sample_config.yaml 85 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474
  1. # This file is maintained as an up-to-date snapshot of the default
  2. # homeserver.yaml configuration generated by Synapse.
  3. #
  4. # It is intended to act as a reference for the default configuration,
  5. # helping admins keep track of new options and other changes, and compare
  6. # their configs with the current default. As such, many of the actual
  7. # config values shown are placeholders.
  8. #
  9. # It is *not* intended to be copied and used as the basis for a real
  10. # homeserver.yaml. Instead, if you are starting from scratch, please generate
  11. # a fresh config using Synapse by following the instructions in INSTALL.md.
  12. # Configuration options that take a time period can be set using a number
  13. # followed by a letter. Letters have the following meanings:
  14. # s = second
  15. # m = minute
  16. # h = hour
  17. # d = day
  18. # w = week
  19. # y = year
  20. # For example, setting redaction_retention_period: 5m would remove redacted
  21. # messages from the database after 5 minutes, rather than 5 months.
  22. ################################################################################
  23. # Configuration file for Synapse.
  24. #
  25. # This is a YAML file: see [1] for a quick introduction. Note in particular
  26. # that *indentation is important*: all the elements of a list or dictionary
  27. # should have the same indentation.
  28. #
  29. # [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
  30. ## Server ##
  31. # The domain name of the server, with optional explicit port.
  32. # This is used by remote servers to connect to this server,
  33. # e.g. matrix.org, localhost:8080, etc.
  34. # This is also the last part of your UserID.
  35. #
  36. server_name: "SERVERNAME"
  37. # When running as a daemon, the file to store the pid in
  38. #
  39. pid_file: DATADIR/homeserver.pid
  40. # The absolute URL to the web client which /_matrix/client will redirect
  41. # to if 'webclient' is configured under the 'listeners' configuration.
  42. #
  43. # This option can be also set to the filesystem path to the web client
  44. # which will be served at /_matrix/client/ if 'webclient' is configured
  45. # under the 'listeners' configuration, however this is a security risk:
  46. # https://github.com/matrix-org/synapse#security-note
  47. #
  48. #web_client_location: https://riot.example.com/
  49. # The public-facing base URL that clients use to access this HS
  50. # (not including _matrix/...). This is the same URL a user would
  51. # enter into the 'custom HS URL' field on their client. If you
  52. # use synapse with a reverse proxy, this should be the URL to reach
  53. # synapse via the proxy.
  54. #
  55. #public_baseurl: https://example.com/
  56. # Set the soft limit on the number of file descriptors synapse can use
  57. # Zero is used to indicate synapse should set the soft limit to the
  58. # hard limit.
  59. #
  60. #soft_file_limit: 0
  61. # Set to false to disable presence tracking on this homeserver.
  62. #
  63. #use_presence: false
  64. # Whether to require authentication to retrieve profile data (avatars,
  65. # display names) of other users through the client API. Defaults to
  66. # 'false'. Note that profile data is also available via the federation
  67. # API, so this setting is of limited value if federation is enabled on
  68. # the server.
  69. #
  70. #require_auth_for_profile_requests: true
  71. # Uncomment to require a user to share a room with another user in order
  72. # to retrieve their profile information. Only checked on Client-Server
  73. # requests. Profile requests from other servers should be checked by the
  74. # requesting server. Defaults to 'false'.
  75. #
  76. #limit_profile_requests_to_users_who_share_rooms: true
  77. # If set to 'true', removes the need for authentication to access the server's
  78. # public rooms directory through the client API, meaning that anyone can
  79. # query the room directory. Defaults to 'false'.
  80. #
  81. #allow_public_rooms_without_auth: true
  82. # If set to 'true', allows any other homeserver to fetch the server's public
  83. # rooms directory via federation. Defaults to 'false'.
  84. #
  85. #allow_public_rooms_over_federation: true
  86. # The default room version for newly created rooms.
  87. #
  88. # Known room versions are listed here:
  89. # https://matrix.org/docs/spec/#complete-list-of-room-versions
  90. #
  91. # For example, for room version 1, default_room_version should be set
  92. # to "1".
  93. #
  94. #default_room_version: "5"
  95. # The GC threshold parameters to pass to `gc.set_threshold`, if defined
  96. #
  97. #gc_thresholds: [700, 10, 10]
  98. # Set the limit on the returned events in the timeline in the get
  99. # and sync operations. The default value is 100. -1 means no upper limit.
  100. #
  101. # Uncomment the following to increase the limit to 5000.
  102. #
  103. #filter_timeline_limit: 5000
  104. # Whether room invites to users on this server should be blocked
  105. # (except those sent by local server admins). The default is False.
  106. #
  107. #block_non_admin_invites: true
  108. # Room searching
  109. #
  110. # If disabled, new messages will not be indexed for searching and users
  111. # will receive errors when searching for messages. Defaults to enabled.
  112. #
  113. #enable_search: false
  114. # List of ports that Synapse should listen on, their purpose and their
  115. # configuration.
  116. #
  117. # Options for each listener include:
  118. #
  119. # port: the TCP port to bind to
  120. #
  121. # bind_addresses: a list of local addresses to listen on. The default is
  122. # 'all local interfaces'.
  123. #
  124. # type: the type of listener. Normally 'http', but other valid options are:
  125. # 'manhole' (see docs/manhole.md),
  126. # 'metrics' (see docs/metrics-howto.md),
  127. # 'replication' (see docs/workers.md).
  128. #
  129. # tls: set to true to enable TLS for this listener. Will use the TLS
  130. # key/cert specified in tls_private_key_path / tls_certificate_path.
  131. #
  132. # x_forwarded: Only valid for an 'http' listener. Set to true to use the
  133. # X-Forwarded-For header as the client IP. Useful when Synapse is
  134. # behind a reverse-proxy.
  135. #
  136. # resources: Only valid for an 'http' listener. A list of resources to host
  137. # on this port. Options for each resource are:
  138. #
  139. # names: a list of names of HTTP resources. See below for a list of
  140. # valid resource names.
  141. #
  142. # compress: set to true to enable HTTP compression for this resource.
  143. #
  144. # additional_resources: Only valid for an 'http' listener. A map of
  145. # additional endpoints which should be loaded via dynamic modules.
  146. #
  147. # Valid resource names are:
  148. #
  149. # client: the client-server API (/_matrix/client), and the synapse admin
  150. # API (/_synapse/admin). Also implies 'media' and 'static'.
  151. #
  152. # consent: user consent forms (/_matrix/consent). See
  153. # docs/consent_tracking.md.
  154. #
  155. # federation: the server-server API (/_matrix/federation). Also implies
  156. # 'media', 'keys', 'openid'
  157. #
  158. # keys: the key discovery API (/_matrix/keys).
  159. #
  160. # media: the media API (/_matrix/media).
  161. #
  162. # metrics: the metrics interface. See docs/metrics-howto.md.
  163. #
  164. # openid: OpenID authentication.
  165. #
  166. # replication: the HTTP replication API (/_synapse/replication). See
  167. # docs/workers.md.
  168. #
  169. # static: static resources under synapse/static (/_matrix/static). (Mostly
  170. # useful for 'fallback authentication'.)
  171. #
  172. # webclient: A web client. Requires web_client_location to be set.
  173. #
  174. listeners:
  175. # TLS-enabled listener: for when matrix traffic is sent directly to synapse.
  176. #
  177. # Disabled by default. To enable it, uncomment the following. (Note that you
  178. # will also need to give Synapse a TLS key and certificate: see the TLS section
  179. # below.)
  180. #
  181. #- port: 8448
  182. # type: http
  183. # tls: true
  184. # resources:
  185. # - names: [client, federation]
  186. # Unsecure HTTP listener: for when matrix traffic passes through a reverse proxy
  187. # that unwraps TLS.
  188. #
  189. # If you plan to use a reverse proxy, please see
  190. # https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md.
  191. #
  192. - port: 8008
  193. tls: false
  194. type: http
  195. x_forwarded: true
  196. bind_addresses: ['::1', '127.0.0.1']
  197. resources:
  198. - names: [client, federation]
  199. compress: false
  200. # example additional_resources:
  201. #
  202. #additional_resources:
  203. # "/_matrix/my/custom/endpoint":
  204. # module: my_module.CustomRequestHandler
  205. # config: {}
  206. # Turn on the twisted ssh manhole service on localhost on the given
  207. # port.
  208. #
  209. #- port: 9000
  210. # bind_addresses: ['::1', '127.0.0.1']
  211. # type: manhole
  212. # Forward extremities can build up in a room due to networking delays between
  213. # homeservers. Once this happens in a large room, calculation of the state of
  214. # that room can become quite expensive. To mitigate this, once the number of
  215. # forward extremities reaches a given threshold, Synapse will send an
  216. # org.matrix.dummy_event event, which will reduce the forward extremities
  217. # in the room.
  218. #
  219. # This setting defines the threshold (i.e. number of forward extremities in the
  220. # room) at which dummy events are sent. The default value is 10.
  221. #
  222. #dummy_events_threshold: 5
  223. ## Homeserver blocking ##
  224. # How to reach the server admin, used in ResourceLimitError
  225. #
  226. #admin_contact: 'mailto:admin@server.com'
  227. # Global blocking
  228. #
  229. #hs_disabled: false
  230. #hs_disabled_message: 'Human readable reason for why the HS is blocked'
  231. # Monthly Active User Blocking
  232. #
  233. # Used in cases where the admin or server owner wants to limit to the
  234. # number of monthly active users.
  235. #
  236. # 'limit_usage_by_mau' disables/enables monthly active user blocking. When
  237. # enabled and a limit is reached the server returns a 'ResourceLimitError'
  238. # with error type Codes.RESOURCE_LIMIT_EXCEEDED
  239. #
  240. # 'max_mau_value' is the hard limit of monthly active users above which
  241. # the server will start blocking user actions.
  242. #
  243. # 'mau_trial_days' is a means to add a grace period for active users. It
  244. # means that users must be active for this number of days before they
  245. # can be considered active and guards against the case where lots of users
  246. # sign up in a short space of time never to return after their initial
  247. # session.
  248. #
  249. # 'mau_limit_alerting' is a means of limiting client side alerting
  250. # should the mau limit be reached. This is useful for small instances
  251. # where the admin has 5 mau seats (say) for 5 specific people and no
  252. # interest increasing the mau limit further. Defaults to True, which
  253. # means that alerting is enabled
  254. #
  255. #limit_usage_by_mau: false
  256. #max_mau_value: 50
  257. #mau_trial_days: 2
  258. #mau_limit_alerting: false
  259. # If enabled, the metrics for the number of monthly active users will
  260. # be populated, however no one will be limited. If limit_usage_by_mau
  261. # is true, this is implied to be true.
  262. #
  263. #mau_stats_only: false
  264. # Sometimes the server admin will want to ensure certain accounts are
  265. # never blocked by mau checking. These accounts are specified here.
  266. #
  267. #mau_limit_reserved_threepids:
  268. # - medium: 'email'
  269. # address: 'reserved_user@example.com'
  270. # Used by phonehome stats to group together related servers.
  271. #server_context: context
  272. # Resource-constrained homeserver settings
  273. #
  274. # When this is enabled, the room "complexity" will be checked before a user
  275. # joins a new remote room. If it is above the complexity limit, the server will
  276. # disallow joining, or will instantly leave.
  277. #
  278. # Room complexity is an arbitrary measure based on factors such as the number of
  279. # users in the room.
  280. #
  281. limit_remote_rooms:
  282. # Uncomment to enable room complexity checking.
  283. #
  284. #enabled: true
  285. # the limit above which rooms cannot be joined. The default is 1.0.
