one for messages that ratelimits sending based on the account the client
  444. # is using
  445. # - one for registration that ratelimits registration requests based on the
  446. # client's IP address.
  447. # - one for login that ratelimits login requests based on the client's IP
  448. # address.
  449. # - one for login that ratelimits login requests based on the account the
  450. # client is attempting to log into.
  451. # - one for login that ratelimits login requests based on the account the
  452. # client is attempting to log into, based on the amount of failed login
  453. # attempts for this account.
  454. #
  455. # The defaults are as shown below.
  456. #
  457. #rc_message:
  458. # per_second: 0.2
  459. # burst_count: 10
  460. #
  461. #rc_registration:
  462. # per_second: 0.17
  463. # burst_count: 3
  464. #
  465. #rc_login:
  466. # address:
  467. # per_second: 0.17
  468. # burst_count: 3
  469. # account:
  470. # per_second: 0.17
  471. # burst_count: 3
  472. # failed_attempts:
  473. # per_second: 0.17
  474. # burst_count: 3
  475. # Ratelimiting settings for incoming federation
  476. #
  477. # The rc_federation configuration is made up of the following settings:
  478. # - window_size: window size in milliseconds
  479. # - sleep_limit: number of federation requests from a single server in
  480. # a window before the server will delay processing the request.
  481. # - sleep_delay: duration in milliseconds to delay processing events
  482. # from remote servers by if they go over the sleep limit.
  483. # - reject_limit: maximum number of concurrent federation requests
  484. # allowed from a single server
  485. # - concurrent: number of federation requests to concurrently process
  486. # from a single server
  487. #
  488. # The defaults are as shown below.
  489. #
  490. #rc_federation:
  491. # window_size: 1000
  492. # sleep_limit: 10
  493. # sleep_delay: 500
  494. # reject_limit: 50
  495. # concurrent: 3
  496. # Target outgoing federation transaction frequency for sending read-receipts,
  497. # per-room.
  498. #
  499. # If we end up trying to send out more read-receipts, they will get buffered up
  500. # into fewer transactions.
  501. #
  502. #federation_rr_transactions_per_room_per_second: 50
  503. ## Media Store ##
  504. # Enable the media store service in the Synapse master. Uncomment the
  505. # following if you are using a separate media store worker.
  506. #
  507. #enable_media_repo: false
  508. # Directory where uploaded images and attachments are stored.
  509. #
  510. media_store_path: "DATADIR/media_store"
  511. # Media storage providers allow media to be stored in different
  512. # locations.
  513. #
  514. #media_storage_providers:
  515. # - module: file_system
  516. # # Whether to write new local files.
  517. # store_local: false
  518. # # Whether to write new remote media
  519. # store_remote: false
  520. # # Whether to block upload requests waiting for write to this
  521. # # provider to complete
  522. # store_synchronous: false
  523. # config:
  524. # directory: /mnt/some/other/directory
  525. # Directory where in-progress uploads are stored.
  526. #
  527. uploads_path: "DATADIR/uploads"
  528. # The largest allowed upload size in bytes
  529. #
  530. #max_upload_size: 10M
  531. # Maximum number of pixels that will be thumbnailed
  532. #
  533. #max_image_pixels: 32M
  534. # Whether to generate new thumbnails on the fly to precisely match
  535. # the resolution requested by the client. If true then whenever
  536. # a new resolution is requested by the client the server will
  537. # generate a new thumbnail. If false the server will pick a thumbnail
  538. # from a precalculated list.
  539. #
  540. #dynamic_thumbnails: false
  541. # List of thumbnails to precalculate when an image is uploaded.
  542. #
  543. #thumbnail_sizes:
  544. # - width: 32
  545. # height: 32
  546. # method: crop
  547. # - width: 96
  548. # height: 96
  549. # method: crop
  550. # - width: 320
  551. # height: 240
  552. # method: scale
  553. # - width: 640
  554. # height: 480
  555. # method: scale
  556. # - width: 800
  557. # height: 600
  558. # method: scale
  559. # Is the preview URL API enabled?
  560. #
  561. # 'false' by default: uncomment the following to enable it (and specify a
  562. # url_preview_ip_range_blacklist blacklist).
  563. #
  564. #url_preview_enabled: true
  565. # List of IP address CIDR ranges that the URL preview spider is denied
  566. # from accessing. There are no defaults: you must explicitly
  567. # specify a list for URL previewing to work. You should specify any
  568. # internal services in your network that you do not want synapse to try
  569. # to connect to, otherwise anyone in any Matrix room could cause your
  570. # synapse to issue arbitrary GET requests to your internal services,
  571. # causing serious security issues.
