matrix

   1 # vim:ft=yaml,et
   2 
   3 ## Server ##
   4 
   5 # The domain name of the server, with optional explicit port.
   6 # This is used by remote servers to connect to this server,
   7 # e.g. matrix.org, localhost:8080, etc.
   8 # This is also the last part of your UserID.
   9 #
  10 server_name: "matrix.rockstable.it"
  11 
  12 # When running as a daemon, the file to store the pid in
  13 pid_file: "/run/matrix-synapse/matrix-synapse.pid"
  14 
  15 # The path to the web client which will be served at /_matrix/client/
  16 # if 'webclient' is configured under the 'listeners' configuration.
  17 #
  18 #web_client_location: "/path/to/web/root"
  19 
  20 # The public-facing base URL that clients use to access this HS
  21 # (not including _matrix/...). This is the same URL a user would
  22 # enter into the 'custom HS URL' field on their client. If you
  23 # use synapse with a reverse proxy, this should be the URL to reach
  24 # synapse via the proxy.
  25 #public_baseurl: https://example.com/
  26 
  27 # Set the soft limit on the number of file descriptors synapse can use
  28 # Zero is used to indicate synapse should set the soft limit to the
  29 # hard limit.
  30 soft_file_limit: 0
  31 
  32 # CPU affinity mask. Setting this restricts the CPUs on which the
  33 # process will be scheduled. It is represented as a bitmask, with the
  34 # lowest order bit corresponding to the first logical CPU and the
  35 # highest order bit corresponding to the last logical CPU. Not all CPUs
  36 # may exist on a given system but a mask may specify more CPUs than are
  37 # present.
  38 #
  39 # For example:
  40 #    0x00000001  is processor #0,
  41 #    0x00000003  is processors #0 and #1,
  42 #    0xFFFFFFFF  is all processors (#0 through #31).
  43 #
  44 # Pinning a Python process to a single CPU is desirable, because Python
  45 # is inherently single-threaded due to the GIL, and can suffer a
  46 # 30-40% slowdown due to cache blow-out and thread context switching
  47 # if the scheduler happens to schedule the underlying threads across
  48 # different cores. See
  49 # https://www.mirantis.com/blog/improve-performance-python-programs-restricting-single-cpu/.
  50 #
  51 # cpu_affinity: 0xFFFFFFFF
  52 
  53 # Set to false to disable presence tracking on this homeserver.
  54 #
  55 #use_presence: False
  56 
  57 # Whether to require authentication to retrieve profile data (avatars,
  58 # display names) of other users through the client API. Defaults to
  59 # 'false'. Note that profile data is also available via the federation
  60 # API, so this setting is of limited value if federation is enabled on
  61 # the server.
  62 #
  63 #require_auth_for_profile_requests: True
  64 
  65 # If set to 'False', requires authentication to access the server's public rooms
  66 # directory through the client API. Defaults to 'True'.
  67 #
  68 #allow_public_rooms_without_auth: False
  69 
  70 # If set to 'False', forbids any other homeserver to fetch the server's public
  71 # rooms directory via federation. Defaults to 'True'.
  72 #
  73 #allow_public_rooms_over_federation: False
  74 
  75 # The default room version for newly created rooms.
  76 #
  77 # Known room versions are listed here:
  78 # https://matrix.org/docs/spec/#complete-list-of-room-versions
  79 #
  80 # For example, for room version 1, default_room_version should be set
  81 # to "1".
  82 #
  83 #default_room_version: "4"
  84 
  85 # The GC threshold parameters to pass to `gc.set_threshold`, if defined
  86 #gc_thresholds: [700, 10, 10]
  87 
  88 # Set the limit on the returned events in the timeline in the get
  89 # and sync operations. The default value is -1, means no upper limit.
  90 #filter_timeline_limit: 5000
  91 
  92 # Whether room invites to users on this server should be blocked
  93 # (except those sent by local server admins). The default is False.
  94 #block_non_admin_invites: True
  95 
  96 # Room searching
  97 #
  98 # If disabled, new messages will not be indexed for searching and users
  99 # will receive errors when searching for messages. Defaults to enabled.
 100 #
 101 #enable_search: False
 102 
 103 # Restrict federation to the following whitelist of domains.
 104 # N.B. we recommend also firewalling your federation listener to limit
 105 # inbound federation traffic as early as possible, rather than relying
 106 # purely on this application-layer restriction.  If not specified, the
 107 # default is to whitelist everything.
 108 #
 109 #federation_domain_whitelist:
 110 #  - lon.example.com
 111 #  - nyc.example.com
 112 #  - syd.example.com
 113 
 114 # Prevent federation requests from being sent to the following
 115 # blacklist IP address CIDR ranges. If this option is not specified, or
 116 # specified with an empty list, no ip range blacklist will be enforced.
 117 #
 118 # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
 119 # listed here, since they correspond to unroutable addresses.)
 120 #
 121 federation_ip_range_blacklist:
 122   - '127.0.0.0/8'
 123   - '10.0.0.0/8'
 124   - '172.16.0.0/12'
 125   - '192.168.0.0/16'
 126   - '100.64.0.0/10'
 127   - '169.254.0.0/16'
 128   - '::1/128'
 129   - 'fe80::/64'
 130   - 'fc00::/7'
 131 
 132 # List of ports that Synapse should listen on, their purpose and their
 133 # configuration.
 134 #
 135 # Options for each listener include:
 136 #
 137 #   port: the TCP port to bind to
 138 #
 139 #   bind_addresses: a list of local addresses to listen on. The default is
 140 #       'all local interfaces'.
 141 #
 142 #   type: the type of listener. Normally 'http', but other valid options are:
 143 #       'manhole' (see docs/manhole.md),
 144 #       'metrics' (see docs/metrics-howto.rst),
 145 #       'replication' (see docs/workers.rst).
 146 #
 147 #   tls: set to True to enable TLS for this listener. Will use the TLS
 148 #       key/cert specified in tls_private_key_path / tls_certificate_path.
 149 #
 150 #   x_forwarded: Only valid for an 'http' listener. Set to True to use the
 151 #       X-Forwarded-For header as the client IP. Useful when Synapse is
 152 #       behind a reverse-proxy.
 153 #
 154 #   resources: Only valid for an 'http' listener. A list of resources to host
 155 #       on this port. Options for each resource are:
 156 #
 157 #       names: a list of names of HTTP resources. See below for a list of
 158 #           valid resource names.
 159 #
 160 #       compress: set to True to enable HTTP comression for this resource.
 161 #
 162 #   additional_resources: Only valid for an 'http' listener. A map of
 163 #        additional endpoints which should be loaded via dynamic modules.
 164 #
 165 # Valid resource names are:
 166 #
 167 #   client: the client-server API (/_matrix/client), and the synapse admin
 168 #       API (/_synapse/admin). Also implies 'media' and 'static'.
 169 #
 170 #   consent: user consent forms (/_matrix/consent). See
 171 #       docs/consent_tracking.md.