  286. #
  287. #complexity: 0.5
  288. # override the error which is returned when the room is too complex.
  289. #
  290. #complexity_error: "This room is too complex."
  291. # allow server admins to join complex rooms. Default is false.
  292. #
  293. #admins_can_join: true
  294. # Whether to require a user to be in the room to add an alias to it.
  295. # Defaults to 'true'.
  296. #
  297. #require_membership_for_aliases: false
  298. # Whether to allow per-room membership profiles through the send of membership
  299. # events with profile information that differ from the target's global profile.
  300. # Defaults to 'true'.
  301. #
  302. #allow_per_room_profiles: false
  303. # How long to keep redacted events in unredacted form in the database. After
  304. # this period redacted events get replaced with their redacted form in the DB.
  305. #
  306. # Defaults to `7d`. Set to `null` to disable.
  307. #
  308. #redaction_retention_period: 28d
  309. # How long to track users' last seen time and IPs in the database.
  310. #
  311. # Defaults to `28d`. Set to `null` to disable clearing out of old rows.
  312. #
  313. #user_ips_max_age: 14d
  314. # Message retention policy at the server level.
  315. #
  316. # Room admins and mods can define a retention period for their rooms using the
  317. # 'm.room.retention' state event, and server admins can cap this period by setting
  318. # the 'allowed_lifetime_min' and 'allowed_lifetime_max' config options.
  319. #
  320. # If this feature is enabled, Synapse will regularly look for and purge events
  321. # which are older than the room's maximum retention period. Synapse will also
  322. # filter events received over federation so that events that should have been
  323. # purged are ignored and not stored again.
  324. #
  325. retention:
  326. # The message retention policies feature is disabled by default. Uncomment the
  327. # following line to enable it.
  328. #
  329. #enabled: true
  330. # Default retention policy. If set, Synapse will apply it to rooms that lack the
  331. # 'm.room.retention' state event. Currently, the value of 'min_lifetime' doesn't
  332. # matter much because Synapse doesn't take it into account yet.
  333. #
  334. #default_policy:
  335. # min_lifetime: 1d
  336. # max_lifetime: 1y
  337. # Retention policy limits. If set, a user won't be able to send a
  338. # 'm.room.retention' event which features a 'min_lifetime' or a 'max_lifetime'
  339. # that's not within this range. This is especially useful in closed federations,
  340. # in which server admins can make sure every federating server applies the same
  341. # rules.
  342. #
  343. #allowed_lifetime_min: 1d
  344. #allowed_lifetime_max: 1y
  345. # Server admins can define the settings of the background jobs purging the
  346. # events which lifetime has expired under the 'purge_jobs' section.
  347. #
  348. # If no configuration is provided, a single job will be set up to delete expired
  349. # events in every room daily.
  350. #
  351. # Each job's configuration defines which range of message lifetimes the job
  352. # takes care of. For example, if 'shortest_max_lifetime' is '2d' and
  353. # 'longest_max_lifetime' is '3d', the job will handle purging expired events in
  354. # rooms whose state defines a 'max_lifetime' that's both higher than 2 days, and
  355. # lower than or equal to 3 days. Both the minimum and the maximum value of a
  356. # range are optional, e.g. a job with no 'shortest_max_lifetime' and a
  357. # 'longest_max_lifetime' of '3d' will handle every room with a retention policy
  358. # which 'max_lifetime' is lower than or equal to three days.
  359. #
  360. # The rationale for this per-job configuration is that some rooms might have a
  361. # retention policy with a low 'max_lifetime', where history needs to be purged
  362. # of outdated messages on a more frequent basis than for the rest of the rooms
  363. # (e.g. every 12h), but not want that purge to be performed by a job that's
  364. # iterating over every room it knows, which could be heavy on the server.
  365. #
  366. #purge_jobs:
  367. # - shortest_max_lifetime: 1d
  368. # longest_max_lifetime: 3d
  369. # interval: 12h
  370. # - shortest_max_lifetime: 3d
  371. # longest_max_lifetime: 1y
  372. # interval: 1d
  373. # Inhibits the /requestToken endpoints from returning an error that might leak
  374. # information about whether an e-mail address is in use or not on this
  375. # homeserver.
  376. # Note that for some endpoints the error situation is the e-mail already being
  377. # used, and for others the error is entering the e-mail being unused.
  378. # If this option is enabled, instead of returning an error, these endpoints will
  379. # act as if no error happened and return a fake session ID ('sid') to clients.
  380. #
  381. #request_token_inhibit_3pid_errors: true
  382. ## TLS ##
  383. # PEM-encoded X509 certificate for TLS.
  384. # This certificate, as of Synapse 1.0, will need to be a valid and verifiable
  385. # certificate, signed by a recognised Certificate Authority.
  386. #
  387. # See 'ACME support' below to enable auto-provisioning this certificate via
  388. # Let's Encrypt.
  389. #
  390. # If supplying your own, be sure to use a `.pem` file that includes the
  391. # full certificate chain including any intermediate certificates (for
  392. # instance, if using certbot, use `fullchain.pem` as your certificate,
  393. # not `cert.pem`).
  394. #
  395. #tls_certificate_path: "CONFDIR/SERVERNAME.tls.crt"
  396. # PEM-encoded private key for TLS
  397. #
  398. #tls_private_key_path: "CONFDIR/SERVERNAME.tls.key"
  399. # Whether to verify TLS server certificates for outbound federation requests.
  400. #
  401. # Defaults to `true`. To disable certificate verification, uncomment the
  402. # following line.
  403. #
  404. #federation_verify_certificates: false
  405. # The minimum TLS version that will be used for outbound federation requests.
  406. #
  407. # Defaults to `1`. Configurable to `1`, `1.1`, `1.2`, or `1.3`. Note
  408. # that setting this value higher than `1.2` will prevent federation to most
  409. # of the public Matrix network: only configure it to `1.3` if you have an
  410. # entirely private federation setup and you can ensure TLS 1.3 support.
  411. #
  412. #federation_client_minimum_tls_version: 1.2
  413. # Skip federation certificate verification on the following whitelist
  414. # of domains.
  415. #
  416. # This setting should only be used in very specific cases, such as
  417. # federation over Tor hidden services and similar. For private networks
  418. # of homeservers, you likely want to use a private CA instead.
  419. #
  420. # Only effective if federation_verify_certicates is `true`.
  421. #
  422. #federation_certificate_verification_whitelist:
  423. # - lon.example.com
  424. # - *.domain.com
  425. # - *.onion
  426. # List of custom certificate authorities for federation traffic.
  427. #
  428. # This setting should only normally be used within a private network of
  429. # homeservers.
  430. #
  431. # Note that this list will replace those that are provided by your
  432. # operating environment. Certificates must be in PEM format.
  433. #
  434. #federation_custom_ca_list:
  435. # - myCA1.pem
  436. # - myCA2.pem
  437. # - myCA3.pem
  438. # ACME support: This will configure Synapse to request a valid TLS certificate
  439. # for your configured `server_name` via Let's Encrypt.
  440. #
  441. # Note that ACME v1 is now deprecated, and Synapse currently doesn't support
  442. # ACME v2. This means that this feature currently won't work with installs set
  443. # up after November 2019. For more info, and alternative solutions, see
  444. # https://github.com/matrix-org/synapse/blob/master/docs/ACME.md#deprecation-of-acme-v1
  445. #
  446. # Note that provisioning a certificate in this way requires port 80 to be
  447. # routed to Synapse so that it can complete the http-01 ACME challenge.
  448. # By default, if you enable ACME support, Synapse will attempt to listen on
  449. # port 80 for incoming http-01 challenges - however, this will likely fail
  450. # with 'Permission denied' or a similar error.
  451. #
  452. # There are a couple of potential solutions to this:
  453. #
  454. # * If you already have an Apache, Nginx, or similar listening on port 80,
  455. # you can configure Synapse to use an alternate port, and have your web
  456. # server forward the requests. For example, assuming you set 'port: 8009'
  457. # below, on Apache, you would write:
  458. #
  459. # ProxyPass /.well-known/acme-challenge http://localhost:8009/.well-known/acme-challenge
  460. #
  461. # * Alternatively, you can use something like `authbind` to give Synapse
  462. # permission to listen on port 80.
  463. #
  464. acme:
  465. # ACME support is disabled by default. Set this to `true` and uncomment
  466. # tls_certificate_path and tls_private_key_path above to enable it.
  467. #
  468. enabled: false
  469. # Endpoint to use to request certificates. If you only want to test,
  470. # use Let's Encrypt's staging url:
  471. # https://acme-staging.api.letsencrypt.org/directory
  472. #
  473. #url: https://acme-v01.api.letsencrypt.org/directory
  474. # Port number to listen on for the HTTP-01 challenge. Change this if
  475. # you are forwarding connections through Apache/Nginx/etc.
  476. #
  477. port: 80
  478. # Local addresses to listen on for incoming connections.
  479. # Again, you may want to change this if you are forwarding connections
  480. # through Apache/Nginx/etc.
  481. #
  482. bind_addresses: ['::', '0.0.0.0']
  483. # How many days remaining on a certificate before it is renewed.
  484. #
  485. reprovision_threshold: 30
  486. # The domain that the certificate should be for. Normally this
  487. # should be the same as your Matrix domain (i.e., 'server_name'), but,
  488. # by putting a file at 'https://<server_name>/.well-known/matrix/server',
  489. # you can delegate incoming traffic to another server. If you do that,
  490. # you should give the target of the delegation here.
  491. #
  492. # For example: if your 'server_name' is 'example.com', but
  493. # 'https://example.com/.well-known/matrix/server' delegates to
  494. # 'matrix.example.com', you should put 'matrix.example.com' here.
  495. #
  496. # If not set, defaults to your 'server_name'.
  497. #
  498. domain: matrix.example.com
  499. # file to use for the account key. This will be generated if it doesn't
  500. # exist.
  501. #
  502. # If unspecified, we will use CONFDIR/client.key.
  503. #
  504. account_key_file: DATADIR/acme_account.key
  505. # List of allowed TLS fingerprints for this server to publish along
  506. # with the signing keys for this server. Other matrix servers that
  507. # make HTTPS requests to this server will check that the TLS
  508. # certificates returned by this server match one of the fingerprints.
  509. #
  510. # Synapse automatically adds the fingerprint of its own certificate
  511. # to the list. So if federation traffic is handled directly by synapse
  512. # then no modification to the list is required.
  513. #
  514. # If synapse is run behind a load balancer that handles the TLS then it
  515. # will be necessary to add the fingerprints of the certificates used by
  516. # the loadbalancers to this list if they are different to the one
  517. # synapse is using.
  518. #
  519. # Homeservers are permitted to cache the list of TLS fingerprints
  520. # returned in the key responses up to the "valid_until_ts" returned in
  521. # key. It may be necessary to publish the fingerprints of a new
  522. # certificate and wait until the "valid_until_ts" of the previous key
  523. # responses have passed before deploying it.
  524. #
  525. # You can calculate a fingerprint from a given TLS listener via:
  526. # openssl s_client -connect $host:$port < /dev/null 2> /dev/null |
  527. # openssl x509 -outform DER | openssl sha256 -binary | base64 | tr -d '='
  528. # or by checking matrix.org/federationtester/api/report?server_name=$host
  529. #
  530. #tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
  531. # Restrict federation to the following whitelist of domains.
  532. # N.B. we recommend also firewalling your federation listener to limit
  533. # inbound federation traffic as early as possible, rather than relying
  534. # purely on this application-layer restriction. If not specified, the
  535. # default is to whitelist everything.