  572. #
  573. # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
  574. # listed here, since they correspond to unroutable addresses.)
  575. #
  576. # This must be specified if url_preview_enabled is set. It is recommended that
  577. # you uncomment the following list as a starting point.
  578. #
  579. #url_preview_ip_range_blacklist:
  580. # - '127.0.0.0/8'
  581. # - '10.0.0.0/8'
  582. # - '172.16.0.0/12'
  583. # - '192.168.0.0/16'
  584. # - '100.64.0.0/10'
  585. # - '169.254.0.0/16'
  586. # - '::1/128'
  587. # - 'fe80::/64'
  588. # - 'fc00::/7'
  589. # List of IP address CIDR ranges that the URL preview spider is allowed
  590. # to access even if they are specified in url_preview_ip_range_blacklist.
  591. # This is useful for specifying exceptions to wide-ranging blacklisted
  592. # target IP ranges - e.g. for enabling URL previews for a specific private
  593. # website only visible in your network.
  594. #
  595. #url_preview_ip_range_whitelist:
  596. # - '192.168.1.1'
  597. # Optional list of URL matches that the URL preview spider is
  598. # denied from accessing. You should use url_preview_ip_range_blacklist
  599. # in preference to this, otherwise someone could define a public DNS
  600. # entry that points to a private IP address and circumvent the blacklist.
  601. # This is more useful if you know there is an entire shape of URL that
  602. # you know that will never want synapse to try to spider.
  603. #
  604. # Each list entry is a dictionary of url component attributes as returned
  605. # by urlparse.urlsplit as applied to the absolute form of the URL. See
  606. # https://docs.python.org/2/library/urlparse.html#urlparse.urlsplit
  607. # The values of the dictionary are treated as an filename match pattern
  608. # applied to that component of URLs, unless they start with a ^ in which
  609. # case they are treated as a regular expression match. If all the
  610. # specified component matches for a given list item succeed, the URL is
  611. # blacklisted.
  612. #
  613. #url_preview_url_blacklist:
  614. # # blacklist any URL with a username in its URI
  615. # - username: '*'
  616. #
  617. # # blacklist all *.google.com URLs
  618. # - netloc: 'google.com'
  619. # - netloc: '*.google.com'
  620. #
  621. # # blacklist all plain HTTP URLs
  622. # - scheme: 'http'
  623. #
  624. # # blacklist http(s)://www.acme.com/foo
  625. # - netloc: 'www.acme.com'
  626. # path: '/foo'
  627. #
  628. # # blacklist any URL with a literal IPv4 address
  629. # - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
  630. # The largest allowed URL preview spidering size in bytes
  631. #
  632. #max_spider_size: 10M
  633. ## Captcha ##
  634. # See docs/CAPTCHA_SETUP for full details of configuring this.
  635. # This Home Server's ReCAPTCHA public key.
  636. #
  637. #recaptcha_public_key: "YOUR_PUBLIC_KEY"
  638. # This Home Server's ReCAPTCHA private key.
  639. #
  640. #recaptcha_private_key: "YOUR_PRIVATE_KEY"
  641. # Enables ReCaptcha checks when registering, preventing signup
  642. # unless a captcha is answered. Requires a valid ReCaptcha
  643. # public/private key.
  644. #
  645. #enable_registration_captcha: false
  646. # A secret key used to bypass the captcha test entirely.
  647. #
  648. #captcha_bypass_secret: "YOUR_SECRET_HERE"
  649. # The API endpoint to use for verifying m.login.recaptcha responses.
  650. #
  651. #recaptcha_siteverify_api: "https://www.recaptcha.net/recaptcha/api/siteverify"
  652. ## TURN ##
  653. # The public URIs of the TURN server to give to clients
  654. #
  655. #turn_uris: []
  656. # The shared secret used to compute passwords for the TURN server
  657. #
  658. #turn_shared_secret: "YOUR_SHARED_SECRET"
  659. # The Username and password if the TURN server needs them and
  660. # does not use a token
  661. #
  662. #turn_username: "TURNSERVER_USERNAME"
  663. #turn_password: "TURNSERVER_PASSWORD"
  664. # How long generated TURN credentials last
  665. #
  666. #turn_user_lifetime: 1h
  667. # Whether guests should be allowed to use the TURN server.