 172 #
 173 #   federation: the server-server API (/_matrix/federation). Also implies
 174 #       'media', 'keys', 'openid'
 175 #
 176 #   keys: the key discovery API (/_matrix/keys).
 177 #
 178 #   media: the media API (/_matrix/media).
 179 #
 180 #   metrics: the metrics interface. See docs/metrics-howto.rst.
 181 #
 182 #   openid: OpenID authentication.
 183 #
 184 #   replication: the HTTP replication API (/_synapse/replication). See
 185 #       docs/workers.rst.
 186 #
 187 #   static: static resources under synapse/static (/_matrix/static). (Mostly
 188 #       useful for 'fallback authentication'.)
 189 #
 190 #   webclient: A web client. Requires web_client_location to be set.
 191 #
 192 listeners:
 193   # TLS-enabled listener: for when matrix traffic is sent directly to synapse.
 194   #
 195   # Disabled by default. To enable it, uncomment the following. (Note that you
 196   # will also need to give Synapse a TLS key and certificate: see the TLS section
 197   # below.)
 198   #
 199   #- port: 8448
 200   #  # This is a 'http' listener, allows us to specify 'resources'.
 201   #  type: http
 202   #  tls: True
 203 
 204   #  # Local addresses to listen on.
 205   #  # On Linux and Mac OS, `::` will listen on all IPv4 and IPv6
 206   #  # addresses by default. For most other OSes, this will only listen
 207   #  # on IPv6.
 208   #  bind_addresses:
 209   #    - '::1'
 210   #    - '127.0.0.1'
 211   #    # - '::'
 212   #    # - '0.0.0.0'
 213 
 214   #  # Use the X-Forwarded-For (XFF) header as the client IP and not the
 215   #  # actual client IP.
 216   #  x_forwarded: False
 217 
 218   #  # List of HTTP resources to serve on this listener.
 219   #  resources:
 220   #    - names: federation
 221   #      compress: False
 222 
 223   # Unsecure HTTP listener:
 224   # For when matrix traffic passes through a reverse proxy that unwraps TLS.
 225   #
 226   # If you plan to use a reverse proxy, please see
 227   # https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.rst.
 228   #
 229   - port: 8008
 230     tls: False
 231     bind_addresses:
 232       - '::1'
 233       - '127.0.0.1'
 234       # - '::'
 235       # - '0.0.0.0'
 236     type: http
 237     # Use the X-Forwarded-For (XFF) header as the client IP and not the
 238     # actual client IP.
 239     x_forwarded: True
 240 
 241     # List of HTTP resources to serve on this listener.
 242     resources:
 243       - names: [client, federation]
 244         compress: True
 245 
 246     # example additional_resources:
 247     #
 248     #additional_resources:
 249     #  "/_matrix/my/custom/endpoint":
 250     #    module: my_module.CustomRequestHandler
 251     #    config: {}
 252 
 253   # Turn on the twisted ssh manhole service on localhost on the given
 254   # port.
 255   #- port: 9000
 256   #  bind_addresses:
 257   #    - '::1'
 258   #    - '127.0.0.1'
 259   #  type: manhole
 260 
 261 
 262 ## Homeserver blocking ##
 263 
 264 # How to reach the server admin, used in ResourceLimitError
 265 #
 266 #admin_contact: 'mailto:root@rockstable.it'
 267 
 268 # Global blocking
 269 #
 270 #hs_disabled: False
 271 #hs_disabled_message: 'Human readable reason for why the HS is blocked'
 272 #hs_disabled_limit_type: 'error code(str), to help clients decode reason'
 273 
 274 # Monthly Active User Blocking
 275 #
 276 # Used in cases where the admin or server owner wants to limit to the
 277 # number of monthly active users.
 278 #
 279 # 'limit_usage_by_mau' disables/enables monthly active user blocking. When
 280 # anabled and a limit is reached the server returns a 'ResourceLimitError'
 281 # with error type Codes.RESOURCE_LIMIT_EXCEEDED
 282 #
 283 # 'max_mau_value' is the hard limit of monthly active users above which
 284 # the server will start blocking user actions.
 285 #
 286 # 'mau_trial_days' is a means to add a grace period for active users. It
 287 # means that users must be active for this number of days before they
 288 # can be considered active and guards against the case where lots of users
 289 # sign up in a short space of time never to return after their initial
 290 # session.
 291 #
 292 #limit_usage_by_mau: False
 293 #max_mau_value: 50
 294 #mau_trial_days: 2
 295 
 296 # If enabled, the metrics for the number of monthly active users will
 297 # be populated, however no one will be limited. If limit_usage_by_mau
 298 # is True, this is implied to be true.
 299 #
 300 #mau_stats_only: False
 301 
 302 # Sometimes the server admin will want to ensure certain accounts are
 303 # never blocked by mau checking. These accounts are specified here.
 304 #
 305 #mau_limit_reserved_threepids:
 306 #  - medium: 'email'
 307 #    address: 'reserved_user@example.com'
 308 
 309 # Used by phonehome stats to group together related servers.
 310 #server_context: context
 311 
 312 # Whether to require a user to be in the room to add an alias to it.
 313 # Defaults to 'True'.
 314 #
 315 #require_membership_for_aliases: False
 316 
 317 # Whether to allow per-room membership profiles through the send of membership
 318 # events with profile information that differ from the target's global profile.
 319 # Defaults to 'True'.
 320 #
 321 #allow_per_room_profiles: False
 322 
 323 
 324 ## TLS ##
 325 
 326 # PEM-encoded X509 certificate for TLS.
 327 # This certificate, as of Synapse 1.0, will need to be a valid and verifiable
 328 # certificate, signed by a recognised Certificate Authority.
 329 #
 330 # See 'ACME support' below to enable auto-provisioning this certificate via
 331 # Let's Encrypt.
 332 #
 333 # If supplying your own, be sure to use a `.pem` file that includes the
 334 # full certificate chain including any intermediate certificates (for
 335 # instance, if using certbot, use `fullchain.pem` as your certificate,
 336 # not `cert.pem`).
 337 #
 338 tls_certificate_path: "/etc/letsencrypt/live/matrix.rockstable.it/fullchain.pem"
 339 
 340 # PEM-encoded private key for TLS
 341 tls_private_key_path: "/etc/letsencrypt/live/matrix.rockstable.it/privkey.pem"
 342 
 343 # PEM dh parameters for ephemeral keys
 344 tls_dh_params_path: "/etc/ssl/dhparam/dhparam_4096.pem"
 345 
 346 # Don't bind to the https port
 347 no_tls: False
 348 
 349 # Whether to verify TLS server certificates for outbound federation requests.
 350 #
 351 # Defaults to `True`. To disable certificate verification, uncomment the
 352 # following line.
 353 #
 354 #federation_verify_certificates: False
 355 
 356 # The minimum TLS version that will be used for outbound federation requests.