  536. #
  537. #federation_domain_whitelist:
  538. # - lon.example.com
  539. # - nyc.example.com
  540. # - syd.example.com
  541. # Prevent federation requests from being sent to the following
  542. # blacklist IP address CIDR ranges. If this option is not specified, or
  543. # specified with an empty list, no ip range blacklist will be enforced.
  544. #
  545. # As of Synapse v1.4.0 this option also affects any outbound requests to identity
  546. # servers provided by user input.
  547. #
  548. # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
  549. # listed here, since they correspond to unroutable addresses.)
  550. #
  551. federation_ip_range_blacklist:
  552. - '127.0.0.0/8'
  553. - '10.0.0.0/8'
  554. - '172.16.0.0/12'
  555. - '192.168.0.0/16'
  556. - '100.64.0.0/10'
  557. - '169.254.0.0/16'
  558. - '::1/128'
  559. - 'fe80::/64'
  560. - 'fc00::/7'
  561. ## Caching ##
  562. # Caching can be configured through the following options.
  563. #
  564. # A cache 'factor' is a multiplier that can be applied to each of
  565. # Synapse's caches in order to increase or decrease the maximum
  566. # number of entries that can be stored.
  567. # The number of events to cache in memory. Not affected by
  568. # caches.global_factor.
  569. #
  570. #event_cache_size: 10K
  571. caches:
  572. # Controls the global cache factor, which is the default cache factor
  573. # for all caches if a specific factor for that cache is not otherwise
  574. # set.
  575. #
  576. # This can also be set by the "SYNAPSE_CACHE_FACTOR" environment
  577. # variable. Setting by environment variable takes priority over
  578. # setting through the config file.
  579. #
  580. # Defaults to 0.5, which will half the size of all caches.
  581. #
  582. #global_factor: 1.0
  583. # A dictionary of cache name to cache factor for that individual
  584. # cache. Overrides the global cache factor for a given cache.
  585. #
  586. # These can also be set through environment variables comprised
  587. # of "SYNAPSE_CACHE_FACTOR_" + the name of the cache in capital
  588. # letters and underscores. Setting by environment variable
  589. # takes priority over setting through the config file.
  590. # Ex. SYNAPSE_CACHE_FACTOR_GET_USERS_WHO_SHARE_ROOM_WITH_USER=2.0
  591. #
  592. # Some caches have '*' and other characters that are not
  593. # alphanumeric or underscores. These caches can be named with or
  594. # without the special characters stripped. For example, to specify
  595. # the cache factor for `*stateGroupCache*` via an environment
  596. # variable would be `SYNAPSE_CACHE_FACTOR_STATEGROUPCACHE=2.0`.
  597. #
  598. per_cache_factors:
  599. #get_users_who_share_room_with_user: 2.0
  600. ## Database ##
  601. # The 'database' setting defines the database that synapse uses to store all of
  602. # its data.
  603. #
  604. # 'name' gives the database engine to use: either 'sqlite3' (for SQLite) or
  605. # 'psycopg2' (for PostgreSQL).
  606. #
  607. # 'args' gives options which are passed through to the database engine,
  608. # except for options starting 'cp_', which are used to configure the Twisted
  609. # connection pool. For a reference to valid arguments, see:
  610. # * for sqlite: https://docs.python.org/3/library/sqlite3.html#sqlite3.connect
  611. # * for postgres: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
  612. # * for the connection pool: https://twistedmatrix.com/documents/current/api/twisted.enterprise.adbapi.ConnectionPool.html#__init__
  613. #
  614. #
  615. # Example SQLite configuration:
  616. #
  617. #database:
  618. # name: sqlite3
  619. # args:
  620. # database: /path/to/homeserver.db
  621. #
  622. #
  623. # Example Postgres configuration:
  624. #
  625. #database:
  626. # name: psycopg2
  627. # args:
  628. # user: synapse_user
  629. # password: secretpassword
  630. # database: synapse
  631. # host: localhost
  632. # cp_min: 5
  633. # cp_max: 10
  634. #
  635. # For more information on using Synapse with Postgres, see `docs/postgres.md`.
  636. #
  637. database:
  638. name: sqlite3
  639. args:
  640. database: DATADIR/homeserver.db
  641. ## Logging ##
  642. # A yaml python logging config file as described by
  643. # https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
  644. #
  645. log_config: "CONFDIR/SERVERNAME.log.config"
  646. ## Ratelimiting ##
  647. # Ratelimiting settings for client actions (registration, login, messaging).
  648. #
  649. # Each ratelimiting configuration is made of two parameters:
  650. # - per_second: number of requests a client can send per second.
  651. # - burst_count: number of requests a client can send before being throttled.
  652. #
  653. # Synapse currently uses the following configurations:
  654. # - one for messages that ratelimits sending based on the account the client
  655. # is using
  656. # - one for registration that ratelimits registration requests based on the
  657. # client's IP address.
  658. # - one for login that ratelimits login requests based on the client's IP
  659. # address.
  660. # - one for login that ratelimits login requests based on the account the
  661. # client is attempting to log into.
  662. # - one for login that ratelimits login requests based on the account the
  663. # client is attempting to log into, based on the amount of failed login
  664. # attempts for this account.
  665. # - one for ratelimiting redactions by room admins. If this is not explicitly
  666. # set then it uses the same ratelimiting as per rc_message. This is useful
  667. # to allow room admins to deal with abuse quickly.
  668. # - two for ratelimiting number of rooms a user can join, "local" for when
  669. # users are joining rooms the server is already in (this is cheap) vs
  670. # "remote" for when users are trying to join rooms not on the server (which
  671. # can be more expensive)
  672. #
  673. # The defaults are as shown below.
  674. #
  675. #rc_message:
  676. # per_second: 0.2
  677. # burst_count: 10
  678. #
  679. #rc_registration:
  680. # per_second: 0.17
  681. # burst_count: 3
  682. #
  683. #rc_login:
  684. # address:
  685. # per_second: 0.17
  686. # burst_count: 3
  687. # account:
  688. # per_second: 0.17
  689. # burst_count: 3
  690. # failed_attempts:
  691. # per_second: 0.17
  692. # burst_count: 3
  693. #
  694. #rc_admin_redaction:
  695. # per_second: 1
  696. # burst_count: 50
  697. #
  698. #rc_joins:
  699. # local:
  700. # per_second: 0.1
  701. # burst_count: 3
  702. # remote:
  703. # per_second: 0.01
  704. # burst_count: 3
  705. # Ratelimiting settings for incoming federation
  706. #
  707. # The rc_federation configuration is made up of the following settings:
  708. # - window_size: window size in milliseconds
  709. # - sleep_limit: number of federation requests from a single server in
  710. # a window before the server will delay processing the request.
  711. # - sleep_delay: duration in milliseconds to delay processing events
  712. # from remote servers by if they go over the sleep limit.
  713. # - reject_limit: maximum number of concurrent federation requests
  714. # allowed from a single server
  715. # - concurrent: number of federation requests to concurrently process
  716. # from a single server
  717. #
  718. # The defaults are as shown below.
  719. #
  720. #rc_federation:
  721. # window_size: 1000
  722. # sleep_limit: 10
  723. # sleep_delay: 500
  724. # reject_limit: 50
  725. # concurrent: 3
  726. # Target outgoing federation transaction frequency for sending read-receipts,
  727. # per-room.
  728. #
  729. # If we end up trying to send out more read-receipts, they will get buffered up
  730. # into fewer transactions.
  731. #
  732. #federation_rr_transactions_per_room_per_second: 50
  733. ## Media Store ##
  734. # Enable the media store service in the Synapse master. Uncomment the
  735. # following if you are using a separate media store worker.
  736. #
  737. #enable_media_repo: false
  738. # Directory where uploaded images and attachments are stored.
  739. #
  740. media_store_path: "DATADIR/media_store"
  741. # Media storage providers allow media to be stored in different
  742. # locations.
  743. #
  744. #media_storage_providers:
  745. # - module: file_system
  746. # # Whether to store newly uploaded local files
  747. # store_local: false
  748. # # Whether to store newly downloaded remote files
  749. # store_remote: false
  750. # # Whether to wait for successful storage for local uploads
  751. # store_synchronous: false
  752. # config:
  753. # directory: /mnt/some/other/directory
  754. # The largest allowed upload size in bytes
  755. #
  756. #max_upload_size: 10M
  757. # Maximum number of pixels that will be thumbnailed
  758. #
  759. #max_image_pixels: 32M
  760. # Whether to generate new thumbnails on the fly to precisely match
  761. # the resolution requested by the client. If true then whenever
  762. # a new resolution is requested by the client the server will
  763. # generate a new thumbnail. If false the server will pick a thumbnail
  764. # from a precalculated list.
  765. #
  766. #dynamic_thumbnails: false
  767. # List of thumbnails to precalculate when an image is uploaded.
  768. #
  769. #thumbnail_sizes:
  770. # - width: 32
  771. # height: 32
  772. # method: crop
  773. # - width: 96
  774. # height: 96
  775. # method: crop
  776. # - width: 320
  777. # height: 240
  778. # method: scale
  779. # - width: 640
  780. # height: 480
  781. # method: scale
  782. # - width: 800
  783. # height: 600
  784. # method: scale
  785. # Is the preview URL API enabled?
  786. #
  787. # 'false' by default: uncomment the following to enable it (and specify a
  788. # url_preview_ip_range_blacklist blacklist).
  789. #
  790. #url_preview_enabled: true
  791. # List of IP address CIDR ranges that the URL preview spider is denied
  792. # from accessing. There are no defaults: you must explicitly
  793. # specify a list for URL previewing to work. You should specify any
  794. # internal services in your network that you do not want synapse to try
  795. # to connect to, otherwise anyone in any Matrix room could cause your
  796. # synapse to issue arbitrary GET requests to your internal services,
  797. # causing serious security issues.
  798. #
  799. # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
  800. # listed here, since they correspond to unroutable addresses.)
  801. #
  802. # This must be specified if url_preview_enabled is set. It is recommended that
  803. # you uncomment the following list as a starting point.
  804. #
  805. #url_preview_ip_range_blacklist:
  806. # - '127.0.0.0/8'
  807. # - '10.0.0.0/8'
  808. # - '172.16.0.0/12'
  809. # - '192.168.0.0/16'
  810. # - '100.64.0.0/10'
  811. # - '169.254.0.0/16'
  812. # - '::1/128'
  813. # - 'fe80::/64'
  814. # - 'fc00::/7'
  815. # List of IP address CIDR ranges that the URL preview spider is allowed
  816. # to access even if they are specified in url_preview_ip_range_blacklist.
  817. # This is useful for specifying exceptions to wide-ranging blacklisted
  818. # target IP ranges - e.g. for enabling URL previews for a specific private
  819. # website only visible in your network.
  820. #
  821. #url_preview_ip_range_whitelist:
  822. # - '192.168.1.1'
  823. # Optional list of URL matches that the URL preview spider is
  824. # denied from accessing. You should use url_preview_ip_range_blacklist
  825. # in preference to this, otherwise someone could define a public DNS
  826. # entry that points to a private IP address and circumvent the blacklist.
  827. # This is more useful if you know there is an entire shape of URL that
  828. # you know that will never want synapse to try to spider.
  829. #
  830. # Each list entry is a dictionary of url component attributes as returned
  831. # by urlparse.urlsplit as applied to the absolute form of the URL. See
  832. # https://docs.python.org/2/library/urlparse.html#urlparse.urlsplit
  833. # The values of the dictionary are treated as an filename match pattern
  834. # applied to that component of URLs, unless they start with a ^ in which
  835. # case they are treated as a regular expression match. If all the
  836. # specified component matches for a given list item succeed, the URL is
  837. # blacklisted.
