# Synapse homeserver configuration.
#
# Copied to <app dir>/data/homeserver.yaml by matrix_install_post_compose, which
# substitutes the *_PLACEHOLDER values below. Edit the deployed copy, not this
# template — this one is only read at install time.
#
# Restart the container after editing:  docker restart matrix-synapse

# server_name is permanent. It is signed into every event this server has ever
# sent and forms the second half of every user ID (@alice:<server_name>).
# Changing it later does not migrate anything — it orphans the whole database.
server_name: "SYNAPSE_SERVER_NAME_PLACEHOLDER"

# Where clients actually reach this server. Independent of server_name: on a
# LAN or WireGuard-only install this is http://<ip>:<port> while server_name
# stays whatever permanent identity you chose. Adding TLS later means changing
# only this line.
public_baseurl: "SYNAPSE_PUBLIC_BASEURL_PLACEHOLDER"
pid_file: /data/homeserver.pid

# Serve /.well-known/matrix/server ourselves, advertising port 443. Federation
# otherwise defaults to port 8448 on server_name, which Traefik is not
# listening on. Only switched on for a real HTTPS deployment — advertising
# <server_name>:443 from an install that is only reachable at http://<ip>:<port>
# would just invite other servers to connect somewhere that cannot answer.
serve_server_wellknown: SYNAPSE_SERVE_WELLKNOWN_PLACEHOLDER

listeners:
  # Port 8008 is the container-internal port and is deliberately hardcoded: it
  # is what CFG_MATRIX_PORT_1 declares as the internal half of its mapping, and
  # what the Traefik service label points at. Change one and you must change all
  # three.
  - port: 8008
    tls: false
    type: http
    # Traefik terminates TLS and proxies onward, so the source address Synapse
    # sees is Traefik's. Without this, rate limiting and the audit log would
    # attribute every request in the world to a single internal IP.
    x_forwarded: true
    bind_addresses: ['0.0.0.0']
    resources:
      - names: [client, federation]
        compress: false

database:
  name: psycopg2
  args:
    user: synapse
    password: "SYNAPSE_DB_PASSWORD_PLACEHOLDER"
    dbname: synapse
    host: matrix-postgres
    port: 5432
    cp_min: 5
    cp_max: 10

log_config: "/data/log.config"
media_store_path: /data/media_store
signing_key_path: "/data/signing.key"

# Uploads. Raise max_upload_size if your users share video; remember the
# reverse proxy has its own limit too.
max_upload_size: 50M

# Open registration is off by default: a reachable homeserver with registration
# enabled will be found and used for spam within days. The install creates one
# admin account for you; invite everyone else, or turn this on deliberately via
# CFG_MATRIX_ENABLE_REGISTRATION and re-run the install.
enable_registration: SYNAPSE_ENABLE_REGISTRATION_PLACEHOLDER
enable_registration_without_verification: SYNAPSE_ENABLE_REGISTRATION_PLACEHOLDER

registration_shared_secret: "SYNAPSE_REGISTRATION_SECRET_PLACEHOLDER"
macaroon_secret_key: "SYNAPSE_MACAROON_SECRET_PLACEHOLDER"
form_secret: "SYNAPSE_FORM_SECRET_PLACEHOLDER"

report_stats: false
suppress_key_server_warning: true

# Which servers to fetch other servers' signing keys from. matrix.org is the
# conventional default; federation still works if it is unreachable, just more
# slowly on first contact with a new server.
trusted_key_servers:
  - server_name: "matrix.org"

# ---------------------------------------------------------------------------
# Single sign-on against Authelia (optional)
# ---------------------------------------------------------------------------
# CFG_MATRIX_AUTHELIA must stay false — that switch puts Authelia's forward-auth
# in front of /_matrix, which breaks every client. Real SSO is done here
# instead, with Synapse as an OIDC client of Authelia.
#
# Register the client in Authelia's configuration.yml first, then uncomment and
# fill in the block below and restart the container.
#
# oidc_providers:
#   - idp_id: authelia
#     idp_name: "Authelia"
#     issuer: "https://auth.<your domain>"
#     client_id: "synapse"
#     client_secret: "<the secret you set in Authelia>"
#     scopes: ["openid", "profile", "email"]
#     user_mapping_provider:
#       config:
#         localpart_template: "{{ user.preferred_username }}"
#         display_name_template: "{{ user.name }}"
#         email_template: "{{ user.email }}"
#
# The redirect URI to register in Authelia is:
#   https://SYNAPSE_SERVER_NAME_PLACEHOLDER/_synapse/client/oidc/callback