 357 #
 358 # Defaults to `1`. Configurable to `1`, `1.1`, `1.2`, or `1.3`. Note
 359 # that setting this value higher than `1.2` will prevent federation to most
 360 # of the public Matrix network: only configure it to `1.3` if you have an
 361 # entirely private federation setup and you can ensure TLS 1.3 support.
 362 #
 363 #federation_client_minimum_tls_version: 1.2
 364 
 365 # Skip federation certificate verification on the following whitelist
 366 # of domains.
 367 #
 368 # This setting should only be used in very specific cases, such as
 369 # federation over Tor hidden services and similar. For private networks
 370 # of homeservers, you likely want to use a private CA instead.
 371 #
 372 # Only effective if federation_verify_certicates is `True`.
 373 #
 374 #federation_certificate_verification_whitelist:
 375 #  - lon.example.com
 376 #  - *.domain.com
 377 #  - *.onion
 378 
 379 # List of custom certificate authorities for federation traffic.
 380 #
 381 # This setting should only normally be used within a private network of
 382 # homeservers.
 383 #
 384 # Note that this list will replace those that are provided by your
 385 # operating environment. Certificates must be in PEM format.
 386 #
 387 #federation_custom_ca_list:
 388 #  - myCA1.pem
 389 #  - myCA2.pem
 390 #  - myCA3.pem
 391 
 392 # ACME support: This will configure Synapse to request a valid TLS certificate
 393 # for your configured `server_name` via Let's Encrypt.
 394 #
 395 # Note that provisioning a certificate in this way requires port 80 to be
 396 # routed to Synapse so that it can complete the http-01 ACME challenge.
 397 # By default, if you enable ACME support, Synapse will attempt to listen on
 398 # port 80 for incoming http-01 challenges - however, this will likely fail
 399 # with 'Permission denied' or a similar error.
 400 #
 401 # There are a couple of potential solutions to this:
 402 #
 403 #  * If you already have an Apache, Nginx, or similar listening on port 80,
 404 #    you can configure Synapse to use an alternate port, and have your web
 405 #    server forward the requests. For example, assuming you set 'port: 8009'
 406 #    below, on Apache, you would write:
 407 #
 408 #    ProxyPass /.well-known/acme-challenge http://localhost:8009/.well-known/acme-challenge
 409 #
 410 #  * Alternatively, you can use something like `authbind` to give Synapse
 411 #    permission to listen on port 80.
 412 #
 413 acme:
 414     # ACME support is disabled by default. Uncomment the following line
 415     # (and tls_certificate_path and tls_private_key_path above) to enable it.
 416     #
 417     #enabled: True
 418 
 419     # Endpoint to use to request certificates. If you only want to test,
 420     # use Let's Encrypt's staging url:
 421     #     https://acme-staging.api.letsencrypt.org/directory
 422     #
 423     #url: https://acme-v01.api.letsencrypt.org/directory
 424 
 425     # Port number to listen on for the HTTP-01 challenge. Change this if
 426     # you are forwarding connections through Apache/Nginx/etc.
 427     #
 428     #port: 80
 429 
 430     # Local addresses to listen on for incoming connections.
 431     # Again, you may want to change this if you are forwarding connections
 432     # through Apache/Nginx/etc.
 433     #
 434     #bind_addresses: ['::', '0.0.0.0']
 435 
 436     # How many days remaining on a certificate before it is renewed.
 437     #
 438     #reprovision_threshold: 30
 439 
 440     # The domain that the certificate should be for. Normally this
 441     # should be the same as your Matrix domain (i.e., 'server_name'), but,
 442     # by putting a file at 'https://<server_name>/.well-known/matrix/server',
 443     # you can delegate incoming traffic to another server. If you do that,
 444     # you should give the target of the delegation here.
 445     #
 446     # For example: if your 'server_name' is 'example.com', but
 447     # 'https://example.com/.well-known/matrix/server' delegates to
 448     # 'matrix.example.com', you should put 'matrix.example.com' here.
 449     #
 450     # If not set, defaults to your 'server_name'.
 451     #
 452     #domain: matrix.example.com
 453 
 454     # file to use for the account key. This will be generated if it doesn't
 455     # exist.
 456     #
 457     # If unspecified, we will use CONFDIR/client.key.
 458     #
 459     account_key_file: /var/lib/matrix-synapse/acme_account.key
 460 
 461 # List of allowed TLS fingerprints for this server to publish along
 462 # with the signing keys for this server. Other matrix servers that
 463 # make HTTPS requests to this server will check that the TLS
 464 # certificates returned by this server match one of the fingerprints.
 465 #
 466 # Synapse automatically adds the fingerprint of its own certificate
 467 # to the list. So if federation traffic is handled directly by synapse
 468 # then no modification to the list is required.
 469 #
 470 # If synapse is run behind a load balancer that handles the TLS then it
 471 # will be necessary to add the fingerprints of the certificates used by
 472 # the loadbalancers to this list if they are different to the one
 473 # synapse is using.
 474 #
 475 # Homeservers are permitted to cache the list of TLS fingerprints
 476 # returned in the key responses up to the "valid_until_ts" returned in
 477 # key. It may be necessary to publish the fingerprints of a new
 478 # certificate and wait until the "valid_until_ts" of the previous key
 479 # responses have passed before deploying it.
 480 #
 481 # You can calculate a fingerprint from a given TLS listener via:
 482 # openssl s_client -connect $host:$port < /dev/null 2> /dev/null |
 483 #   openssl x509 -outform DER | openssl sha256 -binary | base64 | tr -d '='
 484 # or by checking matrix.org/federationtester/api/report?server_name=$host
 485 #
 486 #tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
 487 
 488 
 489 ## Database ##
 490 
 491 database:
 492   # The database engine name
 493   name: "sqlite3"
 494   # Arguments to pass to the engine
 495   args:
 496     # Path to the database
 497     database: "/var/lib/matrix-synapse/homeserver.db"
 498 
 499 # Number of events to cache in memory.
 500 event_cache_size: "10K"
 501 
 502 
 503 ## Logging ##
 504 
 505 # A yaml python logging config file
 506 log_config: "/etc/matrix-synapse/log.yaml"
 507 
 508 
 509 ## Ratelimiting ##
 510 
 511 # Ratelimiting settings for client actions (registration, login, messaging).
 512 #
 513 # Each ratelimiting configuration is made of two parameters:
 514 #   - per_second: number of requests a client can send per second.
 515 #   - burst_count: number of requests a client can send before being throttled.
 516 #
 517 # Synapse currently uses the following configurations:
 518 #   - one for messages that ratelimits sending based on the account the client
 519 #     is using
 520 #   - one for registration that ratelimits registration requests based on the
 521 #     client's IP address.
 522 #   - one for login that ratelimits login requests based on the client's IP
 523 #     address.
 524 #   - one for login that ratelimits login requests based on the account the
 525 #     client is attempting to log into.