  668. # This defaults to True, otherwise VoIP will be unreliable for guests.
  669. # However, it does introduce a slight security risk as it allows users to
  670. # connect to arbitrary endpoints without having first signed up for a
  671. # valid account (e.g. by passing a CAPTCHA).
  672. #
  673. #turn_allow_guests: True
  674. ## Registration ##
  675. #
  676. # Registration can be rate-limited using the parameters in the "Ratelimiting"
  677. # section of this file.
  678. # Enable registration for new users.
  679. #
  680. #enable_registration: false
  681. # Optional account validity configuration. This allows for accounts to be denied
  682. # any request after a given period.
  683. #
  684. # ``enabled`` defines whether the account validity feature is enabled. Defaults
  685. # to False.
  686. #
  687. # ``period`` allows setting the period after which an account is valid
  688. # after its registration. When renewing the account, its validity period
  689. # will be extended by this amount of time. This parameter is required when using
  690. # the account validity feature.
  691. #
  692. # ``renew_at`` is the amount of time before an account's expiry date at which
  693. # Synapse will send an email to the account's email address with a renewal link.
  694. # This needs the ``email`` and ``public_baseurl`` configuration sections to be
  695. # filled.
  696. #
  697. # ``renew_email_subject`` is the subject of the email sent out with the renewal
  698. # link. ``%(app)s`` can be used as a placeholder for the ``app_name`` parameter
  699. # from the ``email`` section.
  700. #
  701. # Once this feature is enabled, Synapse will look for registered users without an
  702. # expiration date at startup and will add one to every account it found using the
  703. # current settings at that time.
  704. # This means that, if a validity period is set, and Synapse is restarted (it will
  705. # then derive an expiration date from the current validity period), and some time
  706. # after that the validity period changes and Synapse is restarted, the users'
  707. # expiration dates won't be updated unless their account is manually renewed. This
  708. # date will be randomly selected within a range [now + period - d ; now + period],
  709. # where d is equal to 10% of the validity period.
  710. #
  711. #account_validity:
  712. # enabled: True
  713. # period: 6w
  714. # renew_at: 1w
  715. # renew_email_subject: "Renew your %(app)s account"
  716. # # Directory in which Synapse will try to find the HTML files to serve to the
  717. # # user when trying to renew an account. Optional, defaults to
  718. # # synapse/res/templates.
  719. # template_dir: "res/templates"
  720. # # HTML to be displayed to the user after they successfully renewed their
  721. # # account. Optional.
  722. # account_renewed_html_path: "account_renewed.html"
  723. # # HTML to be displayed when the user tries to renew an account with an invalid
  724. # # renewal token. Optional.
  725. # invalid_token_html_path: "invalid_token.html"
  726. # Time that a user's session remains valid for, after they log in.
  727. #
  728. # Note that this is not currently compatible with guest logins.
  729. #
  730. # Note also that this is calculated at login time: changes are not applied
  731. # retrospectively to users who have already logged in.
  732. #
  733. # By default, this is infinite.
  734. #
  735. #session_lifetime: 24h
  736. # The user must provide all of the below types of 3PID when registering.
  737. #
  738. #registrations_require_3pid:
  739. # - email
  740. # - msisdn
  741. # Explicitly disable asking for MSISDNs from the registration
  742. # flow (overrides registrations_require_3pid if MSISDNs are set as required)
  743. #
  744. #disable_msisdn_registration: true
  745. # Mandate that users are only allowed to associate certain formats of
  746. # 3PIDs with accounts on this server.
  747. #
  748. #allowed_local_3pids:
  749. # - medium: email
  750. # pattern: '.*@matrix\.org'
  751. # - medium: email
  752. # pattern: '.*@vector\.im'
  753. # - medium: msisdn
  754. # pattern: '\+44'
  755. # Enable 3PIDs lookup requests to identity servers from this server.
  756. #
  757. #enable_3pid_lookup: true
  758. # If set, allows registration of standard or admin accounts by anyone who
  759. # has the shared secret, even if registration is otherwise disabled.
  760. #
  761. # registration_shared_secret: <PRIVATE STRING>
  762. # Set the number of bcrypt rounds used to generate password hash.
  763. # Larger numbers increase the work factor needed to generate the hash.
  764. # The default number is 12 (which equates to 2^12 rounds).
  765. # N.B. that increasing this will exponentially increase the time required
  766. # to register or login - e.g. 24 => 2^24 rounds which will take >20 mins.