  838. #
  839. #url_preview_url_blacklist:
  840. # # blacklist any URL with a username in its URI
  841. # - username: '*'
  842. #
  843. # # blacklist all *.google.com URLs
  844. # - netloc: 'google.com'
  845. # - netloc: '*.google.com'
  846. #
  847. # # blacklist all plain HTTP URLs
  848. # - scheme: 'http'
  849. #
  850. # # blacklist http(s)://www.acme.com/foo
  851. # - netloc: 'www.acme.com'
  852. # path: '/foo'
  853. #
  854. # # blacklist any URL with a literal IPv4 address
  855. # - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
  856. # The largest allowed URL preview spidering size in bytes
  857. #
  858. #max_spider_size: 10M
  859. # A list of values for the Accept-Language HTTP header used when
  860. # downloading webpages during URL preview generation. This allows
  861. # Synapse to specify the preferred languages that URL previews should
  862. # be in when communicating with remote servers.
  863. #
  864. # Each value is a IETF language tag; a 2-3 letter identifier for a
  865. # language, optionally followed by subtags separated by '-', specifying
  866. # a country or region variant.
  867. #
  868. # Multiple values can be provided, and a weight can be added to each by
  869. # using quality value syntax (;q=). '*' translates to any language.
  870. #
  871. # Defaults to "en".
  872. #
  873. # Example:
  874. #
  875. # url_preview_accept_language:
  876. # - en-UK
  877. # - en-US;q=0.9
  878. # - fr;q=0.8
  879. # - *;q=0.7
  880. #
  881. url_preview_accept_language:
  882. # - en
  883. ## Captcha ##
  884. # See docs/CAPTCHA_SETUP.md for full details of configuring this.
  885. # This homeserver's ReCAPTCHA public key. Must be specified if
  886. # enable_registration_captcha is enabled.
  887. #
  888. #recaptcha_public_key: "YOUR_PUBLIC_KEY"
  889. # This homeserver's ReCAPTCHA private key. Must be specified if
  890. # enable_registration_captcha is enabled.
  891. #
  892. #recaptcha_private_key: "YOUR_PRIVATE_KEY"
  893. # Uncomment to enable ReCaptcha checks when registering, preventing signup
  894. # unless a captcha is answered. Requires a valid ReCaptcha
  895. # public/private key. Defaults to 'false'.
  896. #
  897. #enable_registration_captcha: true
  898. # The API endpoint to use for verifying m.login.recaptcha responses.
  899. # Defaults to "https://www.recaptcha.net/recaptcha/api/siteverify".
  900. #
  901. #recaptcha_siteverify_api: "https://my.recaptcha.site"
  902. ## TURN ##
  903. # The public URIs of the TURN server to give to clients
  904. #
  905. #turn_uris: []
  906. # The shared secret used to compute passwords for the TURN server
  907. #
  908. #turn_shared_secret: "YOUR_SHARED_SECRET"
  909. # The Username and password if the TURN server needs them and
  910. # does not use a token
  911. #
  912. #turn_username: "TURNSERVER_USERNAME"
  913. #turn_password: "TURNSERVER_PASSWORD"
  914. # How long generated TURN credentials last
  915. #
  916. #turn_user_lifetime: 1h
  917. # Whether guests should be allowed to use the TURN server.
  918. # This defaults to True, otherwise VoIP will be unreliable for guests.
  919. # However, it does introduce a slight security risk as it allows users to
  920. # connect to arbitrary endpoints without having first signed up for a
  921. # valid account (e.g. by passing a CAPTCHA).
  922. #
  923. #turn_allow_guests: true
  924. ## Registration ##
  925. #
  926. # Registration can be rate-limited using the parameters in the "Ratelimiting"
  927. # section of this file.
  928. # Enable registration for new users.
  929. #
  930. #enable_registration: false
  931. # Optional account validity configuration. This allows for accounts to be denied
  932. # any request after a given period.
  933. #
  934. # Once this feature is enabled, Synapse will look for registered users without an
  935. # expiration date at startup and will add one to every account it found using the
  936. # current settings at that time.
  937. # This means that, if a validity period is set, and Synapse is restarted (it will
  938. # then derive an expiration date from the current validity period), and some time
  939. # after that the validity period changes and Synapse is restarted, the users'
  940. # expiration dates won't be updated unless their account is manually renewed. This
  941. # date will be randomly selected within a range [now + period - d ; now + period],
  942. # where d is equal to 10% of the validity period.
  943. #
  944. account_validity:
  945. # The account validity feature is disabled by default. Uncomment the
  946. # following line to enable it.
  947. #
  948. #enabled: true
  949. # The period after which an account is valid after its registration. When
  950. # renewing the account, its validity period will be extended by this amount
  951. # of time. This parameter is required when using the account validity
  952. # feature.
  953. #
  954. #period: 6w
  955. # The amount of time before an account's expiry date at which Synapse will
  956. # send an email to the account's email address with a renewal link. By
  957. # default, no such emails are sent.
  958. #
  959. # If you enable this setting, you will also need to fill out the 'email' and
  960. # 'public_baseurl' configuration sections.
  961. #
  962. #renew_at: 1w
  963. # The subject of the email sent out with the renewal link. '%(app)s' can be
  964. # used as a placeholder for the 'app_name' parameter from the 'email'
  965. # section.
  966. #
  967. # Note that the placeholder must be written '%(app)s', including the
  968. # trailing 's'.
  969. #
  970. # If this is not set, a default value is used.
  971. #
  972. #renew_email_subject: "Renew your %(app)s account"
  973. # Directory in which Synapse will try to find templates for the HTML files to
  974. # serve to the user when trying to renew an account. If not set, default
  975. # templates from within the Synapse package will be used.
  976. #
  977. #template_dir: "res/templates"
  978. # File within 'template_dir' giving the HTML to be displayed to the user after
  979. # they successfully renewed their account. If not set, default text is used.
  980. #
  981. #account_renewed_html_path: "account_renewed.html"
  982. # File within 'template_dir' giving the HTML to be displayed when the user
  983. # tries to renew an account with an invalid renewal token. If not set,
  984. # default text is used.
  985. #
  986. #invalid_token_html_path: "invalid_token.html"
  987. # Time that a user's session remains valid for, after they log in.
  988. #
  989. # Note that this is not currently compatible with guest logins.
  990. #
  991. # Note also that this is calculated at login time: changes are not applied
  992. # retrospectively to users who have already logged in.
  993. #
  994. # By default, this is infinite.
  995. #
  996. #session_lifetime: 24h
  997. # The user must provide all of the below types of 3PID when registering.
  998. #
  999. #registrations_require_3pid:
  1000. # - email
  1001. # - msisdn
  1002. # Explicitly disable asking for MSISDNs from the registration
  1003. # flow (overrides registrations_require_3pid if MSISDNs are set as required)
  1004. #
  1005. #disable_msisdn_registration: true
  1006. # Mandate that users are only allowed to associate certain formats of
  1007. # 3PIDs with accounts on this server.
  1008. #
  1009. #allowed_local_3pids:
  1010. # - medium: email
  1011. # pattern: '.*@matrix\.org'
  1012. # - medium: email
  1013. # pattern: '.*@vector\.im'
  1014. # - medium: msisdn
  1015. # pattern: '\+44'
  1016. # Enable 3PIDs lookup requests to identity servers from this server.
  1017. #
  1018. #enable_3pid_lookup: true
  1019. # If set, allows registration of standard or admin accounts by anyone who
  1020. # has the shared secret, even if registration is otherwise disabled.
  1021. #
  1022. #registration_shared_secret: <PRIVATE STRING>
  1023. # Set the number of bcrypt rounds used to generate password hash.
  1024. # Larger numbers increase the work factor needed to generate the hash.
  1025. # The default number is 12 (which equates to 2^12 rounds).
  1026. # N.B. that increasing this will exponentially increase the time required
  1027. # to register or login - e.g. 24 => 2^24 rounds which will take >20 mins.
  1028. #
  1029. #bcrypt_rounds: 12
  1030. # Allows users to register as guests without a password/email/etc, and
  1031. # participate in rooms hosted on this server which have been made
  1032. # accessible to anonymous users.
  1033. #
  1034. #allow_guest_access: false
  1035. # The identity server which we suggest that clients should use when users log
  1036. # in on this server.
  1037. #
  1038. # (By default, no suggestion is made, so it is left up to the client.
  1039. # This setting is ignored unless public_baseurl is also set.)
  1040. #
  1041. #default_identity_server: https://matrix.org
  1042. # Handle threepid (email/phone etc) registration and password resets through a set of
  1043. # *trusted* identity servers. Note that this allows the configured identity server to
  1044. # reset passwords for accounts!
  1045. #
  1046. # Be aware that if `email` is not set, and SMTP options have not been
  1047. # configured in the email config block, registration and user password resets via
  1048. # email will be globally disabled.
  1049. #
  1050. # Additionally, if `msisdn` is not set, registration and password resets via msisdn
  1051. # will be disabled regardless. This is due to Synapse currently not supporting any
  1052. # method of sending SMS messages on its own.
  1053. #
  1054. # To enable using an identity server for operations regarding a particular third-party
  1055. # identifier type, set the value to the URL of that identity server as shown in the
  1056. # examples below.
  1057. #
  1058. # Servers handling the these requests must answer the `/requestToken` endpoints defined
  1059. # by the Matrix Identity Service API specification:
  1060. # https://matrix.org/docs/spec/identity_service/latest
  1061. #
  1062. # If a delegate is specified, the config option public_baseurl must also be filled out.
  1063. #
  1064. account_threepid_delegates:
  1065. #email: https://example.com # Delegate email sending to example.com
  1066. #msisdn: http://localhost:8090 # Delegate SMS sending to this local process
  1067. # Whether users are allowed to change their displayname after it has
  1068. # been initially set. Useful when provisioning users based on the
  1069. # contents of a third-party directory.
  1070. #
  1071. # Does not apply to server administrators. Defaults to 'true'
  1072. #
  1073. #enable_set_displayname: false
  1074. # Whether users are allowed to change their avatar after it has been
  1075. # initially set. Useful when provisioning users based on the contents
  1076. # of a third-party directory.
  1077. #
  1078. # Does not apply to server administrators. Defaults to 'true'
  1079. #
  1080. #enable_set_avatar_url: false
  1081. # Whether users can change the 3PIDs associated with their accounts
  1082. # (email address and msisdn).
  1083. #
  1084. # Defaults to 'true'
  1085. #
  1086. #enable_3pid_changes: false
  1087. # Users who register on this homeserver will automatically be joined
  1088. # to these rooms.
  1089. #
  1090. # By default, any room aliases included in this list will be created
  1091. # as a publicly joinable room when the first user registers for the
  1092. # homeserver. This behaviour can be customised with the settings below.
  1093. #
  1094. #auto_join_rooms:
  1095. # - "#example:example.com"
  1096. # Where auto_join_rooms are specified, setting this flag ensures that the
  1097. # the rooms exist by creating them when the first user on the
  1098. # homeserver registers.
  1099. #
  1100. # By default the auto-created rooms are publicly joinable from any federated
  1101. # server. Use the autocreate_auto_join_rooms_federated and
  1102. # autocreate_auto_join_room_preset settings below to customise this behaviour.
  1103. #
  1104. # Setting to false means that if the rooms are not manually created,
  1105. # users cannot be auto-joined since they do not exist.
  1106. #
  1107. # Defaults to true. Uncomment the following line to disable automatically
  1108. # creating auto-join rooms.
