overmind
/
matrix-docker-ansible-deploy
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Fork 0
Code Issues 0 Releases 0 Wiki Activity
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
9927 Commits
12 Branches
946 MiB
 
 
Tree: e5574a405e
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'e5574a405e'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-synapse/defaults/main.yml

1651 lines
103 KiB
Raw Blame History 

  1. ---

  2. # Synapse is a Matrix homeserver

  3. # Project source code URL: https://github.com/element-hq/synapse

  4. 

  5. matrix_synapse_enabled: true

  6. 

  7. # Specifies which Github organization and repository name Synapse lives at.

  8. #

  9. # This influences:

  10. # - the Github Container Image registry that container images are pulled from (see `matrix_synapse_docker_image_name`)

  11. # - the git repository to code is pulled from when self-building is used (see `matrix_synapse_container_image_self_build_repo`)

  12. # - potentially other roles which need to reference the Synapse git repository

  13. #

  14. # A popular alternative value may be: `matrix-org/synapse`.

  15. # However, do note that the last Synapse version available there is v1.98.0.

  16. matrix_synapse_github_org_and_repo: element-hq/synapse

  17. 

  18. # renovate: datasource=docker depName=ghcr.io/element-hq/synapse

  19. matrix_synapse_version: v1.127.1

  20. 

  21. matrix_synapse_username: ''

  22. matrix_synapse_uid: ''

  23. matrix_synapse_gid: ''

  24. 

  25. matrix_synapse_container_image_self_build: false

  26. matrix_synapse_container_image_self_build_repo: "https://github.com/{{ matrix_synapse_github_org_and_repo }}.git"

  27. 

  28. # matrix_synapse_container_image_customizations_enabled controls whether a customized Synapse image will be built.

  29. #

  30. # We toggle this variable to `true` when certain features which require a custom build are enabled.

  31. # Feel free to toggle this to `true` yourself and specify build steps in `matrix_synapse_container_image_customizations_dockerfile_body_custom`.

  32. #

  33. # See:

  34. # - `roles/custom/matrix-synapse/templates/synapse/customizations/Dockerfile.j2`

  35. # - `matrix_synapse_container_image_customizations_dockerfile_body_custom`

  36. # - `matrix_synapse_docker_image_customized`

  37. # - `matrix_synapse_docker_image_final`

  38. matrix_synapse_container_image_customizations_enabled: |-

  39.   {{

  40.     matrix_synapse_container_image_customizations_s3_storage_provider_installation_enabled

  41.     or

  42.     matrix_synapse_container_image_customizations_templates_enabled

  43.     or

  44.     matrix_synapse_container_image_customizations_auto_accept_invite_installation_enabled

  45.   }}

  46. 

  47. # Controls whether custom build steps will be added to the Dockerfile for installing s3-storage-provider.

  48. # The version that will be installed is specified in `matrix_synapse_ext_synapse_s3_storage_provider_version`.

  49. matrix_synapse_container_image_customizations_s3_storage_provider_installation_enabled: "{{ matrix_synapse_ext_synapse_s3_storage_provider_enabled }}"

  50. 

  51. # Controls whether to install an old version of boto3 and botocore, to work around the following issue:

  52. # https://github.com/aws/aws-cli/issues/9214

  53. matrix_synapse_container_image_customizations_s3_storage_provider_installation_old_boto_workaround_enabled: true

  54. 

  55. # Controls whether to install libldapXX explicitly when installing s3-storage-provider.

  56. # This is to work around it potentially not being there (after `autoremove` invoked by other scripts cleans it up, etc.)

  57. #

  58. # Some scripts in the custom Dockerfile may install and then autoremove git/ssh/openssh-client.

  59. # This has the side-effect of removing the libldap library that s3-storage-provider depends upon indirectly (via psycopg2).

  60. #

  61. # If this should happen, s3-storage-provider (the `s3_media_upload` script) will fail to start with an error like this:

  62. # > Traceback (most recent call last):

  63. # >   File "/usr/local/bin/s3_media_upload", line 10, in <module>

  64. # >     import psycopg2

  65. # >   File "/usr/local/lib/python3.12/site-packages/psycopg2/__init__.py", line 51, in <module>

  66. # >     from psycopg2._psycopg import (                     # noqa

  67. # > ImportError: libldap-2.5.so.0: cannot open shared object file: No such file or directory

  68. #

  69. # The library (e.g. `/usr/lib/x86_64-linux-gnu/libldap-2.5.so.0`) appears to be available by default in the upstream Synapse image for some reason,

  70. # but it doesn't seem to be installed through a Debian package. Autoremoval would remove it, causing s3-storage-provider to fail.

  71. # Given that this is a dependency for s3-storage-provider (psycopg2), we prefer to install it explicitly.

  72. matrix_synapse_container_image_customizations_s3_storage_provider_installation_explicit_libldap_installation_enabled: true

  73. matrix_synapse_container_image_customizations_s3_storage_provider_installation_explicit_libldap_installation_package_name: libldap-2.5

  74. 

  75. # Controls whether custom build steps will be added to the Dockerfile for installing auto-accept-invite module.

  76. # The version that will be installed is specified in `matrix_synapse_ext_synapse_auto_accept_invite_version`.

  77. matrix_synapse_container_image_customizations_auto_accept_invite_installation_enabled: "{{ matrix_synapse_ext_synapse_auto_accept_invite_enabled }}"

  78. 

  79. # Controls whether custom build steps will be added to the Dockerfile for customizing the email templates used by Synapse.

  80. #

  81. # Example usage:

  82. #

  83. # ```yaml

  84. # matrix_synapse_container_image_customizations_templates_enabled: true

  85. # # The templates are expected to be in a `templates/` subdirectory in

  86. # matrix_synapse_container_image_customizations_templates_in_container_template_files_relative_path: templates/

  87. # matrix_synapse_container_image_customizations_templates_git_repository_url: git@github.com:organization/repository.git

  88. # matrix_synapse_container_image_customizations_templates_git_repository_branch: main

  89. # matrix_synapse_container_image_customizations_templates_git_repository_keyscan_enabled: true

  90. # matrix_synapse_container_image_customizations_templates_git_repository_keyscan_hostname: github.com

  91. # ```

  92. #

  93. # See: https://github.com/element-hq/synapse/blob/develop/docs/templates.md

  94. matrix_synapse_container_image_customizations_templates_enabled: false

  95. matrix_synapse_container_image_customizations_templates_in_container_base_path: /custom-templates

  96. matrix_synapse_container_image_customizations_templates_in_container_template_files_relative_path: ''

  97. matrix_synapse_container_image_customizations_templates_in_container_full_path: "{{ matrix_synapse_container_image_customizations_templates_in_container_base_path }}/{{ matrix_synapse_container_image_customizations_templates_in_container_template_files_relative_path }}"

  98. matrix_synapse_container_image_customizations_templates_git_repository_url: ''

  99. matrix_synapse_container_image_customizations_templates_git_repository_branch: main

  100. matrix_synapse_container_image_customizations_templates_git_repository_keyscan_enabled: false

  101. matrix_synapse_container_image_customizations_templates_git_repository_keyscan_hostname: ''

  102. 

  103. # matrix_synapse_container_image_customizations_dockerfile_body contains your custom Dockerfile steps

  104. # for building your customized Synapse image based on the original (upstream) image (`matrix_synapse_docker_image`).

  105. # A `FROM …` clause is included automatically so you don't have to.

  106. #

  107. # For this to take effect, you need to enable customizations (`matrix_synapse_container_image_customizations_enabled: true`).

  108. #

  109. # Example:

  110. # matrix_synapse_container_image_customizations_dockerfile_body_custom: |

  111. #  RUN echo 'This is a custom step for building the customized Docker image for Synapse.'

  112. #  RUN echo 'You can override matrix_synapse_container_image_customizations_dockerfile_body_custom to add your own steps.'

  113. #  RUN echo 'You do NOT need to include a FROM clause yourself.'

  114. matrix_synapse_container_image_customizations_dockerfile_body_custom: ''

  115. 

  116. matrix_synapse_docker_image: "{{ matrix_synapse_docker_image_registry_prefix }}{{ matrix_synapse_docker_image_name }}:{{ matrix_synapse_docker_image_tag }}"

  117. matrix_synapse_docker_image_name: "{{ matrix_synapse_github_org_and_repo }}"

  118. matrix_synapse_docker_image_tag: "{{ matrix_synapse_version }}"

  119. matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}"

  120. matrix_synapse_docker_image_registry_prefix: "{{ 'localhost/' if matrix_synapse_container_image_self_build else matrix_synapse_docker_image_registry_prefix_upstream }}"

  121. matrix_synapse_docker_image_registry_prefix_upstream: "{{ matrix_synapse_docker_image_registry_prefix_upstream_default }}"

  122. matrix_synapse_docker_image_registry_prefix_upstream_default: "ghcr.io/"

  123. 