  767. #
  768. #bcrypt_rounds: 12
  769. # Allows users to register as guests without a password/email/etc, and
  770. # participate in rooms hosted on this server which have been made
  771. # accessible to anonymous users.
  772. #
  773. #allow_guest_access: false
  774. # The identity server which we suggest that clients should use when users log
  775. # in on this server.
  776. #
  777. # (By default, no suggestion is made, so it is left up to the client.
  778. # This setting is ignored unless public_baseurl is also set.)
  779. #
  780. #default_identity_server: https://matrix.org
  781. # The list of identity servers trusted to verify third party
  782. # identifiers by this server.
  783. #
  784. # Also defines the ID server which will be called when an account is
  785. # deactivated (one will be picked arbitrarily).
  786. #
  787. #trusted_third_party_id_servers:
  788. # - matrix.org
  789. # - vector.im
  790. # Users who register on this homeserver will automatically be joined
  791. # to these rooms
  792. #
  793. #auto_join_rooms:
  794. # - "#example:example.com"
  795. # Where auto_join_rooms are specified, setting this flag ensures that the
  796. # the rooms exist by creating them when the first user on the
  797. # homeserver registers.
  798. # Setting to false means that if the rooms are not manually created,
  799. # users cannot be auto-joined since they do not exist.
  800. #
  801. #autocreate_auto_join_rooms: true
  802. ## Metrics ###
  803. # Enable collection and rendering of performance metrics
  804. #
  805. #enable_metrics: False
  806. # Enable sentry integration
  807. # NOTE: While attempts are made to ensure that the logs don't contain
  808. # any sensitive information, this cannot be guaranteed. By enabling
  809. # this option the sentry server may therefore receive sensitive
  810. # information, and it in turn may then diseminate sensitive information
  811. # through insecure notification channels if so configured.
  812. #
  813. #sentry:
  814. # dsn: "..."
  815. # Whether or not to report anonymized homeserver usage statistics.
  816. # report_stats: true|false
  817. ## API Configuration ##
  818. # A list of event types that will be included in the room_invite_state
  819. #
  820. #room_invite_state_types:
  821. # - "m.room.join_rules"
  822. # - "m.room.canonical_alias"
  823. # - "m.room.avatar"
  824. # - "m.room.encryption"
  825. # - "m.room.name"
  826. # A list of application service config files to use
  827. #
  828. #app_service_config_files:
  829. # - app_service_1.yaml
  830. # - app_service_2.yaml
  831. # Uncomment to enable tracking of application service IP addresses. Implicitly
  832. # enables MAU tracking for application service users.
  833. #
  834. #track_appservice_user_ips: True
  835. # a secret which is used to sign access tokens. If none is specified,
  836. # the registration_shared_secret is used, if one is given; otherwise,
  837. # a secret key is derived from the signing key.
  838. #
  839. # macaroon_secret_key: <PRIVATE STRING>
  840. # a secret which is used to calculate HMACs for form values, to stop
  841. # falsification of values. Must be specified for the User Consent
  842. # forms to work.
  843. #
  844. # form_secret: <PRIVATE STRING>
  845. ## Signing Keys ##
  846. # Path to the signing key to sign messages with
  847. #
  848. signing_key_path: "CONFDIR/SERVERNAME.signing.key"
  849. # The keys that the server used to sign messages with but won't use
  850. # to sign new messages. E.g. it has lost its private key
  851. #
  852. #old_signing_keys:
  853. # "ed25519:auto":
  854. # # Base64 encoded public key
  855. # key: "The public part of your old signing key."
  856. # # Millisecond POSIX timestamp when the key expired.
  857. # expired_ts: 123456789123
  858. # How long key response published by this server is valid for.
  859. # Used to set the valid_until_ts in /key/v2 APIs.
  860. # Determines how quickly servers will query to check which keys
  861. # are still valid.
  862. #
  863. #key_refresh_interval: 1d
  864. # The trusted servers to download signing keys from.
  865. #
  866. # When we need to fetch a signing key, each server is tried in parallel.
  867. #
  868. # Normally, the connection to the key server is validated via TLS certificates.
  869. # Additional security can be provided by configuring a `verify key`, which
  870. # will make synapse check that the response is signed by that key.
  871. #
  872. # This setting supercedes an older setting named `perspectives`. The old format
  873. # is still supported for backwards-compatibility, but it is deprecated.
  874. #
  875. # Options for each entry in the list include:
  876. #
  877. # server_name: the name of the server. required.