  1109. #
  1110. #autocreate_auto_join_rooms: false
  1111. # Whether the auto_join_rooms that are auto-created are available via
  1112. # federation. Only has an effect if autocreate_auto_join_rooms is true.
  1113. #
  1114. # Note that whether a room is federated cannot be modified after
  1115. # creation.
  1116. #
  1117. # Defaults to true: the room will be joinable from other servers.
  1118. # Uncomment the following to prevent users from other homeservers from
  1119. # joining these rooms.
  1120. #
  1121. #autocreate_auto_join_rooms_federated: false
  1122. # The room preset to use when auto-creating one of auto_join_rooms. Only has an
  1123. # effect if autocreate_auto_join_rooms is true.
  1124. #
  1125. # This can be one of "public_chat", "private_chat", or "trusted_private_chat".
  1126. # If a value of "private_chat" or "trusted_private_chat" is used then
  1127. # auto_join_mxid_localpart must also be configured.
  1128. #
  1129. # Defaults to "public_chat", meaning that the room is joinable by anyone, including
  1130. # federated servers if autocreate_auto_join_rooms_federated is true (the default).
  1131. # Uncomment the following to require an invitation to join these rooms.
  1132. #
  1133. #autocreate_auto_join_room_preset: private_chat
  1134. # The local part of the user id which is used to create auto_join_rooms if
  1135. # autocreate_auto_join_rooms is true. If this is not provided then the
  1136. # initial user account that registers will be used to create the rooms.
  1137. #
  1138. # The user id is also used to invite new users to any auto-join rooms which
  1139. # are set to invite-only.
  1140. #
  1141. # It *must* be configured if autocreate_auto_join_room_preset is set to
  1142. # "private_chat" or "trusted_private_chat".
  1143. #
  1144. # Note that this must be specified in order for new users to be correctly
  1145. # invited to any auto-join rooms which have been set to invite-only (either
  1146. # at the time of creation or subsequently).
  1147. #
  1148. # Note that, if the room already exists, this user must be joined and
  1149. # have the appropriate permissions to invite new members.
  1150. #
  1151. #auto_join_mxid_localpart: system
  1152. # When auto_join_rooms is specified, setting this flag to false prevents
  1153. # guest accounts from being automatically joined to the rooms.
  1154. #
  1155. # Defaults to true.
  1156. #
  1157. #auto_join_rooms_for_guests: false
  1158. ## Metrics ###
  1159. # Enable collection and rendering of performance metrics
  1160. #
  1161. #enable_metrics: false
  1162. # Enable sentry integration
  1163. # NOTE: While attempts are made to ensure that the logs don't contain
  1164. # any sensitive information, this cannot be guaranteed. By enabling
  1165. # this option the sentry server may therefore receive sensitive
  1166. # information, and it in turn may then diseminate sensitive information
  1167. # through insecure notification channels if so configured.
  1168. #
  1169. #sentry:
  1170. # dsn: "..."
  1171. # Flags to enable Prometheus metrics which are not suitable to be
  1172. # enabled by default, either for performance reasons or limited use.
  1173. #
  1174. metrics_flags:
  1175. # Publish synapse_federation_known_servers, a gauge of the number of
  1176. # servers this homeserver knows about, including itself. May cause
  1177. # performance problems on large homeservers.
  1178. #
  1179. #known_servers: true
  1180. # Whether or not to report anonymized homeserver usage statistics.
  1181. #
  1182. #report_stats: true|false
  1183. # The endpoint to report the anonymized homeserver usage statistics to.
  1184. # Defaults to https://matrix.org/report-usage-stats/push
  1185. #
  1186. #report_stats_endpoint: https://example.com/report-usage-stats/push
  1187. ## API Configuration ##
  1188. # A list of event types that will be included in the room_invite_state
  1189. #
  1190. #room_invite_state_types:
  1191. # - "m.room.join_rules"
  1192. # - "m.room.canonical_alias"
  1193. # - "m.room.avatar"
  1194. # - "m.room.encryption"
  1195. # - "m.room.name"
  1196. # A list of application service config files to use
  1197. #
  1198. #app_service_config_files:
  1199. # - app_service_1.yaml
  1200. # - app_service_2.yaml
  1201. # Uncomment to enable tracking of application service IP addresses. Implicitly
  1202. # enables MAU tracking for application service users.
  1203. #
  1204. #track_appservice_user_ips: true
  1205. # a secret which is used to sign access tokens. If none is specified,
  1206. # the registration_shared_secret is used, if one is given; otherwise,
  1207. # a secret key is derived from the signing key.
  1208. #
  1209. #macaroon_secret_key: <PRIVATE STRING>
  1210. # a secret which is used to calculate HMACs for form values, to stop
  1211. # falsification of values. Must be specified for the User Consent
  1212. # forms to work.
  1213. #
  1214. #form_secret: <PRIVATE STRING>
  1215. ## Signing Keys ##
  1216. # Path to the signing key to sign messages with
  1217. #
  1218. signing_key_path: "CONFDIR/SERVERNAME.signing.key"
  1219. # The keys that the server used to sign messages with but won't use
  1220. # to sign new messages.
  1221. #
  1222. old_signing_keys:
  1223. # For each key, `key` should be the base64-encoded public key, and
  1224. # `expired_ts`should be the time (in milliseconds since the unix epoch) that
  1225. # it was last used.
  1226. #
  1227. # It is possible to build an entry from an old signing.key file using the
  1228. # `export_signing_key` script which is provided with synapse.
  1229. #
  1230. # For example:
  1231. #
  1232. #"ed25519:id": { key: "base64string", expired_ts: 123456789123 }
  1233. # How long key response published by this server is valid for.
  1234. # Used to set the valid_until_ts in /key/v2 APIs.
  1235. # Determines how quickly servers will query to check which keys
  1236. # are still valid.
  1237. #
  1238. #key_refresh_interval: 1d
  1239. # The trusted servers to download signing keys from.
  1240. #
  1241. # When we need to fetch a signing key, each server is tried in parallel.
  1242. #
  1243. # Normally, the connection to the key server is validated via TLS certificates.
  1244. # Additional security can be provided by configuring a `verify key`, which
  1245. # will make synapse check that the response is signed by that key.
  1246. #
  1247. # This setting supercedes an older setting named `perspectives`. The old format
  1248. # is still supported for backwards-compatibility, but it is deprecated.
  1249. #
  1250. # 'trusted_key_servers' defaults to matrix.org, but using it will generate a
  1251. # warning on start-up. To suppress this warning, set
  1252. # 'suppress_key_server_warning' to true.
  1253. #
  1254. # Options for each entry in the list include:
  1255. #
  1256. # server_name: the name of the server. required.
  1257. #
  1258. # verify_keys: an optional map from key id to base64-encoded public key.
  1259. # If specified, we will check that the response is signed by at least
  1260. # one of the given keys.
  1261. #
  1262. # accept_keys_insecurely: a boolean. Normally, if `verify_keys` is unset,
  1263. # and federation_verify_certificates is not `true`, synapse will refuse
  1264. # to start, because this would allow anyone who can spoof DNS responses
  1265. # to masquerade as the trusted key server. If you know what you are doing
  1266. # and are sure that your network environment provides a secure connection
  1267. # to the key server, you can set this to `true` to override this
  1268. # behaviour.
  1269. #
  1270. # An example configuration might look like:
  1271. #
  1272. #trusted_key_servers:
  1273. # - server_name: "my_trusted_server.example.com"
  1274. # verify_keys:
  1275. # "ed25519:auto": "abcdefghijklmnopqrstuvwxyzabcdefghijklmopqr"
  1276. # - server_name: "my_other_trusted_server.example.com"
  1277. #
  1278. trusted_key_servers:
  1279. - server_name: "matrix.org"
  1280. # Uncomment the following to disable the warning that is emitted when the
  1281. # trusted_key_servers include 'matrix.org'. See above.
  1282. #
  1283. #suppress_key_server_warning: true
  1284. # The signing keys to use when acting as a trusted key server. If not specified
  1285. # defaults to the server signing key.
  1286. #
  1287. # Can contain multiple keys, one per line.
  1288. #
  1289. #key_server_signing_keys_path: "key_server_signing_keys.key"
  1290. ## Single sign-on integration ##
  1291. # Enable SAML2 for registration and login. Uses pysaml2.
  1292. #
  1293. # At least one of `sp_config` or `config_path` must be set in this section to
  1294. # enable SAML login.
  1295. #
  1296. # (You will probably also want to set the following options to `false` to
  1297. # disable the regular login/registration flows:
  1298. # * enable_registration
  1299. # * password_config.enabled
  1300. #
  1301. # Once SAML support is enabled, a metadata file will be exposed at
  1302. # https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
  1303. # use to configure your SAML IdP with. Alternatively, you can manually configure
  1304. # the IdP to use an ACS location of
  1305. # https://<server>:<port>/_matrix/saml2/authn_response.
  1306. #
  1307. saml2_config:
  1308. # `sp_config` is the configuration for the pysaml2 Service Provider.
  1309. # See pysaml2 docs for format of config.
  1310. #
  1311. # Default values will be used for the 'entityid' and 'service' settings,
  1312. # so it is not normally necessary to specify them unless you need to
  1313. # override them.
  1314. #
  1315. #sp_config:
  1316. # # point this to the IdP's metadata. You can use either a local file or
  1317. # # (preferably) a URL.
  1318. # metadata:
  1319. # #local: ["saml2/idp.xml"]
  1320. # remote:
  1321. # - url: https://our_idp/metadata.xml
  1322. #
  1323. # # By default, the user has to go to our login page first. If you'd like
  1324. # # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
  1325. # # 'service.sp' section:
  1326. # #
  1327. # #service:
  1328. # # sp:
  1329. # # allow_unsolicited: true
  1330. #
  1331. # # The examples below are just used to generate our metadata xml, and you
  1332. # # may well not need them, depending on your setup. Alternatively you
  1333. # # may need a whole lot more detail - see the pysaml2 docs!
  1334. #
  1335. # description: ["My awesome SP", "en"]
  1336. # name: ["Test SP", "en"]
  1337. #
  1338. # organization:
  1339. # name: Example com
  1340. # display_name:
  1341. # - ["Example co", "en"]
  1342. # url: "http://example.com"
  1343. #
  1344. # contact_person:
  1345. # - given_name: Bob
  1346. # sur_name: "the Sysadmin"
  1347. # email_address": ["admin@example.com"]
  1348. # contact_type": technical
  1349. # Instead of putting the config inline as above, you can specify a
  1350. # separate pysaml2 configuration file:
  1351. #
  1352. #config_path: "CONFDIR/sp_conf.py"
  1353. # The lifetime of a SAML session. This defines how long a user has to
  1354. # complete the authentication process, if allow_unsolicited is unset.
  1355. # The default is 15 minutes.
  1356. #
  1357. #saml_session_lifetime: 5m
  1358. # An external module can be provided here as a custom solution to
  1359. # mapping attributes returned from a saml provider onto a matrix user.
  1360. #
  1361. user_mapping_provider:
  1362. # The custom module's class. Uncomment to use a custom module.
  1363. #
  1364. #module: mapping_provider.SamlMappingProvider
  1365. # Custom configuration values for the module. Below options are
  1366. # intended for the built-in provider, they should be changed if
  1367. # using a custom module. This section will be passed as a Python
  1368. # dictionary to the module's `parse_config` method.
  1369. #
  1370. config:
  1371. # The SAML attribute (after mapping via the attribute maps) to use
  1372. # to derive the Matrix ID from. 'uid' by default.
  1373. #
  1374. # Note: This used to be configured by the
  1375. # saml2_config.mxid_source_attribute option. If that is still
  1376. # defined, its value will be used instead.