 526 #   - one for login that ratelimits login requests based on the account the
 527 #     client is attempting to log into, based on the amount of failed login
 528 #     attempts for this account.
 529 #
 530 # The defaults are as shown below.
 531 #
 532 #rc_message:
 533 #  per_second: 0.2
 534 #  burst_count: 10
 535 #
 536 #rc_registration:
 537 #  per_second: 0.17
 538 #  burst_count: 3
 539 #
 540 #rc_login:
 541 #  address:
 542 #    per_second: 0.17
 543 #    burst_count: 3
 544 #  account:
 545 #    per_second: 0.17
 546 #    burst_count: 3
 547 #  failed_attempts:
 548 #    per_second: 0.17
 549 #    burst_count: 3
 550 
 551 
 552 # Ratelimiting settings for incoming federation
 553 #
 554 # The rc_federation configuration is made up of the following settings:
 555 #   - window_size: window size in milliseconds
 556 #   - sleep_limit: number of federation requests from a single server in
 557 #     a window before the server will delay processing the request.
 558 #   - sleep_delay: duration in milliseconds to delay processing events
 559 #     from remote servers by if they go over the sleep limit.
 560 #   - reject_limit: maximum number of concurrent federation requests
 561 #     allowed from a single server
 562 #   - concurrent: number of federation requests to concurrently process
 563 #     from a single server
 564 #
 565 # The defaults are as shown below.
 566 #
 567 #rc_federation:
 568 #  window_size: 1000
 569 #  sleep_limit: 10
 570 #  sleep_delay: 500
 571 #  reject_limit: 50
 572 #  concurrent: 3
 573 
 574 # Target outgoing federation transaction frequency for sending read-receipts,
 575 # per-room.
 576 #
 577 # If we end up trying to send out more read-receipts, they will get buffered up
 578 # into fewer transactions.
 579 #
 580 #federation_rr_transactions_per_room_per_second: 50
 581 
 582 
 583 # Directory where uploaded images and attachments are stored.
 584 media_store_path: "/var/lib/matrix-synapse/media"
 585 #media_store_path: "/var/lib/matrix-synapse/media_store"
 586 
 587 # Media storage providers allow media to be stored in different
 588 # locations.
 589 #media_storage_providers:
 590 #  - module: file_system
 591 #    # Whether to write new local files.
 592 #    store_local: False
 593 #    # Whether to write new remote media
 594 #    store_remote: False
 595 #    # Whether to block upload requests waiting for write to this
 596 #    # provider to complete
 597 #    store_synchronous: False
 598 #    config:
 599 #       directory: /mnt/some/other/directory
 600 
 601 # Directory where in-progress uploads are stored.
 602 uploads_path: "/var/lib/matrix-synapse/uploads"
 603 
 604 # The largest allowed upload size in bytes
 605 max_upload_size: "20M"
 606 
 607 # Maximum number of pixels that will be thumbnailed
 608 max_image_pixels: "32M"
 609 
 610 # Whether to generate new thumbnails on the fly to precisely match
 611 # the resolution requested by the client. If True then whenever
 612 # a new resolution is requested by the client the server will
 613 # generate a new thumbnail. If False the server will pick a thumbnail
 614 # from a precalculated list.
 615 dynamic_thumbnails: False
 616 
 617 # List of thumbnails to precalculate when an image is uploaded.
 618 thumbnail_sizes:
 619   - width: 32
 620     height: 32
 621     method: crop
 622   - width: 96
 623     height: 96
 624     method: crop
 625   - width: 320
 626     height: 240
 627     method: scale
 628   - width: 640
 629     height: 480
 630     method: scale
 631   - width: 800
 632     height: 600
 633     method: scale
 634 
 635 # Is the preview URL API enabled?
 636 # 'False' by default: uncomment the following to enable it (and specify a
 637 # url_preview_ip_range_blacklist blacklist).
 638 url_preview_enabled: False
 639 
 640 # List of IP address CIDR ranges that the URL preview spider is denied
 641 # from accessing.  There are no defaults: you must explicitly
 642 # specify a list for URL previewing to work.  You should specify any
 643 # internal services in your network that you do not want synapse to try
 644 # to connect to, otherwise anyone in any Matrix room could cause your
 645 # synapse to issue arbitrary GET requests to your internal services,
 646 # causing serious security issues.
 647 #
 648 # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
 649 # listed here, since they correspond to unroutable addresses.)
 650 #
 651 # This must be specified if url_preview_enabled is set. It is recommended that
 652 # you uncomment the following list as a starting point.
 653 #
 654 url_preview_ip_range_blacklist:
 655   - '127.0.0.0/8'
 656   - '10.0.0.0/8'
 657   - '172.16.0.0/12'
 658   - '192.168.0.0/16'
 659   - '100.64.0.0/10'
 660   - '169.254.0.0/16'
 661   - '::1/128'
 662   - 'fe80::/64'
 663   - 'fc00::/7'
 664 
 665 # List of IP address CIDR ranges that the URL preview spider is allowed
 666 # to access even if they are specified in url_preview_ip_range_blacklist.
 667 # This is useful for specifying exceptions to wide-ranging blacklisted
 668 # target IP ranges - e.g. for enabling URL previews for a specific private
 669 # website only visible in your network.
 670 #
 671 #url_preview_ip_range_whitelist:
 672 #   - '192.168.1.1'
 673 
 674 # Optional list of URL matches that the URL preview spider is
 675 # denied from accessing.  You should use url_preview_ip_range_blacklist
 676 # in preference to this, otherwise someone could define a public DNS
 677 # entry that points to a private IP address and circumvent the blacklist.
 678 # This is more useful if you know there is an entire shape of URL that
 679 # you know that will never want synapse to try to spider.
 680 #
 681 # Each list entry is a dictionary of url component attributes as returned
 682 # by urlparse.urlsplit as applied to the absolute form of the URL.  See
 683 # https://docs.python.org/2/library/urlparse.html#urlparse.urlsplit
 684 # The values of the dictionary are treated as an filename match pattern
 685 # applied to that component of URLs, unless they start with a ^ in which
 686 # case they are treated as a regular expression match.  If all the
 687 # specified component matches for a given list item succeed, the URL is
 688 # blacklisted.
 689 #
 690 #url_preview_url_blacklist:
 691 #  # blacklist any URL with a username in its URI
 692 #  - username: '*'
 693 #
 694 #  # blacklist all *.google.com URLs
 695 #  - netloc: 'google.com'
 696 #  - netloc: '*.google.com'
 697 #
 698 #  # blacklist all plain HTTP URLs
 699 #  - scheme: 'http'
 700 #
 701 #  # blacklist http(s)://www.acme.com/foo
 702 #  - netloc: 'www.acme.com'
 703 #    path: '/foo'
 704 #
 705 #  # blacklist any URL with a literal IPv4 address
 706 #  - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
 707 
 708 # The largest allowed URL preview spidering size in bytes
 709 max_spider_size: "10M"
 710 
 711 
 712 ## Captcha ##
 713 # See docs/CAPTCHA_SETUP for full details of configuring this.