  878. #
  879. # verify_keys: an optional map from key id to base64-encoded public key.
  880. # If specified, we will check that the response is signed by at least
  881. # one of the given keys.
  882. #
  883. # accept_keys_insecurely: a boolean. Normally, if `verify_keys` is unset,
  884. # and federation_verify_certificates is not `true`, synapse will refuse
  885. # to start, because this would allow anyone who can spoof DNS responses
  886. # to masquerade as the trusted key server. If you know what you are doing
  887. # and are sure that your network environment provides a secure connection
  888. # to the key server, you can set this to `true` to override this
  889. # behaviour.
  890. #
  891. # An example configuration might look like:
  892. #
  893. #trusted_key_servers:
  894. # - server_name: "my_trusted_server.example.com"
  895. # verify_keys:
  896. # "ed25519:auto": "abcdefghijklmnopqrstuvwxyzabcdefghijklmopqr"
  897. # - server_name: "my_other_trusted_server.example.com"
  898. #
  899. # The default configuration is:
  900. #
  901. #trusted_key_servers:
  902. # - server_name: "matrix.org"
  903. #
  904. # The signing keys to use when acting as a trusted key server. If not specified
  905. # defaults to the server signing key.
  906. #
  907. # Can contain multiple keys, one per line.
  908. #
  909. #key_server_signing_keys_path: "key_server_signing_keys.key"
  910. # Enable SAML2 for registration and login. Uses pysaml2.
  911. #
  912. # `sp_config` is the configuration for the pysaml2 Service Provider.
  913. # See pysaml2 docs for format of config.
  914. #
  915. # Default values will be used for the 'entityid' and 'service' settings,
  916. # so it is not normally necessary to specify them unless you need to
  917. # override them.
  918. #
  919. # Once SAML support is enabled, a metadata file will be exposed at
  920. # https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
  921. # use to configure your SAML IdP with. Alternatively, you can manually configure
  922. # the IdP to use an ACS location of
  923. # https://<server>:<port>/_matrix/saml2/authn_response.
  924. #
  925. #saml2_config:
  926. # sp_config:
  927. # # point this to the IdP's metadata. You can use either a local file or
  928. # # (preferably) a URL.
  929. # metadata:
  930. # #local: ["saml2/idp.xml"]
  931. # remote:
  932. # - url: https://our_idp/metadata.xml
  933. #
  934. # # By default, the user has to go to our login page first. If you'd like to
  935. # # allow IdP-initiated login, set 'allow_unsolicited: True' in a
  936. # # 'service.sp' section:
  937. # #
  938. # #service:
  939. # # sp:
  940. # # allow_unsolicited: True
  941. #
  942. # # The examples below are just used to generate our metadata xml, and you
  943. # # may well not need it, depending on your setup. Alternatively you
  944. # # may need a whole lot more detail - see the pysaml2 docs!
  945. #
  946. # description: ["My awesome SP", "en"]
  947. # name: ["Test SP", "en"]
  948. #
  949. # organization:
  950. # name: Example com
  951. # display_name:
  952. # - ["Example co", "en"]
  953. # url: "http://example.com"
  954. #
  955. # contact_person:
  956. # - given_name: Bob
  957. # sur_name: "the Sysadmin"
  958. # email_address": ["admin@example.com"]
  959. # contact_type": technical
  960. #
  961. # # Instead of putting the config inline as above, you can specify a
  962. # # separate pysaml2 configuration file:
  963. # #
  964. # config_path: "CONFDIR/sp_conf.py"
  965. #
  966. # # the lifetime of a SAML session. This defines how long a user has to
  967. # # complete the authentication process, if allow_unsolicited is unset.
  968. # # The default is 5 minutes.
  969. # #
  970. # # saml_session_lifetime: 5m
  971. # Enable CAS for registration and login.
  972. #
  973. #cas_config:
  974. # enabled: true
  975. # server_url: "https://cas-server.com"
  976. # service_url: "https://homeserver.domain.com:8448"
  977. # #required_attributes:
  978. # # name: value
  979. # The JWT needs to contain a globally unique "sub" (subject) claim.
  980. #
  981. #jwt_config:
  982. # enabled: true
  983. # secret: "a secret"
  984. # algorithm: "HS256"
  985. password_config:
  986. # Uncomment to disable password login
  987. #
  988. #enabled: false
  989. # Uncomment to disable authentication against the local password
  990. # database. This is ignored if `enabled` is false, and is only useful
  991. # if you have other password_providers.