  124. # matrix_synapse_docker_image_customized is the name of the locally built Synapse image

  125. # which adds various customizations on top of the original (upstream) Synapse image.

  126. # This image will be based on the upstream `matrix_synapse_docker_image` image, only if `matrix_synapse_container_image_customizations_enabled: true`.

  127. matrix_synapse_docker_image_customized: "localhost/matrixdotorg/synapse:{{ matrix_synapse_docker_image_tag }}-customized"

  128. 

  129. # Controls whether the customized image (`matrix_synapse_docker_image_customized`) is to be force-built without layer caching enabled.

  130. # This is useful if you've enabled customizations (e.g. `matrix_synapse_container_image_customizations_templates_enabled`),

  131. # which clone some branch of some repository, and you'd like for each Ansible run to pull new revisions from that branch.

  132. matrix_synapse_docker_image_customized_build_nocache: false

  133. 

  134. # Controls whether the customized image (`matrix_synapse_docker_image_customized`) is to be built, even if it already exists.

  135. # Related to: matrix_synapse_docker_image_customized_build_nocache

  136. matrix_synapse_docker_image_customized_force_source: "{{ matrix_synapse_docker_image_customized_build_nocache }}"

  137. 

  138. # matrix_synapse_docker_image_final holds the name of the Synapse image to run depending on whether or not customizations are enabled.

  139. matrix_synapse_docker_image_final: "{{ matrix_synapse_docker_image_customized if matrix_synapse_container_image_customizations_enabled else matrix_synapse_docker_image }} "

  140. 

  141. matrix_synapse_base_path: "{{ matrix_base_data_path }}/synapse"

  142. 

  143. matrix_synapse_docker_src_files_path: "{{ matrix_synapse_base_path }}/docker-src"

  144. matrix_synapse_customized_docker_src_files_path: "{{ matrix_synapse_base_path }}/customized-docker-src"

  145. matrix_synapse_config_dir_path: "{{ matrix_synapse_base_path }}/config"

  146. matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage"

  147. matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store"

  148. matrix_synapse_bin_path: "{{ matrix_synapse_base_path }}/bin"

  149. 

  150. matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext"

  151. 

  152. matrix_synapse_ext_s3_storage_provider_base_path: "{{ matrix_synapse_base_path }}/ext/s3-storage-provider"

  153. matrix_synapse_ext_s3_storage_provider_bin_path: "{{ matrix_synapse_ext_s3_storage_provider_base_path }}/bin"

  154. matrix_synapse_ext_s3_storage_provider_data_path: "{{ matrix_synapse_ext_s3_storage_provider_base_path }}/data"

  155. 

  156. matrix_synapse_container_client_api_port: 8008

  157. 

  158. matrix_synapse_container_federation_api_tls_port: 8448

  159. 

  160. matrix_synapse_container_federation_api_plain_port: 8048

  161. 

  162. # The base container network. It will be auto-created by this role if it doesn't exist already.

  163. matrix_synapse_container_network: ''

  164. 

  165. # A list of additional container networks that the container would be connected to.

  166. # The role does not create these networks, so make sure they already exist.

  167. # Use this to expose this container to another reverse proxy, which runs in a different container network.

  168. matrix_synapse_container_additional_networks: "{{ matrix_synapse_container_additional_networks_auto + matrix_synapse_container_additional_networks_custom }}"

  169. matrix_synapse_container_additional_networks_auto: []

  170. matrix_synapse_container_additional_networks_custom: []

  171. 

  172. # Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/{{ matrix_synapse_container_client_api_port }} in the container).

  173. #

  174. # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8008"), or empty string to not expose.

  175. matrix_synapse_container_client_api_host_bind_port: ''

  176. 

  177. # Controls whether the matrix-synapse container exposes the plain (unencrypted) Server/Server (Federation) API port (tcp/8048 in the container).

  178. #

  179. # Takes effect only if federation is enabled (matrix_synapse_federation_enabled).

  180. #

  181. # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8048"), or empty string to not expose.

  182. matrix_synapse_container_federation_api_plain_host_bind_port: ''

  183. 

  184. # Controls whether the matrix-synapse container exposes the tls (encrypted) Server/Server (Federation) API port (tcp/8448 in the container).

  185. #

  186. # Takes effect only if federation is enabled (matrix_synapse_federation_enabled)

  187. # and TLS support is enabled (matrix_synapse_tls_federation_listener_enabled).

  188. #

  189. # Takes an "<ip>:<port>" or "<port>" value (e.g. "8448"), or empty string to not expose.

  190. matrix_synapse_container_federation_api_tls_host_bind_port: ''

  191. 

  192. # Controls whether the matrix-synapse container exposes the metrics port (tcp/9100 in the container).

  193. #

  194. # Takes effect only if metrics are enabled (matrix_synapse_metrics_enabled).

  195. #

  196. # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9100"), or empty string to not expose.

  197. matrix_synapse_container_metrics_api_host_bind_port: ''

  198. 

  199. # Controls whether the matrix-synapse container exposes the manhole port (tcp/9000 in the container).

  200. #

  201. # Takes effect only if the manhole is enabled (matrix_synapse_manhole_enabled).

  202. #

  203. # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9100"), or empty string to not expose.

  204. matrix_synapse_container_manhole_api_host_bind_port: ''

  205. 

  206. # matrix_synapse_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the main Synapse worker.

  207. # See `../templates/labels.j2` for details.

  208. #

  209. # To inject your own other container labels, see `matrix_synapse_container_labels_additional_labels`.

  210. matrix_synapse_container_labels_traefik_enabled: true

  211. matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_synapse_container_network }}"

  212. matrix_synapse_container_labels_traefik_entrypoints: web-secure

  213. matrix_synapse_container_labels_traefik_tls_certResolver: default  # noqa var-naming

  214. matrix_synapse_container_labels_traefik_hostname: ''

  215. 

  216. # Controls whether a compression middleware will be injected into the middlewares list.

  217. # This compression middleware is supposed to be defined elsewhere (using labels or a File provider, etc.) and is merely referenced by this router.

  218. matrix_synapse_container_labels_traefik_compression_middleware_enabled: false

  219. matrix_synapse_container_labels_traefik_compression_middleware_name: ""

  220. 

  221. # Controls whether Matrix-related labels will be added.

  222. #

  223. # When set to false, variables like the following take no effect:

  224. # - `matrix_synapse_container_labels_public_client_api_enabled`

  225. # - `matrix_synapse_container_labels_public_client_synapse_client_api_enabled`

  226. # - `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled`

  227. # - `matrix_synapse_container_labels_public_federation_api_enabled`

  228. #

  229. # When workers are enabled, we do not capture these requests, because we can't route them appropriately.

  230. matrix_synapse_container_labels_matrix_related_labels_enabled: "{{ not matrix_synapse_workers_enabled }}"

  231. 

  232. # Controls whether labels will be added for handling the root (/) path on a public Traefik entrypoint.

  233. matrix_synapse_container_labels_public_client_root_enabled: true

  234. matrix_synapse_container_labels_public_client_root_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"

  235. matrix_synapse_container_labels_public_client_root_traefik_rule: "Host(`{{ matrix_synapse_container_labels_public_client_root_traefik_hostname }}`) && Path(`/`)"

  236. matrix_synapse_container_labels_public_client_root_traefik_priority: 0

  237. matrix_synapse_container_labels_public_client_root_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"

  238. matrix_synapse_container_labels_public_client_root_traefik_tls: "{{ matrix_synapse_container_labels_public_client_root_traefik_entrypoints != 'web' }}"

  239. matrix_synapse_container_labels_public_client_root_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  240. matrix_synapse_container_labels_public_client_root_redirection_enabled: false

  241. matrix_synapse_container_labels_public_client_root_redirection_url: ""

  242. 

  243. # Controls whether labels will be added that expose the Client-Server API on a public Traefik entrypoint.

  244. # Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.

  245. # See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`

  246. matrix_synapse_container_labels_public_client_api_enabled: true

  247. matrix_synapse_container_labels_public_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"

  248. matrix_synapse_container_labels_public_client_api_traefik_path_prefix: /_matrix

  249. matrix_synapse_container_labels_public_client_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_public_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_public_client_api_traefik_path_prefix }}`)"

  250. matrix_synapse_container_labels_public_client_api_traefik_priority: 0

  251. matrix_synapse_container_labels_public_client_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"

  252. matrix_synapse_container_labels_public_client_api_traefik_tls: "{{ matrix_synapse_container_labels_public_client_api_traefik_entrypoints != 'web' }}"

  253. matrix_synapse_container_labels_public_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  254. 

  255. # Controls whether labels will be added that expose the Client-Server API on the internal Traefik entrypoint.

  256. # This is similar to `matrix_synapse_container_labels_public_client_api_enabled`, but the entrypoint and intent is different.