 714 
 715 # This Home Server's ReCAPTCHA public key.
 716 #recaptcha_public_key: "YOUR_PUBLIC_KEY"
 717 
 718 # This Home Server's ReCAPTCHA private key.
 719 #recaptcha_private_key: "YOUR_PRIVATE_KEY"
 720 
 721 # Enables ReCaptcha checks when registering, preventing signup
 722 # unless a captcha is answered. Requires a valid ReCaptcha
 723 # public/private key.
 724 enable_registration_captcha: False
 725 
 726 # A secret key used to bypass the captcha test entirely.
 727 #captcha_bypass_secret: "YOUR_SECRET_HERE"
 728 
 729 # The API endpoint to use for verifying m.login.recaptcha responses.
 730 recaptcha_siteverify_api: "https://www.google.com/recaptcha/api/siteverify"
 731 #recaptcha_siteverify_api: "https://www.recaptcha.net/recaptcha/api/siteverify"
 732 
 733 
 734 ## TURN ##
 735 
 736 # The public URIs of the TURN server to give to clients
 737 turn_uris: [
 738         "turn:coturn.rockstable.it:3478?transport=udp",
 739         "turn:coturn.rockstable.it:3478?transport=tcp",
 740         "turns:coturn.rockstable.it:5349?transport=udp",
 741         "turns:coturn.rockstable.it:5349?transport=tcp"
 742         ]
 743 
 744 # The shared secret used to compute passwords for the TURN server
 745 turn_shared_secret: "YOUR_SHARED_SECRET"
 746 
 747 # The Username and password if the TURN server needs them and
 748 # does not use a token
 749 #turn_username: "TURNSERVER_USERNAME"
 750 #turn_password: "TURNSERVER_PASSWORD"
 751 
 752 # How long generated TURN credentials last
 753 turn_user_lifetime: "1h"
 754 
 755 # Whether guests should be allowed to use the TURN server.
 756 # This defaults to True, otherwise VoIP will be unreliable for guests.
 757 # However, it does introduce a slight security risk as it allows users to
 758 # connect to arbitrary endpoints without having first signed up for a
 759 # valid account (e.g. by passing a CAPTCHA).
 760 turn_allow_guests: False
 761 
 762 
 763 ## Registration ##
 764 #
 765 # Registration can be rate-limited using the parameters in the "Ratelimiting"
 766 # section of this file.
 767 
 768 # Enable registration for new users.
 769 enable_registration: False
 770 
 771 # Optional account validity configuration. This allows for accounts to be denied
 772 # any request after a given period.
 773 #
 774 # ``enabled`` defines whether the account validity feature is enabled. Defaults
 775 # to False.
 776 #
 777 # ``period`` allows setting the period after which an account is valid
 778 # after its registration. When renewing the account, its validity period
 779 # will be extended by this amount of time. This parameter is required when using
 780 # the account validity feature.
 781 #
 782 # ``renew_at`` is the amount of time before an account's expiry date at which
 783 # Synapse will send an email to the account's email address with a renewal link.
 784 # This needs the ``email`` and ``public_baseurl`` configuration sections to be
 785 # filled.
 786 #
 787 # ``renew_email_subject`` is the subject of the email sent out with the renewal
 788 # link. ``%(app)s`` can be used as a placeholder for the ``app_name`` parameter
 789 # from the ``email`` section.
 790 #
 791 # Once this feature is enabled, Synapse will look for registered users without an
 792 # expiration date at startup and will add one to every account it found using the
 793 # current settings at that time.
 794 # This means that, if a validity period is set, and Synapse is restarted (it will
 795 # then derive an expiration date from the current validity period), and some time
 796 # after that the validity period changes and Synapse is restarted, the users'
 797 # expiration dates won't be updated unless their account is manually renewed. This
 798 # date will be randomly selected within a range [now + period - d ; now + period],
 799 # where d is equal to 10% of the validity period.
 800 #
 801 #account_validity:
 802 #  enabled: True
 803 #  period: 6w
 804 #  renew_at: 1w
 805 #  renew_email_subject: "Renew your %(app)s account"
 806 
 807 # Time that a user's session remains valid for, after they log in.
 808 #
 809 # Note that this is not currently compatible with guest logins.
 810 #
 811 # Note also that this is calculated at login time: changes are not applied
 812 # retrospectively to users who have already logged in.
 813 #
 814 # By default, this is infinite.
 815 #
 816 #session_lifetime: 24h
 817 
 818 # The user must provide all of the below types of 3PID when registering.
 819 #
 820 #registrations_require_3pid:
 821 #  - email
 822 #  - msisdn
 823 
 824 # Explicitly disable asking for MSISDNs from the registration
 825 # flow (overrides registrations_require_3pid if MSISDNs are set as required)
 826 #
 827 #disable_msisdn_registration: True
 828 
 829 # Mandate that users are only allowed to associate certain formats of
 830 # 3PIDs with accounts on this server.
 831 #
 832 #allowed_local_3pids:
 833 #  - medium: email
 834 #    pattern: '.*@matrix\.org'
 835 #  - medium: email
 836 #    pattern: '.*@vector\.im'
 837 #  - medium: msisdn
 838 #    pattern: '\+44'
 839 
 840 # Enable 3PIDs lookup requests to identity servers from this server.
 841 #
 842 #enable_3pid_lookup: True
 843 
 844 # If set, allows registration of standard or admin accounts by anyone who
 845 # has the shared secret, even if registration is otherwise disabled.
 846 registration_shared_secret: "<REGISTRATION_SECRET>"
 847 
 848 # Set the number of bcrypt rounds used to generate password hash.
 849 # Larger numbers increase the work factor needed to generate the hash.
 850 # The default number is 12 (which equates to 2^12 rounds).
 851 # N.B. that increasing this will exponentially increase the time required
 852 # to register or login - e.g. 24 => 2^24 rounds which will take >20 mins.
 853 bcrypt_rounds: 12
 854 
 855 # Allows users to register as guests without a password/email/etc, and
 856 # participate in rooms hosted on this server which have been made
 857 # accessible to anonymous users.
 858 allow_guest_access: False
 859 
 860 # The identity server which we suggest that clients should use when users log
 861 # in on this server.
 862 #
 863 # (By default, no suggestion is made, so it is left up to the client.
 864 # This setting is ignored unless public_baseurl is also set.)
 865 #
 866 #default_identity_server: https://matrix.org
 867 
 868 # The list of identity servers trusted to verify third party
 869 # identifiers by this server.
 870 #
 871 # Also defines the ID server which will be called when an account is
 872 # deactivated (one will be picked arbitrarily).