  992. #
  993. #localdb_enabled: false
  994. # Uncomment and change to a secret random string for extra security.
  995. # DO NOT CHANGE THIS AFTER INITIAL SETUP!
  996. #
  997. #pepper: "EVEN_MORE_SECRET"
  998. # Enable sending emails for password resets, notification events or
  999. # account expiry notices
  1000. #
  1001. # If your SMTP server requires authentication, the optional smtp_user &
  1002. # smtp_pass variables should be used
  1003. #
  1004. #email:
  1005. # enable_notifs: false
  1006. # smtp_host: "localhost"
  1007. # smtp_port: 25 # SSL: 465, STARTTLS: 587
  1008. # smtp_user: "exampleusername"
  1009. # smtp_pass: "examplepassword"
  1010. # require_transport_security: False
  1011. # notif_from: "Your Friendly %(app)s Home Server <noreply@example.com>"
  1012. # app_name: Matrix
  1013. #
  1014. # # Enable email notifications by default
  1015. # #
  1016. # notif_for_new_users: True
  1017. #
  1018. # # Defining a custom URL for Riot is only needed if email notifications
  1019. # # should contain links to a self-hosted installation of Riot; when set
  1020. # # the "app_name" setting is ignored
  1021. # #
  1022. # riot_base_url: "http://localhost/riot"
  1023. #
  1024. # # Enable sending password reset emails via the configured, trusted
  1025. # # identity servers
  1026. # #
  1027. # # IMPORTANT! This will give a malicious or overtaken identity server
  1028. # # the ability to reset passwords for your users! Make absolutely sure
  1029. # # that you want to do this! It is strongly recommended that password
  1030. # # reset emails be sent by the homeserver instead
  1031. # #
  1032. # # If this option is set to false and SMTP options have not been
  1033. # # configured, resetting user passwords via email will be disabled
  1034. # #
  1035. # #trust_identity_server_for_password_resets: false
  1036. #
  1037. # # Configure the time that a validation email or text message code
  1038. # # will expire after sending
  1039. # #
  1040. # # This is currently used for password resets
  1041. # #
  1042. # #validation_token_lifetime: 1h
  1043. #
  1044. # # Template directory. All template files should be stored within this
  1045. # # directory. If not set, default templates from within the Synapse
  1046. # # package will be used
  1047. # #
  1048. # # For the list of default templates, please see
  1049. # # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
  1050. # #
  1051. # #template_dir: res/templates
  1052. #
  1053. # # Templates for email notifications
  1054. # #
  1055. # notif_template_html: notif_mail.html
  1056. # notif_template_text: notif_mail.txt
  1057. #
  1058. # # Templates for account expiry notices
  1059. # #
  1060. # expiry_template_html: notice_expiry.html
  1061. # expiry_template_text: notice_expiry.txt
  1062. #
  1063. # # Templates for password reset emails sent by the homeserver
  1064. # #
  1065. # #password_reset_template_html: password_reset.html
  1066. # #password_reset_template_text: password_reset.txt
  1067. #
  1068. # # Templates for password reset success and failure pages that a user
  1069. # # will see after attempting to reset their password
  1070. # #
  1071. # #password_reset_template_success_html: password_reset_success.html
  1072. # #password_reset_template_failure_html: password_reset_failure.html
  1073. #password_providers:
  1074. # - module: "ldap_auth_provider.LdapAuthProvider"
  1075. # config:
  1076. # enabled: true
  1077. # uri: "ldap://ldap.example.com:389"
  1078. # start_tls: true
  1079. # base: "ou=users,dc=example,dc=com"
  1080. # attributes:
  1081. # uid: "cn"
  1082. # mail: "email"
  1083. # name: "givenName"
  1084. # #bind_dn:
  1085. # #bind_password:
  1086. # #filter: "(objectClass=posixAccount)"
  1087. # Clients requesting push notifications can either have the body of
  1088. # the message sent in the notification poke along with other details
  1089. # like the sender, or just the event ID and room ID (`event_id_only`).
  1090. # If clients choose the former, this option controls whether the
  1091. # notification request includes the content of the event (other details
  1092. # like the sender are still included). For `event_id_only` push, it
  1093. # has no effect.
  1094. #
  1095. # For modern android devices the notification content will still appear
  1096. # because it is loaded by the app. iPhone, however will send a
  1097. # notification saying only that a message arrived and who it came from.