  257. # Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.

  258. # See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`

  259. matrix_synapse_container_labels_internal_client_api_enabled: false

  260. matrix_synapse_container_labels_internal_client_api_traefik_path_prefix: "{{ matrix_synapse_container_labels_public_client_api_traefik_path_prefix }}"

  261. matrix_synapse_container_labels_internal_client_api_traefik_rule: "PathPrefix(`{{ matrix_synapse_container_labels_internal_client_api_traefik_path_prefix }}`)"

  262. matrix_synapse_container_labels_internal_client_api_traefik_priority: "{{ matrix_synapse_container_labels_public_client_api_traefik_priority }}"

  263. matrix_synapse_container_labels_internal_client_api_traefik_entrypoints: ""

  264. 

  265. # Controls whether labels will be added that expose the /_synapse/client paths

  266. # When workers are enabled, we do not capture these requests, because they may be load-balanaced to some specific worker.

  267. # Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.

  268. # See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`

  269. matrix_synapse_container_labels_public_client_synapse_client_api_enabled: true

  270. matrix_synapse_container_labels_public_client_synapse_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"

  271. matrix_synapse_container_labels_public_client_synapse_client_api_traefik_path_prefix: /_synapse/client

  272. matrix_synapse_container_labels_public_client_synapse_client_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_public_client_synapse_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_public_client_synapse_client_api_traefik_path_prefix }}`)"

  273. matrix_synapse_container_labels_public_client_synapse_client_api_traefik_priority: 0

  274. matrix_synapse_container_labels_public_client_synapse_client_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"

  275. matrix_synapse_container_labels_public_client_synapse_client_api_traefik_tls: "{{ matrix_synapse_container_labels_public_client_synapse_client_api_traefik_entrypoints != 'web' }}"

  276. matrix_synapse_container_labels_public_client_synapse_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  277. 

  278. # Controls whether labels will be added that expose the /_synapse/admin paths

  279. # Following these recommendations (https://github.com/element-hq/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.

  280. # Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.

  281. # See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`

  282. matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: false

  283. matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"

  284. matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin

  285. matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_path_prefix }}`)"

  286. matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_priority: 0

  287. matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"

  288. matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_tls: "{{ matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_entrypoints != 'web' }}"

  289. matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  290. 

  291. # Controls whether labels will be added that expose the /_synapse/admin paths on the internal Traefik entrypoint.

  292. # Following these recommendations (https://github.com/element-hq/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.

  293. # Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.

  294. 

  295. matrix_synapse_container_labels_internal_client_synapse_admin_api_enabled: false

  296. matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin

  297. matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_rule: "PathPrefix(`{{ matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_path_prefix }}`)"

  298. matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_priority: 0

  299. matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_entrypoints: ""

  300. 

  301. # Controls whether labels will be added that expose the Server-Server API (Federation API).

  302. # Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.

  303. # See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`

  304. matrix_synapse_container_labels_public_federation_api_enabled: "{{ matrix_synapse_federation_port_enabled }}"

  305. matrix_synapse_container_labels_public_federation_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"

  306. matrix_synapse_container_labels_public_federation_api_traefik_path_prefix: /_matrix

  307. matrix_synapse_container_labels_public_federation_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_public_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_public_federation_api_traefik_path_prefix }}`)"

  308. matrix_synapse_container_labels_public_federation_api_traefik_priority: 0

  309. matrix_synapse_container_labels_public_federation_api_traefik_entrypoints: ''

  310. # TLS is force-enabled here, because the spec (https://spec.matrix.org/v1.9/server-server-api/#tls) says that the federation API must use HTTPS.

  311. matrix_synapse_container_labels_public_federation_api_traefik_tls: true

  312. matrix_synapse_container_labels_public_federation_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  313. 

  314. # Controls whether labels will be added that expose metrics (see `matrix_synapse_metrics_proxying_enabled`) for the main Synapse process

  315. matrix_synapse_container_labels_public_metrics_enabled: "{{ matrix_synapse_metrics_enabled and matrix_synapse_metrics_proxying_enabled }}"

  316. matrix_synapse_container_labels_public_metrics_traefik_path: "{{ matrix_synapse_metrics_proxying_path_prefix }}/main-process"

  317. matrix_synapse_container_labels_public_metrics_traefik_rule: "Host(`{{ matrix_synapse_metrics_proxying_hostname }}`) && Path(`{{ matrix_synapse_container_labels_public_metrics_traefik_path }}`)"

  318. matrix_synapse_container_labels_public_metrics_traefik_priority: 0

  319. matrix_synapse_container_labels_public_metrics_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"

  320. matrix_synapse_container_labels_public_metrics_traefik_tls: "{{ matrix_synapse_container_labels_public_metrics_traefik_entrypoints != 'web' }}"

  321. matrix_synapse_container_labels_public_metrics_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  322. matrix_synapse_container_labels_public_metrics_middleware_basic_auth_enabled: false

  323. # See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users

  324. matrix_synapse_container_labels_public_metrics_middleware_basic_auth_users: ''

  325. 

  326. # matrix_synapse_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.

  327. # See `../templates/labels.j2` for details.

  328. #

  329. # Example:

  330. # matrix_synapse_container_labels_additional_labels: |

  331. #   my.label=1

  332. #   another.label="here"

  333. matrix_synapse_container_labels_additional_labels: ''

  334. 

  335. # A list of extra arguments to pass to the container

  336. # Also see `matrix_synapse_container_arguments`

  337. matrix_synapse_container_extra_arguments: []

  338. 

  339. # matrix_synapse_container_extra_arguments_auto is a list of extra arguments to pass to the container.

  340. # This list is managed by the playbook. You're not meant to override this variable.

  341. # If you'd like to inject your own arguments, see `matrix_synapse_container_extra_arguments`.

  342. matrix_synapse_container_extra_arguments_auto: []

  343. 

  344. # matrix_synapse_container_arguments holds the final list of extra arguments to pass to the container.

  345. # You're not meant to override this variable.

  346. # If you'd like to inject your own arguments, see `matrix_synapse_container_extra_arguments`.

  347. matrix_synapse_container_arguments: "{{ matrix_synapse_container_extra_arguments + matrix_synapse_container_extra_arguments_auto }}"

  348. 

  349. # matrix_synapse_container_master_extra_arguments contains arguments specific to the master process whereas

  350. # matrix_synapse_container_arguments contains arguments the apply to all Synapse containers (master and worker).

  351. matrix_synapse_container_master_extra_arguments: []

  352. 

  353. # List of systemd services that matrix-synapse.service depends on

  354. matrix_synapse_systemd_required_services_list: "{{ matrix_synapse_systemd_required_services_list_default + matrix_synapse_systemd_required_services_list_auto + matrix_synapse_systemd_required_services_list_custom }}"

  355. matrix_synapse_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"

  356. matrix_synapse_systemd_required_services_list_auto: []

  357. matrix_synapse_systemd_required_services_list_custom: []

  358. 

  359. # List of systemd services that matrix-synapse.service wants

  360. matrix_synapse_systemd_wanted_services_list: "{{ matrix_synapse_systemd_wanted_services_list_default + matrix_synapse_systemd_wanted_services_list_auto + matrix_synapse_systemd_wanted_services_list_custom }}"

  361. matrix_synapse_systemd_wanted_services_list_default: []

  362. matrix_synapse_systemd_wanted_services_list_auto: []

  363. matrix_synapse_systemd_wanted_services_list_custom: []

  364. 

  365. # List of systemd services that matrix-goofys.service depends on

  366. matrix_synapse_goofys_systemd_required_services_list: "{{ matrix_synapse_goofys_systemd_required_services_list_default + matrix_synapse_goofys_systemd_required_services_list_auto + matrix_synapse_goofys_systemd_required_services_list_custom }}"

  367. matrix_synapse_goofys_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"

  368. matrix_synapse_goofys_systemd_required_services_list_auto: []

  369. matrix_synapse_goofys_systemd_required_services_list_custom: []

  370. 

  371. # Controls how long to sleep for after starting the matrix-synapse container.

  372. #

  373. # Delaying, so that the homeserver can manage to fully start and various services

  374. # that depend on it (`matrix_synapse_systemd_required_services_list` and `matrix_synapse_systemd_wanted_services_list`)

  375. # may only start after the homeserver is up and running.

  376. #

  377. # This can be set to 0 to remove the delay.

  378. matrix_synapse_systemd_service_post_start_delay_seconds: 10

  379. 

  380. matrix_synapse_in_container_python_packages_path: "/usr/local/lib/python3.12/site-packages"

  381. 

  382. # Specifies which template files to use when configuring Synapse.