 873 #
 874 trusted_third_party_id_servers:
 875   - matrix.org
 876   - vector.im
 877   - riot.im
 878 
 879 # Users who register on this homeserver will automatically be joined
 880 # to these rooms
 881 #auto_join_rooms:
 882 #  - "#example:example.com"
 883 
 884 # Where auto_join_rooms are specified, setting this flag ensures that the
 885 # the rooms exist by creating them when the first user on the
 886 # homeserver registers.
 887 # Setting to False means that if the rooms are not manually created,
 888 # users cannot be auto-joined since they do not exist.
 889 #
 890 #autocreate_auto_join_rooms: True
 891 
 892 
 893 ## Metrics ###
 894 
 895 # Enable collection and rendering of performance metrics
 896 enable_metrics: False
 897 
 898 # Enable sentry integration
 899 # NOTE: While attempts are made to ensure that the logs don't contain
 900 # any sensitive information, this cannot be guaranteed. By enabling
 901 # this option the sentry server may therefore receive sensitive
 902 # information, and it in turn may then diseminate sensitive information
 903 # through insecure notification channels if so configured.
 904 #
 905 #sentry:
 906 #    dsn: "..."
 907 
 908 # Whether or not to report anonymized homeserver usage statistics.
 909 report_stats: True
 910 
 911 
 912 ## API Configuration ##
 913 
 914 # A list of event types that will be included in the room_invite_state
 915 room_invite_state_types:
 916   - "m.room.join_rules"
 917   - "m.room.canonical_alias"
 918   - "m.room.avatar"
 919   - "m.room.name"
 920   - "m.room.encryption"
 921 
 922 
 923 # A list of application service config files to use
 924 app_service_config_files:
 925   - /etc/mautrix-telegram/registration.yaml
 926 
 927 # Uncomment to enable tracking of application service IP addresses. Implicitly
 928 # enables MAU tracking for application service users.
 929 #
 930 #track_appservice_user_ips: True
 931 
 932 
 933 # a secret which is used to sign access tokens. If none is specified,
 934 # the registration_shared_secret is used, if one is given; otherwise,
 935 # a secret key is derived from the signing key.
 936 #
 937 #macaroon_secret_key: <PRIVATE STRING>
 938 macaroon_secret_key: "<MACAROON_SECRET>"
 939 
 940 # Used to enable access token expiration.
 941 expire_access_token: False
 942 
 943 # a secret which is used to calculate HMACs for form values, to stop
 944 # falsification of values. Must be specified for the User Consent
 945 # forms to work.
 946 #
 947 form_secret: "<FORM_SECRET>"
 948 
 949 ## Signing Keys ##
 950 
 951 # Path to the signing key to sign messages with
 952 signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"
 953 #signing_key_path: "/etc/matrix-synapse/matrix.rockstable.it.signing.key"
 954 
 955 # The keys that the server used to sign messages with but won't use
 956 # to sign new messages. E.g. it has lost its private key
 957 old_signing_keys: {}
 958 #old_signing_keys:
 959 #  "ed25519:auto":
 960 #    # Base64 encoded public key
 961 #    key: "The public part of your old signing key."
 962 #    # Millisecond POSIX timestamp when the key expired.
 963 #    expired_ts: 123456789123
 964 
 965 # How long key response published by this server is valid for.
 966 # Used to set the valid_until_ts in /key/v2 APIs.
 967 # Determines how quickly servers will query to check which keys
 968 # are still valid.
 969 key_refresh_interval: "1d"
 970 
 971 # The trusted servers to download signing keys from.
 972 #
 973 # When we need to fetch a signing key, each server is tried in parallel.
 974 #
 975 # Normally, the connection to the key server is validated via TLS certificates.
 976 # Additional security can be provided by configuring a `verify key`, which
 977 # will make synapse check that the response is signed by that key.
 978 #
 979 # This setting supercedes an older setting named `perspectives`. The old format
 980 # is still supported for backwards-compatibility, but it is deprecated.
 981 #
 982 # Options for each entry in the list include:
 983 #
 984 #    server_name: the name of the server. required.
 985 #
 986 #    verify_keys: an optional map from key id to base64-encoded public key.
 987 #       If specified, we will check that the response is signed by at least
 988 #       one of the given keys.
 989 #
 990 #    accept_keys_insecurely: a boolean. Normally, if `verify_keys` is unset,
 991 #       and federation_verify_certificates is not `True`, synapse will refuse
 992 #       to start, because this would allow anyone who can spoof DNS responses
 993 #       to masquerade as the trusted key server. If you know what you are doing
 994 #       and are sure that your network environment provides a secure connection
 995 #       to the key server, you can set this to `True` to override this
 996 #       behaviour.
 997 #
 998 # An example configuration might look like:
 999 #
1000 #trusted_key_servers:
1001 #  - server_name: "my_trusted_server.example.com"
1002 #    verify_keys:
1003 #      "ed25519:auto": "abcdefghijklmnopqrstuvwxyzabcdefghijklmopqr"
1004 #  - server_name: "my_other_trusted_server.example.com"
1005 #
1006 # The default configuration is:
1007 #
1008 #trusted_key_servers:
1009 #  - server_name: "matrix.org"
1010 
1011 
1012 # Enable SAML2 for registration and login. Uses pysaml2.
1013 #
1014 # `sp_config` is the configuration for the pysaml2 Service Provider.
1015 # See pysaml2 docs for format of config.
1016 #
1017 # Default values will be used for the 'entityid' and 'service' settings,
1018 # so it is not normally necessary to specify them unless you need to
1019 # override them.
1020 #
1021 # Once SAML support is enabled, a metadata file will be exposed at
1022 # https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
1023 # use to configure your SAML IdP with. Alternatively, you can manually configure
1024 # the IdP to use an ACS location of
1025 # https://<server>:<port>/_matrix/saml2/authn_response.
1026 #
1027 #saml2_config:
1028 #  sp_config:
1029 #    # point this to the IdP's metadata. You can use either a local file or
1030 #    # (preferably) a URL.
1031 #    metadata:
1032 #      #local: ["saml2/idp.xml"]
1033 #      remote:
1034 #        - url: https://our_idp/metadata.xml
1035 #
1036 #    # By default, the user has to go to our login page first. If you'd like to
1037 #    # allow IdP-initiated login, set 'allow_unsolicited: True' in a
1038 #    # 'service.sp' section:
1039 #    #
1040 #    #service:
1041 #    #  sp:
1042 #    #    allow_unsolicited: True
1043 #
1044 #    # The examples below are just used to generate our metadata xml, and you
1045 #    # may well not need it, depending on your setup. Alternatively you
1046 #    # may need a whole lot more detail - see the pysaml2 docs!
1047 #
1048 #    description: ["My awesome SP", "en"]
1049 #    name: ["Test SP", "en"]
1050 #
1051 #    organization:
1052 #      name: Example com
1053 #      display_name:
1054 #        - ["Example co", "en"]
1055 #      url: "http://example.com"
1056 #
1057 #    contact_person:
1058 #      - given_name: Bob
1059 #        sur_name: "the Sysadmin"
1060 #        email_address": ["admin@example.com"]
1061 #        contact_type": technical
1062 #
1063 #  # Instead of putting the config inline as above, you can specify a
1064 #  # separate pysaml2 configuration file:
1065 #  #
1066 #  config_path: "/etc/matrix-synapse/sp_conf.py"
1067 #
1068 #  # the lifetime of a SAML session. This defines how long a user has to
1069 #  # complete the authentication process, if allow_unsolicited is unset.