  1098. #
  1099. #push:
  1100. # include_content: true
  1101. #spam_checker:
  1102. # module: "my_custom_project.SuperSpamChecker"
  1103. # config:
  1104. # example_option: 'things'
  1105. # Uncomment to allow non-server-admin users to create groups on this server
  1106. #
  1107. #enable_group_creation: true
  1108. # If enabled, non server admins can only create groups with local parts
  1109. # starting with this prefix
  1110. #
  1111. #group_creation_prefix: "unofficial/"
  1112. # User Directory configuration
  1113. #
  1114. # 'enabled' defines whether users can search the user directory. If
  1115. # false then empty responses are returned to all queries. Defaults to
  1116. # true.
  1117. #
  1118. # 'search_all_users' defines whether to search all users visible to your HS
  1119. # when searching the user directory, rather than limiting to users visible
  1120. # in public rooms. Defaults to false. If you set it True, you'll have to
  1121. # rebuild the user_directory search indexes, see
  1122. # https://github.com/matrix-org/synapse/blob/master/docs/user_directory.md
  1123. #
  1124. #user_directory:
  1125. # enabled: true
  1126. # search_all_users: false
  1127. # User Consent configuration
  1128. #
  1129. # for detailed instructions, see
  1130. # https://github.com/matrix-org/synapse/blob/master/docs/consent_tracking.md
  1131. #
  1132. # Parts of this section are required if enabling the 'consent' resource under
  1133. # 'listeners', in particular 'template_dir' and 'version'.
  1134. #
  1135. # 'template_dir' gives the location of the templates for the HTML forms.
  1136. # This directory should contain one subdirectory per language (eg, 'en', 'fr'),
  1137. # and each language directory should contain the policy document (named as
  1138. # '<version>.html') and a success page (success.html).
  1139. #
  1140. # 'version' specifies the 'current' version of the policy document. It defines
  1141. # the version to be served by the consent resource if there is no 'v'
  1142. # parameter.
  1143. #
  1144. # 'server_notice_content', if enabled, will send a user a "Server Notice"
  1145. # asking them to consent to the privacy policy. The 'server_notices' section
  1146. # must also be configured for this to work. Notices will *not* be sent to
  1147. # guest users unless 'send_server_notice_to_guests' is set to true.
  1148. #
  1149. # 'block_events_error', if set, will block any attempts to send events
  1150. # until the user consents to the privacy policy. The value of the setting is
  1151. # used as the text of the error.
  1152. #
  1153. # 'require_at_registration', if enabled, will add a step to the registration
  1154. # process, similar to how captcha works. Users will be required to accept the
  1155. # policy before their account is created.
  1156. #
  1157. # 'policy_name' is the display name of the policy users will see when registering
  1158. # for an account. Has no effect unless `require_at_registration` is enabled.
  1159. # Defaults to "Privacy Policy".
  1160. #
  1161. #user_consent:
  1162. # template_dir: res/templates/privacy
  1163. # version: 1.0
  1164. # server_notice_content:
  1165. # msgtype: m.text
  1166. # body: >-
  1167. # To continue using this homeserver you must review and agree to the
  1168. # terms and conditions at %(consent_uri)s
  1169. # send_server_notice_to_guests: True
  1170. # block_events_error: >-
  1171. # To continue using this homeserver you must review and agree to the
  1172. # terms and conditions at %(consent_uri)s
  1173. # require_at_registration: False
  1174. # policy_name: Privacy Policy
  1175. #
  1176. # Local statistics collection. Used in populating the room directory.
  1177. #
  1178. # 'bucket_size' controls how large each statistics timeslice is. It can
  1179. # be defined in a human readable short form -- e.g. "1d", "1y".
  1180. #
  1181. # 'retention' controls how long historical statistics will be kept for.
  1182. # It can be defined in a human readable short form -- e.g. "1d", "1y".
  1183. #
  1184. #
  1185. #stats:
  1186. # enabled: true
  1187. # bucket_size: 1d
  1188. # retention: 1y
  1189. # Server Notices room configuration
  1190. #
  1191. # Uncomment this section to enable a room which can be used to send notices
  1192. # from the server to users. It is a special room which cannot be left; notices
  1193. # come from a special "notices" user id.
  1194. #
  1195. # If you uncomment this section, you *must* define the system_mxid_localpart
  1196. # setting, which defines the id of the user which will be used to send the
  1197. # notices.
  1198. #
  1199. # It's also possible to override the room name, the display name of the
  1200. # "notices" user, and the avatar for the user.