  383. # If you'd like to have your own different configuration, feel free to copy and paste

  384. # the original files into your inventory (e.g. in `inventory/host_vars/matrix.example.com/`)

  385. # and then change the specific host's `vars.yml` file like this:

  386. # matrix_synapse_template_synapse_homeserver: "{{ playbook_dir }}/inventory/host_vars/matrix.example.com/homeserver.yaml.j2"

  387. matrix_synapse_template_synapse_homeserver: "{{ role_path }}/templates/synapse/homeserver.yaml.j2"

  388. matrix_synapse_template_synapse_log: "{{ role_path }}/templates/synapse/synapse.log.config.j2"

  389. 

  390. matrix_synapse_public_baseurl: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_server_fqn_matrix }}/"

  391. 

  392. matrix_synapse_macaroon_secret_key: ""

  393. matrix_synapse_registration_shared_secret: "{{ matrix_synapse_macaroon_secret_key }}"

  394. matrix_synapse_allow_guest_access: false

  395. matrix_synapse_form_secret: "{{ matrix_synapse_macaroon_secret_key }}"

  396. 

  397. matrix_synapse_max_upload_size_mb: 50

  398. 

  399. # Controls whether local media should be removed under certain conditions, typically for the purpose of saving space.

  400. # should be empty to disable

  401. matrix_synapse_media_retention_local_media_lifetime:

  402. # Controls whether remote media cache (media that is downloaded from other homeservers)

  403. # should be removed under certain conditions, typically for the purpose of saving space.

  404. # should be empty to disable

  405. matrix_synapse_media_retention_remote_media_lifetime:

  406. 

  407. # Controls the list of additional oembed providers to be added to the homeserver.

  408. matrix_synapse_oembed_additional_providers: []

  409. 

  410. # Controls message retention policies

  411. matrix_synapse_retention_enabled: false

  412. # "A single var to control them all" - applied to all retention period vars, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"

  413. matrix_synapse_retention_period: ""

  414. # The default min lifetime, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"

  415. matrix_synapse_retention_default_policy_min_lifetime: "{{ matrix_synapse_retention_period }}"

  416. # The default max lifetime, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"

  417. matrix_synapse_retention_default_policy_max_lifetime: "{{ matrix_synapse_retention_period }}"

  418. # The allowed min lifetime, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"

  419. matrix_synapse_retention_allowed_lifetime_min: "{{ matrix_synapse_retention_period }}"

  420. # The allowed max lifetime, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"

  421. matrix_synapse_retention_allowed_lifetime_max: "{{ matrix_synapse_retention_period }}"

  422. # The list of the purge jobs, structure (all fields are optional, example below contains all available variants):

  423. # - longest_max_lifetime: "1d"

  424. #   shortest_max_lifetime: "1d"

  425. #   interval: "12h"

  426. # - longest_max_lifetime: "1d"

  427. # - shortest_max_lifetime: "1d"

  428. # - interval: "12h"

  429. matrix_synapse_retention_purge_jobs: []

  430. 

  431. # The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.

  432. matrix_synapse_tmp_directory_size_mb: "{{ matrix_synapse_max_upload_size_mb * 50 }}"

  433. 

  434. # Log levels

  435. # Possible options are defined here https://docs.python.org/3/library/logging.html#logging-levels

  436. # warning: setting log level to DEBUG will make synapse log sensitive information such

  437. # as access tokens.

  438. #

  439. # Increasing verbosity may lead to an excessive amount of log messages being generated,

  440. # some of which may get dropped by systemd-journald on certain distributions (like CentOS 7).

  441. # You can work around it by adding `RateLimitInterval=0` and `RateLimitBurst=0` under `[Storage]` in

  442. # `/etc/systemd/journald.conf` and restarting the logging service (`systemctl restart systemd-journald`).

  443. matrix_synapse_log_level: "WARNING"

  444. matrix_synapse_storage_sql_log_level: "WARNING"

  445. matrix_synapse_root_log_level: "WARNING"

  446. 

  447. # Rate limits

  448. matrix_synapse_rc_message:

  449.   per_second: 0.5

  450.   burst_count: 30

  451. 

  452. matrix_synapse_rc_registration:

  453.   per_second: 0.17

  454.   burst_count: 3

  455. 

  456. matrix_synapse_rc_login:

  457.   address:

  458.     per_second: 0.17

  459.     burst_count: 3

  460.   account:

  461.     per_second: 0.17

  462.     burst_count: 3

  463.   failed_attempts:

  464.     per_second: 0.17

  465.     burst_count: 3

  466. 

  467. matrix_synapse_rc_admin_redaction:

  468.   per_second: 1

  469.   burst_count: 50

  470. 

  471. matrix_synapse_rc_joins:

  472.   local:

  473.     per_second: 0.1

  474.     burst_count: 10

  475.   remote:

  476.     per_second: 0.01

  477.     burst_count: 10

  478. 

  479. 

  480. matrix_synapse_rc_invites:

  481.   per_room:

  482.     per_second: 0.3

  483.     burst_count: 10

  484.   per_user:

  485.     per_second: 0.003

  486.     burst_count: 5

  487.   per_issuer:

  488.     per_second: 0.3

  489.     burst_count: 10

  490. 

  491. 

  492. matrix_synapse_rc_federation:

  493.   window_size: 1000

  494.   sleep_limit: 10

  495.   sleep_delay: 500

  496.   reject_limit: 50

  497.   concurrent: 3

  498. 

  499. matrix_synapse_federation_rr_transactions_per_room_per_second: 50

  500. 

  501. # Controls the rate limit for delayed event management.

  502. #

  503. # This is only applied if `matrix_synapse_experimental_features_msc4140_enabled` is set to `true`.

  504. matrix_synapse_rc_delayed_event_mgmt:

  505.   per_second: 1

  506.   burst_count: 20

  507. 

  508. # Controls the templates directory setting.

  509. #

  510. # See:

  511. # - `matrix_synapse_container_image_customizations_templates_enabled`

  512. # - https://github.com/element-hq/synapse/blob/develop/docs/templates.md

  513. matrix_synapse_templates_custom_template_directory: "{{ matrix_synapse_container_image_customizations_templates_in_container_full_path if matrix_synapse_container_image_customizations_templates_enabled else '' }}"

  514. 

  515. # Controls whether the TLS federation listener is enabled (tcp/8448).

  516. # Only makes sense if federation is enabled (`matrix_synapse_federation_enabled`).

  517. # Note that federation may potentially be enabled as non-TLS on `matrix_synapse_container_federation_api_plain_port` as well.

  518. # If you're serving Synapse behind an HTTPS-capable reverse-proxy,

  519. # you can disable the TLS listener (`matrix_synapse_tls_federation_listener_enabled: false`).

  520. matrix_synapse_tls_federation_listener_enabled: true

  521. matrix_synapse_tls_certificate_path: "/data/{{ matrix_server_fqn_matrix }}.tls.crt"

  522. matrix_synapse_tls_private_key_path: "/data/{{ matrix_server_fqn_matrix }}.tls.key"

  523. 

  524. # Resource names used by the unsecure HTTP listener. Here only the Client API

  525. # is defined, see the homeserver config for a full list of valid resource

  526. # names.

  527. matrix_synapse_http_listener_resource_names: ["client"]

  528. 

  529. # Resources served on Synapse's federation port.

  530. # When disabling federation, we may wish to serve the `openid` resource here,

  531. # so that services like Dimension and ma1sd can work.

  532. matrix_synapse_federation_listener_resource_names: "{{ ['federation'] if matrix_synapse_federation_enabled else (['openid'] if matrix_synapse_federation_port_openid_resource_required else []) }}"

  533. 

  534. # Enable this to allow Synapse to report utilization statistics about your server to matrix.org

  535. # (things like number of users, number of messages sent, uptime, load, etc.)

  536. matrix_synapse_report_stats: false

  537. 

  538. # The endpoint to report homeserver usage statistics to.

  539. matrix_synapse_report_stats_endpoint: "https://matrix.org/report-usage-stats/push"

  540. 

  541. # Controls whether the Matrix server will track presence status (online, offline, unavailable) for users.

  542. # If users participate in large rooms with many other servers,

  543. # disabling this will decrease server load significantly.

  544. matrix_synapse_presence_enabled: true

  545. 

  546. # Controls whether accessing the server's public rooms directory can be done without authentication.

  547. # For private servers, you most likely wish to require authentication,

  548. # unless you know what list of rooms you're publishing to the world and explicitly want to do it.

  549. matrix_synapse_allow_public_rooms_without_auth: false

  550. 

  551. # Controls whether remote servers can fetch this server's public rooms directory via federation.

  552. # The upstream default is `false`, but we try to make Matrix federation more useful.

  553. #

  554. # For private servers, you may wish to forbid it to align yourself with upstream defaults.

  555. # However, disabling federation completely (see `matrix_synapse_federation_enabled`) is a better way to make your server private,

  556. # instead of relying on security-by-obscurity — federating with others, having your public rooms joinable by anyone,

  557. # but hiding them and thinking you've secured them.

