a96a3a69a1
linkding_auth.sh persists ADMIN_USER and ADMIN_PASSWORD when the first admin is created, and keeps the password in step on later resets of that account, but linkding.config declared neither — so both writes were no-ops and the WebUI credentials card never had anything to show. Predates the slot work; it only became visible once authPersistCfg started warning instead of failing silently. Added empty rather than RANDOMIZED*, because unlike bookstack or nextcloud nothing seeds a linkding account at install — the first user is created from the WebUI. A generated password would name an account that does not exist, and the card would display a password that cannot log in. Unslotted for the same reason: the slot number marks a value the installer generates, and this one is written at runtime by the tool. No AUTH_PROFILE key: nothing reads it (it exists only in a comment in auth_adapter.sh), and adding an unread key is what was just cleaned up elsewhere. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
109 lines
4.4 KiB
YAML
109 lines
4.4 KiB
YAML
# Synapse homeserver configuration.
|
|
#
|
|
# Copied to <app dir>/data/homeserver.yaml by matrix_install_post_compose, which
|
|
# substitutes the *_PLACEHOLDER values below. Edit the deployed copy, not this
|
|
# template — this one is only read at install time.
|
|
#
|
|
# Restart the container after editing: docker restart matrix-synapse
|
|
|
|
# server_name is permanent. It is signed into every event this server has ever
|
|
# sent and forms the second half of every user ID (@alice:<server_name>).
|
|
# Changing it later does not migrate anything — it orphans the whole database.
|
|
server_name: "SYNAPSE_SERVER_NAME_PLACEHOLDER"
|
|
|
|
# Where clients actually reach this server. Independent of server_name: on a
|
|
# LAN or WireGuard-only install this is http://<ip>:<port> while server_name
|
|
# stays whatever permanent identity you chose. Adding TLS later means changing
|
|
# only this line.
|
|
public_baseurl: "SYNAPSE_PUBLIC_BASEURL_PLACEHOLDER"
|
|
pid_file: /data/homeserver.pid
|
|
|
|
# Serve /.well-known/matrix/server ourselves, advertising port 443. Federation
|
|
# otherwise defaults to port 8448 on server_name, which Traefik is not
|
|
# listening on. Only switched on for a real HTTPS deployment — advertising
|
|
# <server_name>:443 from an install that is only reachable at http://<ip>:<port>
|
|
# would just invite other servers to connect somewhere that cannot answer.
|
|
serve_server_wellknown: SYNAPSE_SERVE_WELLKNOWN_PLACEHOLDER
|
|
|
|
listeners:
|
|
# Port 8008 is the container-internal port and is deliberately hardcoded: it
|
|
# is what CFG_MATRIX_PORT_1 declares as the internal half of its mapping, and
|
|
# what the Traefik service label points at. Change one and you must change all
|
|
# three.
|
|
- port: 8008
|
|
tls: false
|
|
type: http
|
|
# Traefik terminates TLS and proxies onward, so the source address Synapse
|
|
# sees is Traefik's. Without this, rate limiting and the audit log would
|
|
# attribute every request in the world to a single internal IP.
|
|
x_forwarded: true
|
|
bind_addresses: ['0.0.0.0']
|
|
resources:
|
|
- names: [client, federation]
|
|
compress: false
|
|
|
|
database:
|
|
name: psycopg2
|
|
args:
|
|
user: synapse
|
|
password: "SYNAPSE_DB_PASSWORD_PLACEHOLDER"
|
|
dbname: synapse
|
|
host: matrix-postgres
|
|
port: 5432
|
|
cp_min: 5
|
|
cp_max: 10
|
|
|
|
log_config: "/data/log.yaml"
|
|
media_store_path: /data/media_store
|
|
signing_key_path: "/data/signing.key"
|
|
|
|
# Uploads. Raise max_upload_size if your users share video; remember the
|
|
# reverse proxy has its own limit too.
|
|
max_upload_size: 50M
|
|
|
|
# Open registration is off by default: a reachable homeserver with registration
|
|
# enabled will be found and used for spam within days. The install creates one
|
|
# admin account for you; invite everyone else, or turn this on deliberately via
|
|
# CFG_MATRIX_ENABLE_REGISTRATION and re-run the install.
|
|
enable_registration: SYNAPSE_ENABLE_REGISTRATION_PLACEHOLDER
|
|
enable_registration_without_verification: SYNAPSE_ENABLE_REGISTRATION_PLACEHOLDER
|
|
|
|
registration_shared_secret: "SYNAPSE_REGISTRATION_SECRET_PLACEHOLDER"
|
|
macaroon_secret_key: "SYNAPSE_MACAROON_SECRET_PLACEHOLDER"
|
|
form_secret: "SYNAPSE_FORM_SECRET_PLACEHOLDER"
|
|
|
|
report_stats: false
|
|
suppress_key_server_warning: true
|
|
|
|
# Which servers to fetch other servers' signing keys from. matrix.org is the
|
|
# conventional default; federation still works if it is unreachable, just more
|
|
# slowly on first contact with a new server.
|
|
trusted_key_servers:
|
|
- server_name: "matrix.org"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Single sign-on against Authelia (optional)
|
|
# ---------------------------------------------------------------------------
|
|
# CFG_MATRIX_AUTHELIA must stay false — that switch puts Authelia's forward-auth
|
|
# in front of /_matrix, which breaks every client. Real SSO is done here
|
|
# instead, with Synapse as an OIDC client of Authelia.
|
|
#
|
|
# Register the client in Authelia's configuration.yml first, then uncomment and
|
|
# fill in the block below and restart the container.
|
|
#
|
|
# oidc_providers:
|
|
# - idp_id: authelia
|
|
# idp_name: "Authelia"
|
|
# issuer: "https://auth.<your domain>"
|
|
# client_id: "synapse"
|
|
# client_secret: "<the secret you set in Authelia>"
|
|
# scopes: ["openid", "profile", "email"]
|
|
# user_mapping_provider:
|
|
# config:
|
|
# localpart_template: "{{ user.preferred_username }}"
|
|
# display_name_template: "{{ user.name }}"
|
|
# email_template: "{{ user.email }}"
|
|
#
|
|
# The redirect URI to register in Authelia is:
|
|
# https://SYNAPSE_SERVER_NAME_PLACEHOLDER/_synapse/client/oidc/callback
|