  1201. #
  1202. #server_notices:
  1203. # system_mxid_localpart: notices
  1204. # system_mxid_display_name: "Server Notices"
  1205. # system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
  1206. # room_name: "Server Notices"
  1207. # Uncomment to disable searching the public room list. When disabled
  1208. # blocks searching local and remote room lists for local and remote
  1209. # users by always returning an empty list for all queries.
  1210. #
  1211. #enable_room_list_search: false
  1212. # The `alias_creation` option controls who's allowed to create aliases
  1213. # on this server.
  1214. #
  1215. # The format of this option is a list of rules that contain globs that
  1216. # match against user_id, room_id and the new alias (fully qualified with
  1217. # server name). The action in the first rule that matches is taken,
  1218. # which can currently either be "allow" or "deny".
  1219. #
  1220. # Missing user_id/room_id/alias fields default to "*".
  1221. #
  1222. # If no rules match the request is denied. An empty list means no one
  1223. # can create aliases.
  1224. #
  1225. # Options for the rules include:
  1226. #
  1227. # user_id: Matches against the creator of the alias
  1228. # alias: Matches against the alias being created
  1229. # room_id: Matches against the room ID the alias is being pointed at
  1230. # action: Whether to "allow" or "deny" the request if the rule matches
  1231. #
  1232. # The default is:
  1233. #
  1234. #alias_creation_rules:
  1235. # - user_id: "*"
  1236. # alias: "*"
  1237. # room_id: "*"
  1238. # action: allow
  1239. # The `room_list_publication_rules` option controls who can publish and
  1240. # which rooms can be published in the public room list.
  1241. #
  1242. # The format of this option is the same as that for
  1243. # `alias_creation_rules`.
  1244. #
  1245. # If the room has one or more aliases associated with it, only one of
  1246. # the aliases needs to match the alias rule. If there are no aliases
  1247. # then only rules with `alias: *` match.
  1248. #
  1249. # If no rules match the request is denied. An empty list means no one
  1250. # can publish rooms.
  1251. #
  1252. # Options for the rules include:
  1253. #
  1254. # user_id: Matches agaisnt the creator of the alias
  1255. # room_id: Matches against the room ID being published
  1256. # alias: Matches against any current local or canonical aliases
  1257. # associated with the room
  1258. # action: Whether to "allow" or "deny" the request if the rule matches
  1259. #
  1260. # The default is:
  1261. #
  1262. #room_list_publication_rules:
  1263. # - user_id: "*"
  1264. # alias: "*"
  1265. # room_id: "*"
  1266. # action: allow
  1267. # Server admins can define a Python module that implements extra rules for
  1268. # allowing or denying incoming events. In order to work, this module needs to
  1269. # override the methods defined in synapse/events/third_party_rules.py.
  1270. #
  1271. # This feature is designed to be used in closed federations only, where each
  1272. # participating server enforces the same rules.
  1273. #
  1274. #third_party_event_rules:
  1275. # module: "my_custom_project.SuperRulesSet"
  1276. # config:
  1277. # example_option: 'things'
  1278. ## Opentracing ##
  1279. # These settings enable opentracing, which implements distributed tracing.
  1280. # This allows you to observe the causal chains of events across servers
  1281. # including requests, key lookups etc., across any server running
  1282. # synapse or any other other services which supports opentracing
  1283. # (specifically those implemented with Jaeger).
  1284. #
  1285. opentracing:
  1286. # tracing is disabled by default. Uncomment the following line to enable it.
  1287. #
  1288. #enabled: true
  1289. # The list of homeservers we wish to send and receive span contexts and span baggage.
  1290. # See docs/opentracing.rst
  1291. # This is a list of regexes which are matched against the server_name of the
  1292. # homeserver.
  1293. #
  1294. # By defult, it is empty, so no servers are matched.
  1295. #
  1296. #homeserver_whitelist:
  1297. # - ".*"
  1298. # Jaeger can be configured to sample traces at different rates.
  1299. # All configuration options provided by Jaeger can be set here.
  1300. # Jaeger's configuration mostly related to trace sampling which
  1301. # is documented here:
  1302. # https://www.jaegertracing.io/docs/1.13/sampling/.
  1303. #
  1304. #jaeger_config:
  1305. # sampler:
  1306. # type: const
  1307. # param: 1
  1308. # Logging whether spans were started and reported
  1309. #
  1310. # logging:
  1311. # false