  558. matrix_synapse_allow_public_rooms_over_federation: true

  559. 

  560. # Whether to require authentication to retrieve profile data (avatars,

  561. # display names) of other users through the client API. Defaults to

  562. # 'false'. Note that profile data is also available via the federation

  563. # API, so this setting is of limited value if federation is enabled on

  564. # the server.

  565. matrix_synapse_require_auth_for_profile_requests: false

  566. 

  567. # Set to true to require a user to share a room with another user in order

  568. # to retrieve their profile information. Only checked on Client-Server

  569. # requests. Profile requests from other servers should be checked by the

  570. # requesting server. Defaults to 'false'.

  571. matrix_synapse_limit_profile_requests_to_users_who_share_rooms: false

  572. 

  573. # Set to false to prevent a user's profile data from being retrieved and

  574. # displayed in a room until they have joined it. By default, a user's

  575. # profile data is included in an invite event, regardless of the values

  576. # of the above two settings, and whether or not the users share a server.

  577. # Defaults to 'true'.

  578. matrix_synapse_include_profile_data_on_invite: true

  579. 

  580. 

  581. # User search behaviour

  582. matrix_synapse_user_directory_search_all_users: false

  583. matrix_synapse_user_directory_prefer_local_users: false

  584. 

  585. # Controls whether people with access to the homeserver can register by themselves.

  586. matrix_synapse_enable_registration: false

  587. # Controls whether people with access to the homeserver can register by themselves without verification (email/msisdn/token)

  588. matrix_synapse_enable_registration_without_verification: false

  589. 

  590. # reCAPTCHA API for validating registration attempts

  591. matrix_synapse_enable_registration_captcha: false

  592. matrix_synapse_recaptcha_public_key: ''

  593. matrix_synapse_recaptcha_private_key: ''

  594. 

  595. # Requires an MSC3231 token for registration. Note that `matrix_synapse_enable_registration` must be set to `true`.

  596. # Tokens can be created via the API or through synapse-admin.

  597. # Disabling this option will not delete any tokens previously generated.

  598. matrix_synapse_registration_requires_token: false

  599. 

  600. # A list of 3PID types which users must supply when registering (possible values: email, msisdn).

  601. matrix_synapse_registrations_require_3pid: []

  602. 

  603. # Explicitly disable asking for MSISDNs from the registration

  604. # flow (overrides matrix_synapse_registrations_require_3pid if MSISDNs are set as required)

  605. matrix_synapse_disable_msisdn_registration: false

  606. 

  607. # A list of patterns 3pids must match in order to permit registration, e.g.:

  608. #  - medium: email

  609. #    pattern: '.*@example\.com'

  610. #  - medium: msisdn

  611. #    pattern: '\+44'

  612. matrix_synapse_allowed_local_3pids: []

  613. 

  614. # The server to use for phone number threepid validation. When empty, validation cannot happen, as Synapse doesn't support it.

  615. # To make it work, this should be pointed to an identity server.

  616. matrix_synapse_account_threepid_delegates_msisdn: ''

  617. 

  618. # Users who register on this homeserver will automatically be joined to these rooms.

  619. # Rooms are to be specified using addresses (e.g. `#address:example.com`)

  620. # If any auto-join rooms are invite-only, you need to define `matrix_synapse_auto_join_mxid_localpart`.

  621. matrix_synapse_auto_join_rooms: []

  622. 

  623. # Controls whether auto-join rooms (`matrix_synapse_auto_join_rooms`) are to be created

  624. # automatically if they don't already exist.

  625. matrix_synapse_autocreate_auto_join_rooms: true

  626. 

  627. # The local part of the user ID which is used to create auto-join rooms if `matrix_synapse_autocreate_auto_join_rooms` is true.

  628. # Defaults to the initial user account that registers.

  629. # The user ID is also used to invite new users to any auto-join rooms which are set to invite-only.

  630. matrix_synapse_auto_join_mxid_localpart: ''

  631. 

  632. # Controls whether room invites will be accepted on behalf of users.

  633. # See: https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#auto-accept-invites

  634. # This should not be used together with the `synapse_auto_accept_invite` module (see `matrix_synapse_ext_synapse_auto_accept_invite_enabled`).

  635. # Also see:

  636. # - `matrix_synapse_auto_accept_invites_only_for_direct_messages`

  637. # - `matrix_synapse_auto_accept_invites_only_from_local_users`

  638. # - `matrix_synapse_auto_accept_invites_worker_to_run_on`

  639. matrix_synapse_auto_accept_invites_enabled: false

  640. 

  641. # Controls whether auto-invite acceptance should only be done for direct messages.

  642. # Related to: `matrix_synapse_auto_accept_invites_enabled`

  643. matrix_synapse_auto_accept_invites_only_for_direct_messages: false

  644. 

  645. # Controls whether auto-invite acceptance should only be done when the invitatio nis coming from a local user.

  646. # Related to: `matrix_synapse_auto_accept_invites_enabled`

  647. matrix_synapse_auto_accept_invites_only_from_local_users: false

  648. 

  649. # When Synapse workers enabled it is possible (but not required) to assign a worker to run the auto-accept-invites feature on (null = main process).

  650. # Related to: `matrix_synapse_auto_accept_invites_enabled`

  651. matrix_synapse_auto_accept_invites_worker_to_run_on: null

  652. 

  653. # Controls whether password authentication is allowed

  654. # It may be useful when you've configured OAuth, SAML or CAS and want authentication

  655. # to happen only through them

  656. matrix_synapse_password_config_enabled: true

  657. 

  658. # Controls password-peppering for Synapse. Not to be changed after initial setup.

  659. matrix_synapse_password_config_pepper: ""

  660. 

  661. # Controls if Synapse allows people to authenticate against its local database.

  662. # It may be useful to disable this if you've configured additional password providers

  663. # and only wish authentication to happen through them.

  664. matrix_synapse_password_config_localdb_enabled: true

  665. 

  666. # Controls the number of events that Synapse caches in memory.

  667. matrix_synapse_event_cache_size: "100K"

  668. 

  669. # Controls cache sizes for Synapse.

  670. # Raise this to increase cache sizes or lower it to potentially lower memory use.

  671. # To learn more, see:

  672. # - https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#caching

  673. # - https://github.com/matrix-org/synapse/issues/3939

  674. # Defaults for timings of caches is from https://tcpipuk.github.io/synapse/deployment/synapse.html

  675. # The idea with the timings used is that you get to evict soon but also you keep stuff around for a long time when its not forced out.

  676. # Long cache lifetimes together with the low minimum TTL allows autotune to be the primary eviction method assuming size of cache is hit before we hit other caps.

  677. matrix_synapse_caches_global_factor: 10

  678. matrix_synapse_caches_expire_caches: true

  679. matrix_synapse_caches_cache_entry_ttl: "1080m"

  680. matrix_synapse_caches_sync_response_cache_duration: "2m"

  681. 

  682. # Controls how much memory this role thinks is available for cache-size-related calculations.

  683. # By default, all of the server's memory is taken into account, but you can adjust this.

  684. # You can also go for directly adjusting cache-sizes (matrix_synapse_cache_autotuning_max_cache_memory_usage, matrix_synapse_cache_autotuning_target_cache_memory_usage) instead of adjusting this.

  685. matrix_synapse_cache_size_calculations_memtotal_bytes: "{{ (ansible_memtotal_mb * 1024 * 1024) | int }}"

  686. 

  687. # Controls the cap to use for matrix_synapse_cache_autotuning_max_cache_memory_usage.

  688. matrix_synapse_cache_size_calculations_max_cache_memory_usage_cap_bytes: "{{ (2 * 1024 * 1024 * 1024) }}"  # 2GB

  689. 

  690. # Controls the cap to use for matrix_synapse_cache_autotuning_target_cache_memory_usage.

  691. matrix_synapse_cache_size_calculations_target_cache_memory_usage_cap_bytes: "{{ (1 * 1024 * 1024 * 1024) }}"  # 1GB

  692. 

  693. matrix_synapse_cache_autotuning_min_cache_ttl: "30s"

  694. 

  695. matrix_synapse_cache_autotuning_max_cache_memory_usage: |-

  696.   {{

  697.     [

  698.       (((matrix_synapse_cache_size_calculations_memtotal_bytes | int) / 8) | int),

  699.       (matrix_synapse_cache_size_calculations_max_cache_memory_usage_cap_bytes | int),

  700.     ] | min

  701.   }}

  702. 

  703. matrix_synapse_cache_autotuning_target_cache_memory_usage: |-

  704.   {{

  705.     [

  706.       (((matrix_synapse_cache_size_calculations_memtotal_bytes | int) / 16) | int),

  707.       (matrix_synapse_cache_size_calculations_target_cache_memory_usage_cap_bytes | int),

  708.     ] | min

  709.   }}

  710. 