  1377. #
  1378. #mxid_source_attribute: displayName
  1379. # The mapping system to use for mapping the saml attribute onto a
  1380. # matrix ID.
  1381. #
  1382. # Options include:
  1383. # * 'hexencode' (which maps unpermitted characters to '=xx')
  1384. # * 'dotreplace' (which replaces unpermitted characters with
  1385. # '.').
  1386. # The default is 'hexencode'.
  1387. #
  1388. # Note: This used to be configured by the
  1389. # saml2_config.mxid_mapping option. If that is still defined, its
  1390. # value will be used instead.
  1391. #
  1392. #mxid_mapping: dotreplace
  1393. # In previous versions of synapse, the mapping from SAML attribute to
  1394. # MXID was always calculated dynamically rather than stored in a
  1395. # table. For backwards- compatibility, we will look for user_ids
  1396. # matching such a pattern before creating a new account.
  1397. #
  1398. # This setting controls the SAML attribute which will be used for this
  1399. # backwards-compatibility lookup. Typically it should be 'uid', but if
  1400. # the attribute maps are changed, it may be necessary to change it.
  1401. #
  1402. # The default is 'uid'.
  1403. #
  1404. #grandfathered_mxid_source_attribute: upn
  1405. # It is possible to configure Synapse to only allow logins if SAML attributes
  1406. # match particular values. The requirements can be listed under
  1407. # `attribute_requirements` as shown below. All of the listed attributes must
  1408. # match for the login to be permitted.
  1409. #
  1410. #attribute_requirements:
  1411. # - attribute: userGroup
  1412. # value: "staff"
  1413. # - attribute: department
  1414. # value: "sales"
  1415. # Directory in which Synapse will try to find the template files below.
  1416. # If not set, default templates from within the Synapse package will be used.
  1417. #
  1418. # DO NOT UNCOMMENT THIS SETTING unless you want to customise the templates.
  1419. # If you *do* uncomment it, you will need to make sure that all the templates
  1420. # below are in the directory.
  1421. #
  1422. # Synapse will look for the following templates in this directory:
  1423. #
  1424. # * HTML page to display to users if something goes wrong during the
  1425. # authentication process: 'saml_error.html'.
  1426. #
  1427. # When rendering, this template is given the following variables:
  1428. # * code: an HTML error code corresponding to the error that is being
  1429. # returned (typically 400 or 500)
  1430. #
  1431. # * msg: a textual message describing the error.
  1432. #
  1433. # The variables will automatically be HTML-escaped.
  1434. #
  1435. # You can see the default templates at:
  1436. # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
  1437. #
  1438. #template_dir: "res/templates"
  1439. # OpenID Connect integration. The following settings can be used to make Synapse
  1440. # use an OpenID Connect Provider for authentication, instead of its internal
  1441. # password database.
  1442. #
  1443. # See https://github.com/matrix-org/synapse/blob/master/docs/openid.md.
  1444. #
  1445. oidc_config:
  1446. # Uncomment the following to enable authorization against an OpenID Connect
  1447. # server. Defaults to false.
  1448. #
  1449. #enabled: true
  1450. # Uncomment the following to disable use of the OIDC discovery mechanism to
  1451. # discover endpoints. Defaults to true.
  1452. #
  1453. #discover: false
  1454. # the OIDC issuer. Used to validate tokens and (if discovery is enabled) to
  1455. # discover the provider's endpoints.
  1456. #
  1457. # Required if 'enabled' is true.
  1458. #
  1459. #issuer: "https://accounts.example.com/"
  1460. # oauth2 client id to use.
  1461. #
  1462. # Required if 'enabled' is true.
  1463. #
  1464. #client_id: "provided-by-your-issuer"
  1465. # oauth2 client secret to use.
  1466. #
  1467. # Required if 'enabled' is true.
  1468. #
  1469. #client_secret: "provided-by-your-issuer"
  1470. # auth method to use when exchanging the token.
  1471. # Valid values are 'client_secret_basic' (default), 'client_secret_post' and
  1472. # 'none'.
  1473. #
  1474. #client_auth_method: client_secret_post
  1475. # list of scopes to request. This should normally include the "openid" scope.
  1476. # Defaults to ["openid"].
  1477. #
  1478. #scopes: ["openid", "profile"]
  1479. # the oauth2 authorization endpoint. Required if provider discovery is disabled.
  1480. #
  1481. #authorization_endpoint: "https://accounts.example.com/oauth2/auth"
  1482. # the oauth2 token endpoint. Required if provider discovery is disabled.
  1483. #
  1484. #token_endpoint: "https://accounts.example.com/oauth2/token"
  1485. # the OIDC userinfo endpoint. Required if discovery is disabled and the
  1486. # "openid" scope is not requested.
  1487. #
  1488. #userinfo_endpoint: "https://accounts.example.com/userinfo"
  1489. # URI where to fetch the JWKS. Required if discovery is disabled and the
  1490. # "openid" scope is used.
  1491. #
  1492. #jwks_uri: "https://accounts.example.com/.well-known/jwks.json"
  1493. # Uncomment to skip metadata verification. Defaults to false.
  1494. #
  1495. # Use this if you are connecting to a provider that is not OpenID Connect
  1496. # compliant.
  1497. # Avoid this in production.
  1498. #
  1499. #skip_verification: true
  1500. # An external module can be provided here as a custom solution to mapping
  1501. # attributes returned from a OIDC provider onto a matrix user.
  1502. #
  1503. user_mapping_provider:
  1504. # The custom module's class. Uncomment to use a custom module.
  1505. # Default is 'synapse.handlers.oidc_handler.JinjaOidcMappingProvider'.
  1506. #
  1507. # See https://github.com/matrix-org/synapse/blob/master/docs/sso_mapping_providers.md#openid-mapping-providers
  1508. # for information on implementing a custom mapping provider.
  1509. #
  1510. #module: mapping_provider.OidcMappingProvider
  1511. # Custom configuration values for the module. This section will be passed as
  1512. # a Python dictionary to the user mapping provider module's `parse_config`
  1513. # method.
  1514. #
  1515. # The examples below are intended for the default provider: they should be
  1516. # changed if using a custom provider.
  1517. #
  1518. config:
  1519. # name of the claim containing a unique identifier for the user.
  1520. # Defaults to `sub`, which OpenID Connect compliant providers should provide.
  1521. #
  1522. #subject_claim: "sub"
  1523. # Jinja2 template for the localpart of the MXID.
  1524. #
  1525. # When rendering, this template is given the following variables:
  1526. # * user: The claims returned by the UserInfo Endpoint and/or in the ID
  1527. # Token
  1528. #
  1529. # This must be configured if using the default mapping provider.
  1530. #
  1531. localpart_template: "{{ user.preferred_username }}"
  1532. # Jinja2 template for the display name to set on first login.
  1533. #
  1534. # If unset, no displayname will be set.
  1535. #
  1536. #display_name_template: "{{ user.given_name }} {{ user.last_name }}"
  1537. # Enable CAS for registration and login.
  1538. #
  1539. #cas_config:
  1540. # enabled: true
  1541. # server_url: "https://cas-server.com"
  1542. # service_url: "https://homeserver.domain.com:8448"
  1543. # #displayname_attribute: name
  1544. # #required_attributes:
  1545. # # name: value
  1546. # Additional settings to use with single-sign on systems such as OpenID Connect,
  1547. # SAML2 and CAS.
  1548. #
  1549. sso:
  1550. # A list of client URLs which are whitelisted so that the user does not
  1551. # have to confirm giving access to their account to the URL. Any client
  1552. # whose URL starts with an entry in the following list will not be subject
  1553. # to an additional confirmation step after the SSO login is completed.
  1554. #
  1555. # WARNING: An entry such as "https://my.client" is insecure, because it
  1556. # will also match "https://my.client.evil.site", exposing your users to
  1557. # phishing attacks from evil.site. To avoid this, include a slash after the
  1558. # hostname: "https://my.client/".
  1559. #
  1560. # If public_baseurl is set, then the login fallback page (used by clients
  1561. # that don't natively support the required login flows) is whitelisted in
  1562. # addition to any URLs in this list.
  1563. #
  1564. # By default, this list is empty.
  1565. #
  1566. #client_whitelist:
  1567. # - https://riot.im/develop
  1568. # - https://my.custom.client/
  1569. # Directory in which Synapse will try to find the template files below.
  1570. # If not set, default templates from within the Synapse package will be used.
  1571. #
  1572. # DO NOT UNCOMMENT THIS SETTING unless you want to customise the templates.
  1573. # If you *do* uncomment it, you will need to make sure that all the templates
  1574. # below are in the directory.
  1575. #
  1576. # Synapse will look for the following templates in this directory:
  1577. #
  1578. # * HTML page for a confirmation step before redirecting back to the client
  1579. # with the login token: 'sso_redirect_confirm.html'.
  1580. #
  1581. # When rendering, this template is given three variables:
  1582. # * redirect_url: the URL the user is about to be redirected to. Needs
  1583. # manual escaping (see
  1584. # https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
  1585. #
  1586. # * display_url: the same as `redirect_url`, but with the query
  1587. # parameters stripped. The intention is to have a
  1588. # human-readable URL to show to users, not to use it as
  1589. # the final address to redirect to. Needs manual escaping
  1590. # (see https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
  1591. #
  1592. # * server_name: the homeserver's name.
  1593. #
  1594. # * HTML page which notifies the user that they are authenticating to confirm
  1595. # an operation on their account during the user interactive authentication
  1596. # process: 'sso_auth_confirm.html'.
  1597. #
  1598. # When rendering, this template is given the following variables:
  1599. # * redirect_url: the URL the user is about to be redirected to. Needs
  1600. # manual escaping (see
  1601. # https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
  1602. #
  1603. # * description: the operation which the user is being asked to confirm
  1604. #
  1605. # * HTML page shown after a successful user interactive authentication session:
  1606. # 'sso_auth_success.html'.
  1607. #
  1608. # Note that this page must include the JavaScript which notifies of a successful authentication
  1609. # (see https://matrix.org/docs/spec/client_server/r0.6.0#fallback).
  1610. #
  1611. # This template has no additional variables.
  1612. #
  1613. # * HTML page shown during single sign-on if a deactivated user (according to Synapse's database)
  1614. # attempts to login: 'sso_account_deactivated.html'.
  1615. #
  1616. # This template has no additional variables.
  1617. #
  1618. # * HTML page to display to users if something goes wrong during the
  1619. # OpenID Connect authentication process: 'sso_error.html'.
  1620. #
  1621. # When rendering, this template is given two variables:
  1622. # * error: the technical name of the error
  1623. # * error_description: a human-readable message for the error
  1624. #
  1625. # You can see the default templates at:
  1626. # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
  1627. #
  1628. #template_dir: "res/templates"
  1629. # JSON web token integration. The following settings can be used to make
  1630. # Synapse JSON web tokens for authentication, instead of its internal
  1631. # password database.
  1632. #
  1633. # Each JSON Web Token needs to contain a "sub" (subject) claim, which is
  1634. # used as the localpart of the mxid.
  1635. #
  1636. # Additionally, the expiration time ("exp"), not before time ("nbf"),
  1637. # and issued at ("iat") claims are validated if present.
  1638. #
  1639. # Note that this is a non-standard login type and client support is
  1640. # expected to be non-existant.
  1641. #
  1642. # See https://github.com/matrix-org/synapse/blob/master/docs/jwt.md.
  1643. #
  1644. #jwt_config:
  1645. # Uncomment the following to enable authorization using JSON web
  1646. # tokens. Defaults to false.