1070 #  # The default is 5 minutes.
1071 #  #
1072 #  # saml_session_lifetime: 5m
1073 
1074 
1075 # Enable CAS for registration and login.
1076 #cas_config:
1077 #   enabled: True
1078 #   server_url: "https://cas-server.com"
1079 #   service_url: "https://homeserver.domain.com:8448"
1080 #   #required_attributes:
1081 #   #    name: value
1082 
1083 
1084 # The JWT needs to contain a globally unique "sub" (subject) claim.
1085 #
1086 #jwt_config:
1087 #   enabled: True
1088 #   secret: "a secret"
1089 #   algorithm: "HS256"
1090 
1091 
1092 password_config:
1093    # Uncomment to disable password login
1094    #
1095    #enabled: False
1096 
1097    # Uncomment to disable authentication against the local password
1098    # database. This is ignored if `enabled` is False, and is only useful
1099    # if you have other password_providers.
1100    #
1101    #localdb_enabled: False
1102 
1103    # Uncomment and change to a secret random string for extra security.
1104    # DO NOT CHANGE THIS AFTER INITIAL SETUP!
1105    #pepper: "EVEN_MORE_SECRET"
1106 
1107 
1108 # Enable sending emails for password resets, notification events or
1109 # account expiry notices
1110 #
1111 # If your SMTP server requires authentication, the optional smtp_user &
1112 # smtp_pass variables should be used
1113 #
1114 #email:
1115 #   enable_notifs: False
1116 #   smtp_host: "localhost"
1117 #   smtp_port: 25 # SSL: 465, STARTTLS: 587
1118 #   smtp_user: "exampleusername"
1119 #   smtp_pass: "examplepassword"
1120 #   require_transport_security: False
1121 #   notif_from: "Your Friendly %(app)s Home Server <noreply@example.com>"
1122 #   app_name: Matrix
1123 #
1124 #   # Enable email notifications by default
1125 #   #
1126 #   notif_for_new_users: True
1127 #
1128 #   # Defining a custom URL for Riot is only needed if email notifications
1129 #   # should contain links to a self-hosted installation of Riot; when set
1130 #   # the "app_name" setting is ignored
1131 #   #
1132 #   riot_base_url: "http://localhost/riot"
1133 #
1134 #   # Enable sending password reset emails via the configured, trusted
1135 #   # identity servers
1136 #   #
1137 #   # IMPORTANT! This will give a malicious or overtaken identity server
1138 #   # the ability to reset passwords for your users! Make absolutely sure
1139 #   # that you want to do this! It is strongly recommended that password
1140 #   # reset emails be sent by the homeserver instead
1141 #   #
1142 #   # If this option is set to False and SMTP options have not been
1143 #   # configured, resetting user passwords via email will be disabled
1144 #   #
1145 #   #trust_identity_server_for_password_resets: False
1146 #
1147 #   # Configure the time that a validation email or text message code
1148 #   # will expire after sending
1149 #   #
1150 #   # This is currently used for password resets
1151 #   #
1152 #   #validation_token_lifetime: 1h
1153 #
1154 #   # Template directory. All template files should be stored within this
1155 #   # directory. If not set, default templates from within the Synapse
1156 #   # package will be used
1157 #   #
1158 #   # For the list of default templates, please see
1159 #   # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
1160 #   #
1161 #   #template_dir: res/templates
1162 #
1163 #   # Templates for email notifications
1164 #   #
1165 #   notif_template_html: notif_mail.html
1166 #   notif_template_text: notif_mail.txt
1167 #
1168 #   # Templates for account expiry notices
1169 #   #
1170 #   expiry_template_html: notice_expiry.html
1171 #   expiry_template_text: notice_expiry.txt
1172 #
1173 #   # Templates for password reset emails sent by the homeserver
1174 #   #
1175 #   #password_reset_template_html: password_reset.html
1176 #   #password_reset_template_text: password_reset.txt
1177 #
1178 #   # Templates for password reset success and failure pages that a user
1179 #   # will see after attempting to reset their password
1180 #   #
1181 #   #password_reset_template_success_html: password_reset_success.html
1182 #   #password_reset_template_failure_html: password_reset_failure.html
1183 
1184 
1185 #password_providers:
1186 #    - module: "ldap_auth_provider.LdapAuthProvider"
1187 #      config:
1188 #        enabled: True
1189 #        uri: "ldap://ldap.example.com:389"
1190 #        start_tls: True
1191 #        base: "ou=users,dc=example,dc=com"
1192 #        attributes:
1193 #           uid: "cn"
1194 #           mail: "email"
1195 #           name: "givenName"
1196 #        #bind_dn:
1197 #        #bind_password:
1198 #        #filter: "(objectClass=posixAccount)"
1199 
1200 
1201 
1202 # Clients requesting push notifications can either have the body of
1203 # the message sent in the notification poke along with other details
1204 # like the sender, or just the event ID and room ID (`event_id_only`).
1205 # If clients choose the former, this option controls whether the
1206 # notification request includes the content of the event (other details
1207 # like the sender are still included). For `event_id_only` push, it
1208 # has no effect.
1209 #
1210 # For modern android devices the notification content will still appear
1211 # because it is loaded by the app. iPhone, however will send a
1212 # notification saying only that a message arrived and who it came from.
1213 #
1214 #push:
1215 #  include_content: True
1216 
1217 
1218 #spam_checker:
1219 #  module: "my_custom_project.SuperSpamChecker"
1220 #  config:
1221 #    example_option: 'things'
1222 
1223 
1224 # Uncomment to allow non-server-admin users to create groups on this server
1225 enable_group_creation: True
1226 
1227 # If enabled, non server admins can only create groups with local parts
1228 # starting with this prefix
1229 #group_creation_prefix: "unofficial/"
1230 
1231 
1232 
1233 # User Directory configuration
1234 #
1235 # 'enabled' defines whether users can search the user directory. If
1236 # False then empty responses are returned to all queries. Defaults to
1237 # True.
1238 #
1239 # 'search_all_users' defines whether to search all users visible to your HS
1240 # when searching the user directory, rather than limiting to users visible
1241 # in public rooms.  Defaults to False.  If you set it True, you'll have to
1242 # rebuild the user_directory search indexes, see
1243 # https://github.com/matrix-org/synapse/blob/master/docs/user_directory.md
1244 #
1245 #user_directory:
1246 #  enabled: True
1247 #  search_all_users: False
1248 
1249 
1250 # User Consent configuration
1251 #
1252 # for detailed instructions, see
1253 # https://github.com/matrix-org/synapse/blob/master/docs/consent_tracking.md
1254 #
1255 # Parts of this section are required if enabling the 'consent' resource under
1256 # 'listeners', in particular 'template_dir' and 'version'.