  711. # Controls whether Synapse will federate at all.

  712. # Disable this to completely isolate your server from the rest of the Matrix network.

  713. #

  714. # Disabling this still keeps the federation port exposed, because it may be used for other services (`openid`).

  715. #

  716. # Also see:

  717. # - `matrix_synapse_tls_federation_listener_enabled` if you wish to keep federation enabled,

  718. # but want to stop the TLS listener (port 8448).

  719. # - `matrix_synapse_federation_port_enabled` to avoid exposing the federation ports

  720. matrix_synapse_federation_enabled: true

  721. 

  722. # Controls whether the federation ports are used at all.

  723. # One may wish to disable federation (`matrix_synapse_federation_enabled: true`),

  724. # but still run other resources (like `openid`) on the federation port

  725. # by enabling them in `matrix_synapse_federation_listener_resource_names`.

  726. matrix_synapse_federation_port_enabled: "{{ matrix_synapse_federation_enabled or matrix_synapse_federation_port_openid_resource_required }}"

  727. 

  728. # Controls whether an `openid` listener is to be enabled. Useful when disabling federation,

  729. # but needing the `openid` APIs for Dimension or an identity server like ma1sd.

  730. matrix_synapse_federation_port_openid_resource_required: false

  731. 

  732. # A list of domain names that are allowed to federate with the given Synapse server.

  733. # An empty list value (`[]`) will also effectively stop federation, but if that's the desired

  734. # result, it's better to accomplish it by changing `matrix_synapse_federation_enabled`.

  735. matrix_synapse_federation_domain_whitelist: ~

  736. 

  737. # Enable/disable OpenID Connect

  738. matrix_synapse_oidc_enabled: false

  739. # List of OpenID Connect providers, ref: https://matrix-org.github.io/synapse/latest/openid.html#sample-configs

  740. matrix_synapse_oidc_providers: []

  741. 

  742. # A list of additional "volumes" to mount in the container.

  743. # This list gets populated dynamically based on Synapse extensions that have been enabled.

  744. # Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "ro"}

  745. # Note: internally, this uses the `--mount` flag for mounting the specified volumes.

  746. matrix_synapse_container_additional_volumes: []

  747. 

  748. # A list of additional loggers to register in synapse.log.config.

  749. # This list gets populated dynamically based on Synapse extensions that have been enabled.

  750. # Contains definition objects like this: `{"name": "..", "level": "DEBUG"}

  751. matrix_synapse_additional_loggers: "{{ matrix_synapse_additional_loggers_auto + matrix_synapse_additional_loggers_custom }}"

  752. 

  753. matrix_synapse_additional_loggers_auto:

  754.   # By default, we're disabling some useless (and even toxic) spammy WARNING-level logs.

  755.   # Related to:

  756.   # - https://github.com/matrix-org/synapse/issues/16208

  757.   # - https://github.com/matrix-org/synapse/issues/16101

  758.   # - https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2853

  759.   - name: synapse.http.matrixfederationclient

  760.     level: CRITICAL

  761.   - name: synapse.federation.sender.per_destination_queue

  762.     level: CRITICAL

  763.   - name: synapse.handlers.device

  764.     level: CRITICAL

  765.   - name: synapse.replication.tcp.handler

  766.     level: CRITICAL

  767. 

  768. matrix_synapse_additional_loggers_custom: []

  769. 

  770. # A list of appservice config files (in-container filesystem paths).

  771. # This list gets populated dynamically based on Synapse extensions that have been enabled.

  772. # You may wish to use this together with `matrix_synapse_container_additional_volumes` or `matrix_synapse_container_extra_arguments`.

  773. # Also see `matrix_synapse_app_service_config_files_final`

  774. matrix_synapse_app_service_config_files: []

  775. 

  776. # matrix_synapse_app_service_config_files_auto is a list of appservice config files.

  777. # This list is managed by the playbook. You're not meant to override this variable.

  778. # If you'd like to inject your own arguments, see `matrix_synapse_app_service_config_files`.

  779. matrix_synapse_app_service_config_files_auto: []

  780. 

  781. # matrix_synapse_app_service_config_files_final holds the final list of config files to pass to the container.

  782. # You're not meant to override this variable.

  783. # If you'd like to inject your own arguments, see `matrix_synapse_app_service_config_files`.

  784. matrix_synapse_app_service_config_files_final: "{{ matrix_synapse_app_service_config_files + matrix_synapse_app_service_config_files_auto }}"

  785. 

  786. # This is set dynamically during execution depending on whether

  787. # any password providers have been enabled or not.

  788. matrix_synapse_password_providers_enabled: false

  789. 

  790. # Whether clients can request to include message content in push notifications

  791. # sent through third party servers. Setting this to false requires mobile clients

  792. # to load message content directly from the homeserver.

  793. matrix_synapse_push_include_content: true

  794. 

  795. # If url previews should be generated. This will cause a request from Synapse to URLs shared by users.

  796. # Also see `matrix_synapse_url_preview_ip_range_blacklist`.

  797. matrix_synapse_url_preview_enabled: true

  798. 

  799. # List of IP address CIDR ranges that the URL preview spider is denied from accessing.

  800. # Note: The value is ignored when an HTTP proxy is in use

  801. # See the comment about this setting in `templates/synapse/homeserver.yaml.j2` for more details.

  802. matrix_synapse_url_preview_ip_range_blacklist:

  803.   - '127.0.0.0/8'

  804.   - '10.0.0.0/8'

  805.   - '172.16.0.0/12'

  806.   - '192.168.0.0/16'

  807.   - '100.64.0.0/10'

  808.   - '192.0.0.0/24'

  809.   - '169.254.0.0/16'

  810.   - '192.88.99.0/24'

  811.   - '198.18.0.0/15'

  812.   - '192.0.2.0/24'

  813.   - '198.51.100.0/24'

  814.   - '203.0.113.0/24'

  815.   - '224.0.0.0/4'

  816.   - '::1/128'

  817.   - 'fe80::/10'

  818.   - 'fc00::/7'

  819.   - '2001:db8::/32'

  820.   - 'ff00::/8'

  821.   - 'fec0::/10'

  822. 

  823. # List of IP address CIDR ranges that the URL preview spider is allowed to access even if they are specified in `matrix_synapse_url_preview_ip_range_blacklist`.

  824. matrix_synapse_url_preview_ip_range_whitelist: []

  825. 

  826. # A list of values for the Accept-Language HTTP header used when downloading webpages during URL preview generation

  827. matrix_url_preview_accept_language: ['en-US', 'en']

  828. 

  829. # Enable exposure of metrics to Prometheus

  830. # See https://github.com/element-hq/synapse/blob/master/docs/metrics-howto.md

  831. matrix_synapse_metrics_enabled: false

  832. matrix_synapse_metrics_port: 9100

  833. 

  834. # matrix_synapse_grafana_dashboard_urls contains a list of URLs with Grafana dashboard definitions.

  835. # If the Grafana role is enabled, these dashboards will be downloaded.

  836. matrix_synapse_grafana_dashboard_urls:

  837.   - https://raw.githubusercontent.com/element-hq/synapse/master/contrib/grafana/synapse.json

  838. 

  839. # Controls whether Synapse metrics should be proxied (exposed) on:

  840. # - `matrix.example.com/metrics/synapse/main-process` for the main process

  841. # - `matrix.example.com/metrics/synapse/worker/{type}-{id}` for each worker process

  842. matrix_synapse_metrics_proxying_enabled: false

  843. matrix_synapse_metrics_proxying_hostname: ''

  844. matrix_synapse_metrics_proxying_path_prefix: /metrics/synapse

  845. 

  846. # Enable the Synapse manhole

  847. # See https://github.com/element-hq/synapse/blob/master/docs/manhole.md

  848. matrix_synapse_manhole_enabled: false

  849. 

  850. # Enable support for Synapse workers

  851. matrix_synapse_workers_enabled: false

  852. 

  853. # Specifies worker configuration that should be used when workers are enabled.

  854. #

  855. # The posible values (as seen in `matrix_synapse_workers_presets`) are:

  856. # - "little-federation-helper" - a very minimal worker configuration to improve federation performance

  857. # - "one-of-each" - one worker of each supported type + a generic worker

  858. # - "specialized-workers" - one worker of each supported type + specialized workers

  859. #

  860. # You can override `matrix_synapse_workers_presets` to define your own presets, which is ill-advised, because it's fragile.

  861. # To use a more custom configuration, start with one of these presets as a base and configure `matrix_synapse_workers_*_count` variables manually, to suit your liking.

  862. matrix_synapse_workers_preset: one-of-each

  863. 