  1647. #
  1648. #enabled: true
  1649. # This is either the private shared secret or the public key used to
  1650. # decode the contents of the JSON web token.
  1651. #
  1652. # Required if 'enabled' is true.
  1653. #
  1654. #secret: "provided-by-your-issuer"
  1655. # The algorithm used to sign the JSON web token.
  1656. #
  1657. # Supported algorithms are listed at
  1658. # https://pyjwt.readthedocs.io/en/latest/algorithms.html
  1659. #
  1660. # Required if 'enabled' is true.
  1661. #
  1662. #algorithm: "provided-by-your-issuer"
  1663. # The issuer to validate the "iss" claim against.
  1664. #
  1665. # Optional, if provided the "iss" claim will be required and
  1666. # validated for all JSON web tokens.
  1667. #
  1668. #issuer: "provided-by-your-issuer"
  1669. # A list of audiences to validate the "aud" claim against.
  1670. #
  1671. # Optional, if provided the "aud" claim will be required and
  1672. # validated for all JSON web tokens.
  1673. #
  1674. # Note that if the "aud" claim is included in a JSON web token then
  1675. # validation will fail without configuring audiences.
  1676. #
  1677. #audiences:
  1678. # - "provided-by-your-issuer"
  1679. password_config:
  1680. # Uncomment to disable password login
  1681. #
  1682. #enabled: false
  1683. # Uncomment to disable authentication against the local password
  1684. # database. This is ignored if `enabled` is false, and is only useful
  1685. # if you have other password_providers.
  1686. #
  1687. #localdb_enabled: false
  1688. # Uncomment and change to a secret random string for extra security.
  1689. # DO NOT CHANGE THIS AFTER INITIAL SETUP!
  1690. #
  1691. #pepper: "EVEN_MORE_SECRET"
  1692. # Define and enforce a password policy. Each parameter is optional.
  1693. # This is an implementation of MSC2000.
  1694. #
  1695. policy:
  1696. # Whether to enforce the password policy.
  1697. # Defaults to 'false'.
  1698. #
  1699. #enabled: true
  1700. # Minimum accepted length for a password.
  1701. # Defaults to 0.
  1702. #
  1703. #minimum_length: 15
  1704. # Whether a password must contain at least one digit.
  1705. # Defaults to 'false'.
  1706. #
  1707. #require_digit: true
  1708. # Whether a password must contain at least one symbol.
  1709. # A symbol is any character that's not a number or a letter.
  1710. # Defaults to 'false'.
  1711. #
  1712. #require_symbol: true
  1713. # Whether a password must contain at least one lowercase letter.
  1714. # Defaults to 'false'.
  1715. #
  1716. #require_lowercase: true
  1717. # Whether a password must contain at least one lowercase letter.
  1718. # Defaults to 'false'.
  1719. #
  1720. #require_uppercase: true
  1721. # Configuration for sending emails from Synapse.
  1722. #
  1723. email:
  1724. # The hostname of the outgoing SMTP server to use. Defaults to 'localhost'.
  1725. #
  1726. #smtp_host: mail.server
  1727. # The port on the mail server for outgoing SMTP. Defaults to 25.
  1728. #
  1729. #smtp_port: 587
  1730. # Username/password for authentication to the SMTP server. By default, no
  1731. # authentication is attempted.
  1732. #
  1733. #smtp_user: "exampleusername"
  1734. #smtp_pass: "examplepassword"
  1735. # Uncomment the following to require TLS transport security for SMTP.
  1736. # By default, Synapse will connect over plain text, and will then switch to
  1737. # TLS via STARTTLS *if the SMTP server supports it*. If this option is set,
  1738. # Synapse will refuse to connect unless the server supports STARTTLS.
  1739. #
  1740. #require_transport_security: true
  1741. # notif_from defines the "From" address to use when sending emails.
  1742. # It must be set if email sending is enabled.
  1743. #
  1744. # The placeholder '%(app)s' will be replaced by the application name,
  1745. # which is normally 'app_name' (below), but may be overridden by the
  1746. # Matrix client application.
  1747. #
  1748. # Note that the placeholder must be written '%(app)s', including the
  1749. # trailing 's'.
  1750. #
  1751. #notif_from: "Your Friendly %(app)s homeserver <noreply@example.com>"
  1752. # app_name defines the default value for '%(app)s' in notif_from and email
  1753. # subjects. It defaults to 'Matrix'.
  1754. #
  1755. #app_name: my_branded_matrix_server
  1756. # Uncomment the following to enable sending emails for messages that the user
  1757. # has missed. Disabled by default.
  1758. #
  1759. #enable_notifs: true
  1760. # Uncomment the following to disable automatic subscription to email
  1761. # notifications for new users. Enabled by default.
  1762. #
  1763. #notif_for_new_users: false
  1764. # Custom URL for client links within the email notifications. By default
  1765. # links will be based on "https://matrix.to".
  1766. #
  1767. # (This setting used to be called riot_base_url; the old name is still
  1768. # supported for backwards-compatibility but is now deprecated.)
  1769. #
  1770. #client_base_url: "http://localhost/riot"
  1771. # Configure the time that a validation email will expire after sending.
  1772. # Defaults to 1h.
  1773. #
  1774. #validation_token_lifetime: 15m
  1775. # Directory in which Synapse will try to find the template files below.
  1776. # If not set, default templates from within the Synapse package will be used.
  1777. #
  1778. # DO NOT UNCOMMENT THIS SETTING unless you want to customise the templates.
  1779. # If you *do* uncomment it, you will need to make sure that all the templates
  1780. # below are in the directory.
  1781. #
  1782. # Synapse will look for the following templates in this directory:
  1783. #
  1784. # * The contents of email notifications of missed events: 'notif_mail.html' and
  1785. # 'notif_mail.txt'.
  1786. #
  1787. # * The contents of account expiry notice emails: 'notice_expiry.html' and
  1788. # 'notice_expiry.txt'.
  1789. #
  1790. # * The contents of password reset emails sent by the homeserver:
  1791. # 'password_reset.html' and 'password_reset.txt'
  1792. #
  1793. # * HTML pages for success and failure that a user will see when they follow
  1794. # the link in the password reset email: 'password_reset_success.html' and
  1795. # 'password_reset_failure.html'
  1796. #
  1797. # * The contents of address verification emails sent during registration:
  1798. # 'registration.html' and 'registration.txt'
  1799. #
  1800. # * HTML pages for success and failure that a user will see when they follow
  1801. # the link in an address verification email sent during registration:
  1802. # 'registration_success.html' and 'registration_failure.html'
  1803. #
  1804. # * The contents of address verification emails sent when an address is added
  1805. # to a Matrix account: 'add_threepid.html' and 'add_threepid.txt'
  1806. #
  1807. # * HTML pages for success and failure that a user will see when they follow
  1808. # the link in an address verification email sent when an address is added
  1809. # to a Matrix account: 'add_threepid_success.html' and
  1810. # 'add_threepid_failure.html'
  1811. #
  1812. # You can see the default templates at:
  1813. # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
  1814. #
  1815. #template_dir: "res/templates"
  1816. # Subjects to use when sending emails from Synapse.
  1817. #
  1818. # The placeholder '%(app)s' will be replaced with the value of the 'app_name'
  1819. # setting above, or by a value dictated by the Matrix client application.
  1820. #
  1821. # If a subject isn't overridden in this configuration file, the value used as
  1822. # its example will be used.
  1823. #
  1824. #subjects:
  1825. # Subjects for notification emails.
  1826. #
  1827. # On top of the '%(app)s' placeholder, these can use the following
  1828. # placeholders:
  1829. #
  1830. # * '%(person)s', which will be replaced by the display name of the user(s)
  1831. # that sent the message(s), e.g. "Alice and Bob".
  1832. # * '%(room)s', which will be replaced by the name of the room the
  1833. # message(s) have been sent to, e.g. "My super room".
  1834. #
  1835. # See the example provided for each setting to see which placeholder can be
  1836. # used and how to use them.
  1837. #
  1838. # Subject to use to notify about one message from one or more user(s) in a
  1839. # room which has a name.
  1840. #message_from_person_in_room: "[%(app)s] You have a message on %(app)s from %(person)s in the %(room)s room..."
  1841. #
  1842. # Subject to use to notify about one message from one or more user(s) in a
  1843. # room which doesn't have a name.
  1844. #message_from_person: "[%(app)s] You have a message on %(app)s from %(person)s..."
  1845. #
  1846. # Subject to use to notify about multiple messages from one or more users in
  1847. # a room which doesn't have a name.
  1848. #messages_from_person: "[%(app)s] You have messages on %(app)s from %(person)s..."
  1849. #
  1850. # Subject to use to notify about multiple messages in a room which has a
  1851. # name.
  1852. #messages_in_room: "[%(app)s] You have messages on %(app)s in the %(room)s room..."
  1853. #
  1854. # Subject to use to notify about multiple messages in multiple rooms.
  1855. #messages_in_room_and_others: "[%(app)s] You have messages on %(app)s in the %(room)s room and others..."
  1856. #
  1857. # Subject to use to notify about multiple messages from multiple persons in
  1858. # multiple rooms. This is similar to the setting above except it's used when
  1859. # the room in which the notification was triggered has no name.
  1860. #messages_from_person_and_others: "[%(app)s] You have messages on %(app)s from %(person)s and others..."
  1861. #
  1862. # Subject to use to notify about an invite to a room which has a name.
  1863. #invite_from_person_to_room: "[%(app)s] %(person)s has invited you to join the %(room)s room on %(app)s..."
  1864. #
  1865. # Subject to use to notify about an invite to a room which doesn't have a
  1866. # name.
  1867. #invite_from_person: "[%(app)s] %(person)s has invited you to chat on %(app)s..."
  1868. # Subject for emails related to account administration.
  1869. #
  1870. # On top of the '%(app)s' placeholder, these one can use the
  1871. # '%(server_name)s' placeholder, which will be replaced by the value of the
  1872. # 'server_name' setting in your Synapse configuration.
  1873. #
  1874. # Subject to use when sending a password reset email.
  1875. #password_reset: "[%(server_name)s] Password reset"
  1876. #
  1877. # Subject to use when sending a verification email to assert an address's
  1878. # ownership.
  1879. #email_validation: "[%(server_name)s] Validate your email"
  1880. # Password providers allow homeserver administrators to integrate
  1881. # their Synapse installation with existing authentication methods
  1882. # ex. LDAP, external tokens, etc.
  1883. #
  1884. # For more information and known implementations, please see
  1885. # https://github.com/matrix-org/synapse/blob/master/docs/password_auth_providers.md
  1886. #
  1887. # Note: instances wishing to use SAML or CAS authentication should
  1888. # instead use the `saml2_config` or `cas_config` options,
  1889. # respectively.
  1890. #
  1891. password_providers:
  1892. # # Example config for an LDAP auth provider
  1893. # - module: "ldap_auth_provider.LdapAuthProvider"
  1894. # config:
  1895. # enabled: true
  1896. # uri: "ldap://ldap.example.com:389"
  1897. # start_tls: true
  1898. # base: "ou=users,dc=example,dc=com"
  1899. # attributes:
  1900. # uid: "cn"
  1901. # mail: "email"
  1902. # name: "givenName"
  1903. # #bind_dn:
  1904. # #bind_password:
  1905. # #filter: "(objectClass=posixAccount)"
  1906. # Clients requesting push notifications can either have the body of
  1907. # the message sent in the notification poke along with other details
  1908. # like the sender, or just the event ID and room ID (`event_id_only`).
  1909. # If clients choose the former, this option controls whether the
  1910. # notification request includes the content of the event (other details
  1911. # like the sender are still included). For `event_id_only` push, it
  1912. # has no effect.