1257 #
1258 # 'template_dir' gives the location of the templates for the HTML forms.
1259 # This directory should contain one subdirectory per language (eg, 'en', 'fr'),
1260 # and each language directory should contain the policy document (named as
1261 # '<version>.html') and a success page (success.html).
1262 #
1263 # 'version' specifies the 'current' version of the policy document. It defines
1264 # the version to be served by the consent resource if there is no 'v'
1265 # parameter.
1266 #
1267 # 'server_notice_content', if enabled, will send a user a "Server Notice"
1268 # asking them to consent to the privacy policy. The 'server_notices' section
1269 # must also be configured for this to work. Notices will *not* be sent to
1270 # guest users unless 'send_server_notice_to_guests' is set to True.
1271 #
1272 # 'block_events_error', if set, will block any attempts to send events
1273 # until the user consents to the privacy policy. The value of the setting is
1274 # used as the text of the error.
1275 #
1276 # 'require_at_registration', if enabled, will add a step to the registration
1277 # process, similar to how captcha works. Users will be required to accept the
1278 # policy before their account is created.
1279 #
1280 # 'policy_name' is the display name of the policy users will see when registering
1281 # for an account. Has no effect unless `require_at_registration` is enabled.
1282 # Defaults to "Privacy Policy".
1283 #
1284 #user_consent:
1285 #  template_dir: res/templates/privacy
1286 #  version: 1.0
1287 #  server_notice_content:
1288 #    msgtype: m.text
1289 #    body: >-
1290 #      To continue using this homeserver you must review and agree to the
1291 #      terms and conditions at %(consent_uri)s
1292 #  send_server_notice_to_guests: True
1293 #  block_events_error: >-
1294 #    To continue using this homeserver you must review and agree to the
1295 #    terms and conditions at %(consent_uri)s
1296 #  require_at_registration: False
1297 #  policy_name: Privacy Policy
1298 #
1299 
1300 
1301 
1302 # Local statistics collection. Used in populating the room directory.
1303 #
1304 # 'bucket_size' controls how large each statistics timeslice is. It can
1305 # be defined in a human readable short form -- e.g. "1d", "1y".
1306 #
1307 # 'retention' controls how long historical statistics will be kept for.
1308 # It can be defined in a human readable short form -- e.g. "1d", "1y".
1309 #
1310 #
1311 #stats:
1312 #   enabled: True
1313 #   bucket_size: 1d
1314 #   retention: 1y
1315 
1316 
1317 # Server Notices room configuration
1318 #
1319 # Uncomment this section to enable a room which can be used to send notices
1320 # from the server to users. It is a special room which cannot be left; notices
1321 # come from a special "notices" user id.
1322 #
1323 # If you uncomment this section, you *must* define the system_mxid_localpart
1324 # setting, which defines the id of the user which will be used to send the
1325 # notices.
1326 #
1327 # It's also possible to override the room name, the display name of the
1328 # "notices" user, and the avatar for the user.
1329 #
1330 #server_notices:
1331 #  system_mxid_localpart: notices
1332 #  system_mxid_display_name: "Server Notices"
1333 #  system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
1334 #  room_name: "Server Notices"
1335 
1336 
1337 
1338 # Uncomment to disable searching the public room list. When disabled
1339 # blocks searching local and remote room lists for local and remote
1340 # users by always returning an empty list for all queries.
1341 #
1342 #enable_room_list_search: False
1343 
1344 # The `alias_creation` option controls who's allowed to create aliases
1345 # on this server.
1346 #
1347 # The format of this option is a list of rules that contain globs that
1348 # match against user_id, room_id and the new alias (fully qualified with
1349 # server name). The action in the first rule that matches is taken,
1350 # which can currently either be "allow" or "deny".
1351 #
1352 # Missing user_id/room_id/alias fields default to "*".
1353 #
1354 # If no rules match the request is denied. An empty list means no one
1355 # can create aliases.
1356 #
1357 # Options for the rules include:
1358 #
1359 #   user_id: Matches against the creator of the alias
1360 #   alias: Matches against the alias being created
1361 #   room_id: Matches against the room ID the alias is being pointed at
1362 #   action: Whether to "allow" or "deny" the request if the rule matches
1363 #
1364 # The default is:
1365 #
1366 #alias_creation_rules:
1367 #  - user_id: "*"
1368 #    alias: "*"
1369 #    room_id: "*"
1370 #    action: allow
1371 
1372 # The `room_list_publication_rules` option controls who can publish and
1373 # which rooms can be published in the public room list.
1374 #
1375 # The format of this option is the same as that for
1376 # `alias_creation_rules`.
1377 #
1378 # If the room has one or more aliases associated with it, only one of
1379 # the aliases needs to match the alias rule. If there are no aliases
1380 # then only rules with `alias: *` match.
1381 #
1382 # If no rules match the request is denied. An empty list means no one
1383 # can publish rooms.
1384 #
1385 # Options for the rules include:
1386 #
1387 #   user_id: Matches agaisnt the creator of the alias
1388 #   room_id: Matches against the room ID being published
1389 #   alias: Matches against any current local or canonical aliases
1390 #            associated with the room
1391 #   action: Whether to "allow" or "deny" the request if the rule matches
1392 #
1393 # The default is:
1394 #
1395 #room_list_publication_rules:
1396 #  - user_id: "*"
1397 #    alias: "*"
1398 #    room_id: "*"
1399 #    action: allow
1400 
1401 
1402 # Server admins can define a Python module that implements extra rules for
1403 # allowing or denying incoming events. In order to work, this module needs to
1404 # override the methods defined in synapse/events/third_party_rules.py.
1405 #
1406 # This feature is designed to be used in closed federations only, where each
1407 # participating server enforces the same rules.
1408 #
1409 #third_party_event_rules:
1410 #  module: "my_custom_project.SuperRulesSet"
1411 #  config:
1412 #    example_option: 'things'
1413 
1414 
1415 ## Opentracing ##
1416 
1417 # These settings enable opentracing, which implements distributed tracing.
1418 # This allows you to observe the causal chains of events across servers
1419 # including requests, key lookups etc., across any server running
1420 # synapse or any other other services which supports opentracing
1421 # (specifically those implemented with Jaeger).
1422 #
1423 opentracing:
1424     # tracing is disabled by default. Uncomment the following line to enable it.
1425     #
1426     #enabled: True
1427 
1428     # The list of homeservers we wish to send and receive span contexts and span baggage.
1429     # See docs/opentracing.rst
1430     # This is a list of regexes which are matched against the server_name of the
1431     # homeserver.
1432     #
1433     # By defult, it is empty, so no servers are matched.
1434     #
1435     #homeserver_whitelist:
1436     #  - ".*"