  864. matrix_synapse_workers_presets:

  865.   little-federation-helper:

  866.     room_workers_count: 0

  867.     sync_workers_count: 0

  868.     client_reader_workers_count: 0

  869.     federation_reader_workers_count: 0

  870.     generic_workers_count: 0

  871.     pusher_workers_count: 0

  872.     federation_sender_workers_count: 1

  873.     media_repository_workers_count: 0

  874.     appservice_workers_count: 0

  875.     user_dir_workers_count: 0

  876.     background_workers_count: 0

  877.     stream_writer_events_stream_workers_count: 0

  878.     stream_writer_typing_stream_workers_count: 0

  879.     stream_writer_to_device_stream_workers_count: 0

  880.     stream_writer_account_data_stream_workers_count: 0

  881.     stream_writer_receipts_stream_workers_count: 0

  882.     stream_writer_presence_stream_workers_count: 0

  883.   one-of-each:

  884.     room_workers_count: 0

  885.     sync_workers_count: 0

  886.     client_reader_workers_count: 0

  887.     federation_reader_workers_count: 0

  888.     generic_workers_count: 1

  889.     pusher_workers_count: 1

  890.     federation_sender_workers_count: 1

  891.     media_repository_workers_count: 1

  892.     appservice_workers_count: 1

  893.     user_dir_workers_count: 1

  894.     background_workers_count: 1

  895.     stream_writer_events_stream_workers_count: 1

  896.     stream_writer_typing_stream_workers_count: 1

  897.     stream_writer_to_device_stream_workers_count: 1

  898.     stream_writer_account_data_stream_workers_count: 1

  899.     stream_writer_receipts_stream_workers_count: 1

  900.     stream_writer_presence_stream_workers_count: 1

  901.   specialized-workers:

  902.     room_workers_count: 1

  903.     sync_workers_count: 1

  904.     client_reader_workers_count: 1

  905.     federation_reader_workers_count: 1

  906.     generic_workers_count: 0

  907.     pusher_workers_count: 1

  908.     federation_sender_workers_count: 1

  909.     media_repository_workers_count: 1

  910.     appservice_workers_count: 1

  911.     user_dir_workers_count: 1

  912.     background_workers_count: 1

  913.     stream_writer_events_stream_workers_count: 1

  914.     stream_writer_typing_stream_workers_count: 1

  915.     stream_writer_to_device_stream_workers_count: 1

  916.     stream_writer_account_data_stream_workers_count: 1

  917.     stream_writer_receipts_stream_workers_count: 1

  918.     stream_writer_presence_stream_workers_count: 1

  919. 

  920. # Controls whether the matrix-synapse container exposes the various worker ports

  921. # (see `port` and `metrics_port` in `matrix_synapse_workers_enabled_list`) outside of the container.

  922. #

  923. # Takes an "<ip>" value (e.g. "127.0.0.1", "0.0.0.0", etc), or empty string to not expose.

  924. # It takes "*" to signify "bind on all interfaces" ("0.0.0.0" is IPv4-only).

  925. matrix_synapse_workers_container_host_bind_address: ''

  926. 

  927. # matrix_synapse_worker_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to Synapse worker containers.

  928. # See `../templates/worker-labels.j2` for details.

  929. #

  930. # To inject your own other container labels, see `matrix_synapse_worker_container_labels_additional_labels`.

  931. matrix_synapse_worker_container_labels_traefik_enabled: true

  932. matrix_synapse_worker_container_labels_traefik_docker_network: "{{ matrix_synapse_container_labels_traefik_docker_network }}"

  933. matrix_synapse_worker_container_labels_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"

  934. matrix_synapse_worker_container_labels_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  935. matrix_synapse_worker_container_labels_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"

  936. 

  937. # Controls whether labels will be added that expose metrics (see `matrix_synapse_metrics_proxying_enabled`)

  938. matrix_synapse_worker_container_labels_public_metrics_enabled: "{{ matrix_synapse_metrics_enabled and matrix_synapse_metrics_proxying_enabled }}"

  939. # The `__WORKER_ID__` placeholder will be replaced with the actual worker ID during label-file generation (see `../templates/worker-labels.j2`).

  940. matrix_synapse_worker_container_labels_public_metrics_traefik_path: "{{ matrix_synapse_metrics_proxying_path_prefix }}/worker/__WORKER_ID__"

  941. matrix_synapse_worker_container_labels_public_metrics_traefik_rule: "Host(`{{ matrix_synapse_metrics_proxying_hostname }}`) && Path(`{{ matrix_synapse_worker_container_labels_public_metrics_traefik_path }}`)"

  942. matrix_synapse_worker_container_labels_public_metrics_traefik_priority: 0

  943. matrix_synapse_worker_container_labels_public_metrics_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"

  944. matrix_synapse_worker_container_labels_public_metrics_traefik_tls: "{{ matrix_synapse_container_labels_public_metrics_traefik_entrypoints != 'web' }}"

  945. matrix_synapse_worker_container_labels_public_metrics_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  946. matrix_synapse_worker_container_labels_public_metrics_middleware_basic_auth_enabled: "{{ matrix_synapse_container_labels_public_metrics_middleware_basic_auth_enabled }}"

  947. # See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users

  948. matrix_synapse_worker_container_labels_public_metrics_middleware_basic_auth_users: "{{ matrix_synapse_container_labels_public_metrics_middleware_basic_auth_users }}"

  949. 

  950. # matrix_synapse_worker_container_labels_additional_labels contains a multiline string with additional labels to add to the label files for Synapse worker containers.

  951. # See `../templates/labels.j2` for details.

  952. #

  953. # Example:

  954. # matrix_synapse_worker_container_labels_additional_labels: |

  955. #   my.label=1

  956. #   another.label="here"

  957. matrix_synapse_worker_container_labels_additional_labels: ''

  958. 

  959. # Room workers

  960. matrix_synapse_workers_room_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['room_workers_count'] }}"

  961. matrix_synapse_workers_room_workers_port_range_start: 28111

  962. matrix_synapse_workers_room_workers_metrics_range_start: 29111

  963. matrix_synapse_workers_room_workers_container_arguments: []

  964. 

  965. # Sync workers

  966. matrix_synapse_workers_sync_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['sync_workers_count'] }}"

  967. matrix_synapse_workers_sync_workers_port_range_start: 28211

  968. matrix_synapse_workers_sync_workers_metrics_range_start: 29211

  969. matrix_synapse_workers_sync_workers_container_arguments: []

  970. 

  971. # Client reader workers

  972. matrix_synapse_workers_client_reader_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['client_reader_workers_count'] }}"

  973. matrix_synapse_workers_client_reader_workers_port_range_start: 28311

  974. matrix_synapse_workers_client_reader_workers_metrics_range_start: 29311

  975. matrix_synapse_workers_client_reader_workers_container_arguments: []

  976. 

  977. # Federation reader workers

  978. matrix_synapse_workers_federation_reader_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['federation_reader_workers_count'] }}"

  979. matrix_synapse_workers_federation_reader_workers_port_range_start: 28411

  980. matrix_synapse_workers_federation_reader_workers_metrics_range_start: 29411

  981. matrix_synapse_workers_federation_reader_workers_container_arguments: []

  982. 

  983. # Generic workers

  984. matrix_synapse_workers_generic_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['generic_workers_count'] }}"

  985. matrix_synapse_workers_generic_workers_port_range_start: 18111

  986. matrix_synapse_workers_generic_workers_metrics_range_start: 19111

  987. matrix_synapse_workers_generic_workers_container_arguments: []

  988. 

  989. # matrix_synapse_workers_stream_writer_events_stream_workers_count controls how many stream writers that handle the `events` stream to spawn.

  990. # More than 1 worker is also supported of this type.

  991. matrix_synapse_workers_stream_writer_events_stream_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['stream_writer_events_stream_workers_count'] }}"

  992. 

  993. # matrix_synapse_workers_stream_writer_typing_stream_workers_count controls how many stream writers that handle the `typing` stream to spawn.

  994. # The count of these workers can only be 0 or 1.

  995. matrix_synapse_workers_stream_writer_typing_stream_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['stream_writer_typing_stream_workers_count'] }}"

  996. 

  997. # matrix_synapse_workers_stream_writer_to_device_stream_workers_count controls how many stream writers that handle the `to_device` stream to spawn.

  998. # The count of these workers can only be 0 or 1.

  999. matrix_synapse_workers_stream_writer_to_device_stream_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['stream_writer_to_device_stream_workers_count'] }}"

  1000. 

  1001. # matrix_synapse_workers_stream_writer_account_data_stream_workers_count controls how many stream writers that handle the `account_data` stream to spawn.

  1002. # The count of these workers can only be 0 or 1.

  1003. matrix_synapse_workers_stream_writer_account_data_stream_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['stream_writer_account_data_stream_workers_count'] }}"

  1004. 

  1005. # matrix_synapse_workers_stream_writer_receipts_stream_workers_count controls how many stream writers that handle the `receipts` stream to spawn.