  1913. #
  1914. # For modern android devices the notification content will still appear
  1915. # because it is loaded by the app. iPhone, however will send a
  1916. # notification saying only that a message arrived and who it came from.
  1917. #
  1918. #push:
  1919. # include_content: true
  1920. # Spam checkers are third-party modules that can block specific actions
  1921. # of local users, such as creating rooms and registering undesirable
  1922. # usernames, as well as remote users by redacting incoming events.
  1923. #
  1924. spam_checker:
  1925. #- module: "my_custom_project.SuperSpamChecker"
  1926. # config:
  1927. # example_option: 'things'
  1928. #- module: "some_other_project.BadEventStopper"
  1929. # config:
  1930. # example_stop_events_from: ['@bad:example.com']
  1931. ## Rooms ##
  1932. # Controls whether locally-created rooms should be end-to-end encrypted by
  1933. # default.
  1934. #
  1935. # Possible options are "all", "invite", and "off". They are defined as:
  1936. #
  1937. # * "all": any locally-created room
  1938. # * "invite": any room created with the "private_chat" or "trusted_private_chat"
  1939. # room creation presets
  1940. # * "off": this option will take no effect
  1941. #
  1942. # The default value is "off".
  1943. #
  1944. # Note that this option will only affect rooms created after it is set. It
  1945. # will also not affect rooms created by other servers.
  1946. #
  1947. #encryption_enabled_by_default_for_room_type: invite
  1948. # Uncomment to allow non-server-admin users to create groups on this server
  1949. #
  1950. #enable_group_creation: true
  1951. # If enabled, non server admins can only create groups with local parts
  1952. # starting with this prefix
  1953. #
  1954. #group_creation_prefix: "unofficial/"
  1955. # User Directory configuration
  1956. #
  1957. # 'enabled' defines whether users can search the user directory. If
  1958. # false then empty responses are returned to all queries. Defaults to
  1959. # true.
  1960. #
  1961. # 'search_all_users' defines whether to search all users visible to your HS
  1962. # when searching the user directory, rather than limiting to users visible
  1963. # in public rooms. Defaults to false. If you set it True, you'll have to
  1964. # rebuild the user_directory search indexes, see
  1965. # https://github.com/matrix-org/synapse/blob/master/docs/user_directory.md
  1966. #
  1967. #user_directory:
  1968. # enabled: true
  1969. # search_all_users: false
  1970. # User Consent configuration
  1971. #
  1972. # for detailed instructions, see
  1973. # https://github.com/matrix-org/synapse/blob/master/docs/consent_tracking.md
  1974. #
  1975. # Parts of this section are required if enabling the 'consent' resource under
  1976. # 'listeners', in particular 'template_dir' and 'version'.
  1977. #
  1978. # 'template_dir' gives the location of the templates for the HTML forms.
  1979. # This directory should contain one subdirectory per language (eg, 'en', 'fr'),
  1980. # and each language directory should contain the policy document (named as
  1981. # '<version>.html') and a success page (success.html).
  1982. #
  1983. # 'version' specifies the 'current' version of the policy document. It defines
  1984. # the version to be served by the consent resource if there is no 'v'
  1985. # parameter.
  1986. #
  1987. # 'server_notice_content', if enabled, will send a user a "Server Notice"
  1988. # asking them to consent to the privacy policy. The 'server_notices' section
  1989. # must also be configured for this to work. Notices will *not* be sent to
  1990. # guest users unless 'send_server_notice_to_guests' is set to true.
  1991. #
  1992. # 'block_events_error', if set, will block any attempts to send events
  1993. # until the user consents to the privacy policy. The value of the setting is
  1994. # used as the text of the error.
  1995. #
  1996. # 'require_at_registration', if enabled, will add a step to the registration
  1997. # process, similar to how captcha works. Users will be required to accept the
  1998. # policy before their account is created.
  1999. #
  2000. # 'policy_name' is the display name of the policy users will see when registering
  2001. # for an account. Has no effect unless `require_at_registration` is enabled.
  2002. # Defaults to "Privacy Policy".
  2003. #
  2004. #user_consent:
  2005. # template_dir: res/templates/privacy
  2006. # version: 1.0
  2007. # server_notice_content:
  2008. # msgtype: m.text
  2009. # body: >-
  2010. # To continue using this homeserver you must review and agree to the
  2011. # terms and conditions at %(consent_uri)s
  2012. # send_server_notice_to_guests: true
  2013. # block_events_error: >-
  2014. # To continue using this homeserver you must review and agree to the
  2015. # terms and conditions at %(consent_uri)s
  2016. # require_at_registration: false
  2017. # policy_name: Privacy Policy
  2018. #
  2019. # Local statistics collection. Used in populating the room directory.
  2020. #
  2021. # 'bucket_size' controls how large each statistics timeslice is. It can
  2022. # be defined in a human readable short form -- e.g. "1d", "1y".
  2023. #
  2024. # 'retention' controls how long historical statistics will be kept for.
  2025. # It can be defined in a human readable short form -- e.g. "1d", "1y".
  2026. #
  2027. #
  2028. #stats:
  2029. # enabled: true
  2030. # bucket_size: 1d
  2031. # retention: 1y
  2032. # Server Notices room configuration
  2033. #
  2034. # Uncomment this section to enable a room which can be used to send notices
  2035. # from the server to users. It is a special room which cannot be left; notices
  2036. # come from a special "notices" user id.
  2037. #
  2038. # If you uncomment this section, you *must* define the system_mxid_localpart
  2039. # setting, which defines the id of the user which will be used to send the
  2040. # notices.
  2041. #
  2042. # It's also possible to override the room name, the display name of the
  2043. # "notices" user, and the avatar for the user.
  2044. #
  2045. #server_notices:
  2046. # system_mxid_localpart: notices
  2047. # system_mxid_display_name: "Server Notices"
  2048. # system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
  2049. # room_name: "Server Notices"
  2050. # Uncomment to disable searching the public room list. When disabled
  2051. # blocks searching local and remote room lists for local and remote
  2052. # users by always returning an empty list for all queries.
  2053. #
  2054. #enable_room_list_search: false
  2055. # The `alias_creation` option controls who's allowed to create aliases
  2056. # on this server.
  2057. #
  2058. # The format of this option is a list of rules that contain globs that
  2059. # match against user_id, room_id and the new alias (fully qualified with
  2060. # server name). The action in the first rule that matches is taken,
  2061. # which can currently either be "allow" or "deny".
  2062. #
  2063. # Missing user_id/room_id/alias fields default to "*".
  2064. #
  2065. # If no rules match the request is denied. An empty list means no one
  2066. # can create aliases.
  2067. #
  2068. # Options for the rules include:
  2069. #
  2070. # user_id: Matches against the creator of the alias
  2071. # alias: Matches against the alias being created
  2072. # room_id: Matches against the room ID the alias is being pointed at
  2073. # action: Whether to "allow" or "deny" the request if the rule matches
  2074. #
  2075. # The default is:
  2076. #
  2077. #alias_creation_rules:
  2078. # - user_id: "*"
  2079. # alias: "*"
  2080. # room_id: "*"
  2081. # action: allow
  2082. # The `room_list_publication_rules` option controls who can publish and
  2083. # which rooms can be published in the public room list.
  2084. #
  2085. # The format of this option is the same as that for
  2086. # `alias_creation_rules`.
  2087. #
  2088. # If the room has one or more aliases associated with it, only one of
  2089. # the aliases needs to match the alias rule. If there are no aliases
  2090. # then only rules with `alias: *` match.
  2091. #
  2092. # If no rules match the request is denied. An empty list means no one
  2093. # can publish rooms.
  2094. #
  2095. # Options for the rules include:
  2096. #
  2097. # user_id: Matches agaisnt the creator of the alias
  2098. # room_id: Matches against the room ID being published
  2099. # alias: Matches against any current local or canonical aliases
  2100. # associated with the room
  2101. # action: Whether to "allow" or "deny" the request if the rule matches
  2102. #
  2103. # The default is:
  2104. #
  2105. #room_list_publication_rules:
  2106. # - user_id: "*"
  2107. # alias: "*"
  2108. # room_id: "*"
  2109. # action: allow
  2110. # Server admins can define a Python module that implements extra rules for
  2111. # allowing or denying incoming events. In order to work, this module needs to
  2112. # override the methods defined in synapse/events/third_party_rules.py.
  2113. #
  2114. # This feature is designed to be used in closed federations only, where each
  2115. # participating server enforces the same rules.
  2116. #
  2117. #third_party_event_rules:
  2118. # module: "my_custom_project.SuperRulesSet"
  2119. # config:
  2120. # example_option: 'things'
  2121. ## Opentracing ##
  2122. # These settings enable opentracing, which implements distributed tracing.
  2123. # This allows you to observe the causal chains of events across servers
  2124. # including requests, key lookups etc., across any server running
  2125. # synapse or any other other services which supports opentracing
  2126. # (specifically those implemented with Jaeger).
  2127. #
  2128. opentracing:
  2129. # tracing is disabled by default. Uncomment the following line to enable it.
  2130. #
  2131. #enabled: true
  2132. # The list of homeservers we wish to send and receive span contexts and span baggage.
  2133. # See docs/opentracing.rst
  2134. # This is a list of regexes which are matched against the server_name of the
  2135. # homeserver.
  2136. #
  2137. # By defult, it is empty, so no servers are matched.
  2138. #
  2139. #homeserver_whitelist:
  2140. # - ".*"
  2141. # Jaeger can be configured to sample traces at different rates.
  2142. # All configuration options provided by Jaeger can be set here.
  2143. # Jaeger's configuration mostly related to trace sampling which
  2144. # is documented here:
  2145. # https://www.jaegertracing.io/docs/1.13/sampling/.
  2146. #
  2147. #jaeger_config:
  2148. # sampler:
  2149. # type: const
  2150. # param: 1
  2151. # Logging whether spans were started and reported
  2152. #
  2153. # logging:
  2154. # false
  2155. ## Workers ##
  2156. # Disables sending of outbound federation transactions on the main process.
  2157. # Uncomment if using a federation sender worker.
  2158. #
  2159. #send_federation: false
  2160. # It is possible to run multiple federation sender workers, in which case the
  2161. # work is balanced across them.
  2162. #
  2163. # This configuration must be shared between all federation sender workers, and if
  2164. # changed all federation sender workers must be stopped at the same time and then
  2165. # started, to ensure that all instances are running with the same config (otherwise
  2166. # events may be dropped).
  2167. #
  2168. #federation_sender_instances:
  2169. # - federation_sender1
  2170. # When using workers this should be a map from `worker_name` to the
  2171. # HTTP replication listener of the worker, if configured.
  2172. #
  2173. #instance_map:
  2174. # worker1:
  2175. # host: localhost
  2176. # port: 8034
  2177. # Experimental: When using workers you can define which workers should
  2178. # handle event persistence and typing notifications. Any worker
  2179. # specified here must also be in the `instance_map`.
  2180. #
  2181. #stream_writers:
  2182. # events: worker1
  2183. # typing: worker1
  2184. # Configuration for Redis when using workers. This *must* be enabled when
  2185. # using workers (unless using old style direct TCP configuration).
  2186. #
  2187. redis:
  2188. # Uncomment the below to enable Redis support.
  2189. #
  2190. #enabled: true
  2191. # Optional host and port to use to connect to redis. Defaults to
  2192. # localhost and 6379
  2193. #
  2194. #host: localhost
  2195. #port: 6379
  2196. # Optional password if configured on the Redis instance
  2197. #
  2198. #password: <secret_password>