  1006. # The count of these workers can only be 0 or 1.

  1007. matrix_synapse_workers_stream_writer_receipts_stream_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['stream_writer_receipts_stream_workers_count'] }}"

  1008. 

  1009. # matrix_synapse_workers_stream_writer_presence_stream_workers_count controls how many stream writers that handle the `presence` stream to spawn.

  1010. # The count of these workers can only be 0 or 1.

  1011. matrix_synapse_workers_stream_writer_presence_stream_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['stream_writer_presence_stream_workers_count'] }}"

  1012. 

  1013. # A list of stream writer workers to enable. This list is built automatically based on other variables.

  1014. # You're encouraged to enable/disable stream writer workers by setting `matrix_synapse_workers_stream_writer_*_stream_workers_count` variables, instead of adjusting this list manually.

  1015. matrix_synapse_workers_stream_writers: |

  1016.   {{

  1017.     []

  1018.     +

  1019.     ([{'stream': 'events'}] * matrix_synapse_workers_stream_writer_events_stream_workers_count | int)

  1020.     +

  1021.     ([{'stream': 'typing'}] * matrix_synapse_workers_stream_writer_typing_stream_workers_count | int)

  1022.     +

  1023.     ([{'stream': 'to_device'}] * matrix_synapse_workers_stream_writer_to_device_stream_workers_count | int)

  1024.     +

  1025.     ([{'stream': 'account_data'}] * matrix_synapse_workers_stream_writer_account_data_stream_workers_count | int)

  1026.     +

  1027.     ([{'stream': 'receipts'}] * matrix_synapse_workers_stream_writer_receipts_stream_workers_count | int)

  1028.     +

  1029.     ([{'stream': 'presence'}] * matrix_synapse_workers_stream_writer_presence_stream_workers_count | int)

  1030.   }}

  1031. 

  1032. matrix_synapse_workers_stream_writers_container_arguments: []

  1033. 

  1034. # matrix_synapse_stream_writers populates the `stream_writers` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).

  1035. # What you see below is an initial default value which will be adjusted at runtime based on the value of `matrix_synapse_workers_stream_writers`.

  1036. # Adjusting this value manually is generally not necessary.

  1037. #

  1038. # It's tempting to initialize this like this:

  1039. # matrix_synapse_stream_writers:

  1040. #   - typing: []

  1041. #   - events: []

  1042. #   - to_device: []

  1043. #   - account_data: []

  1044. #   - receipts: []

  1045. #   - presence: []

  1046. # .. but Synapse does not like empty lists (see https://github.com/matrix-org/synapse/issues/13804)

  1047. matrix_synapse_stream_writers: {}

  1048. 

  1049. # `matrix_synapse_workers_stream_writer_workers_` variables control the port numbers of various stream writer workers

  1050. # defined in `matrix_synapse_workers_stream_writers`.

  1051. # It should be noted that not all of the background worker types will need to expose HTTP services, etc.

  1052. matrix_synapse_workers_stream_writer_workers_http_port_range_start: 20011

  1053. matrix_synapse_workers_stream_writer_workers_replication_port_range_start: 25011

  1054. matrix_synapse_workers_stream_writer_workers_metrics_range_start: 19211

  1055. 

  1056. # matrix_synapse_workers_pusher_workers_count controls the number of pusher workers (workers who push out notifications) to spawn.

  1057. # See https://matrix-org.github.io/synapse/latest/workers.html#synapseapppusher

  1058. matrix_synapse_workers_pusher_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['pusher_workers_count'] }}"

  1059. matrix_synapse_workers_pusher_workers_metrics_range_start: 19200

  1060. matrix_synapse_workers_pusher_workers_container_arguments: []

  1061. 

  1062. # matrix_synapse_federation_pusher_instances populates the `pusher_instances` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).

  1063. # What you see below is an initial default value which will be adjusted at runtime based on the value of `matrix_synapse_workers_pusher_workers_count` or `matrix_synapse_workers_enabled_list`.

  1064. # Adjusting this value manually is generally not necessary.

  1065. matrix_synapse_federation_pusher_instances: []

  1066. 

  1067. # matrix_synapse_workers_federation_sender_workers_count controls the number of federation sender workers to spawn.

  1068. # See https://matrix-org.github.io/synapse/latest/workers.html#synapseappfederation_sender

  1069. matrix_synapse_workers_federation_sender_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['federation_sender_workers_count'] }}"

  1070. matrix_synapse_workers_federation_sender_workers_metrics_range_start: 19400

  1071. matrix_synapse_workers_federation_sender_workers_container_arguments: []

  1072. 

  1073. # matrix_synapse_federation_sender_instances populates the `federation_sender_instances` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).

  1074. # What you see below is an initial default value which will be adjusted at runtime based on the value of `matrix_synapse_workers_federation_sender_workers_count` or `matrix_synapse_workers_enabled_list`.

  1075. # Adjusting this value manually is generally not necessary.

  1076. matrix_synapse_federation_sender_instances: []

  1077. 

  1078. matrix_synapse_workers_media_repository_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['media_repository_workers_count'] if not matrix_synapse_ext_media_repo_enabled else 0 }}"

  1079. matrix_synapse_workers_media_repository_workers_port_range_start: 18551

  1080. matrix_synapse_workers_media_repository_workers_metrics_range_start: 19551

  1081. matrix_synapse_workers_media_repository_workers_container_arguments: []

  1082. 

  1083. # matrix_synapse_enable_media_repo controls if the main Synapse process should serve media repository endpoints or if it should be left to media_repository workers (see `matrix_synapse_workers_media_repository_workers_count`).

  1084. # This is enabled if workers are disabled, or if they are enabled, but there are no media repository workers.

  1085. # Adjusting this value manually is generally not necessary.

  1086. matrix_synapse_enable_media_repo: "{{ not matrix_synapse_ext_media_repo_enabled and (not matrix_synapse_workers_enabled or (matrix_synapse_workers_enabled_list | selectattr('type', 'equalto', 'media_repository') | list | length == 0)) }}"

  1087. 

  1088. # matrix_synapse_enable_authenticated_media controls if authenticated media is enabled.

  1089. # If enabled all "old" media remains accessible over the legacy endpoints but new media is blocked.

  1090. # while this option is enabled all media access and downloads have to be done via authenticated endpoints.

  1091. matrix_synapse_enable_authenticated_media: true

  1092. 

  1093. # matrix_synapse_media_instance_running_background_jobs populates the `media_instance_running_background_jobs` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).

  1094. # `media_instance_running_background_jobs` is meant to point to a single media-repository worker, which is dedicated to running background tasks that maintain the media repository.

  1095. # Multiple `media_repository` workers may be enabled. We always pick the first one as the background tasks worker.

  1096. matrix_synapse_media_instance_running_background_jobs: "{{ (matrix_synapse_workers_enabled_list | selectattr('type', 'equalto', 'media_repository') | list)[0].name if (matrix_synapse_workers_enabled and matrix_synapse_workers_enabled_list | selectattr('type', 'equalto', 'media_repository') | list | length > 0) else '' }}"

  1097. 

  1098. # matrix_synapse_workers_appservice_workers_count can only be 0 or 1. More instances are not supported.

  1099. # appservice workers were deprecated since Synapse v1.59 (see: https://github.com/element-hq/synapse/blob/v1.59.0/docs/upgrade.md#deprecation-of-the-synapseappappservice-and-synapseappuser_dir-worker-application-types).

  1100. # Our implementation uses generic worker services and assigns them to perform appservice work using the `notify_appservices_from_worker` Synapse option.

  1101. matrix_synapse_workers_appservice_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['appservice_workers_count'] }}"

  1102. matrix_synapse_workers_appservice_workers_metrics_range_start: 19300

  1103. matrix_synapse_workers_appservice_workers_container_arguments: []

  1104. 

  1105. # matrix_synapse_notify_appservices_from_worker populates the `notify_appservices_from_worker` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).

  1106. # `notify_appservices_from_worker` is meant to point to a worker, which is dedicated to sending output traffic to Application Services.

  1107. matrix_synapse_notify_appservices_from_worker: "{{ (matrix_synapse_workers_enabled_list | selectattr('type', 'equalto', 'appservice') | list)[0].name if (matrix_synapse_workers_enabled and matrix_synapse_workers_enabled_list | selectattr('type', 'equalto', 'appservice') | list | length > 0) else '' }}"

  1108. 

  1109. # matrix_synapse_workers_user_dir_workers_count can only be 0 or 1. More instances are not supported.

  1110. # user_dir workers were deprecated since Synapse v1.59 (see: https://github.com/element-hq/synapse/blob/v1.59.0/docs/upgrade.md#deprecation-of-the-synapseappappservice-and-synapseappuser_dir-worker-application-types).

  1111. # Our implementation uses generic worker services and assigns them to perform appservice work using the `update_user_directory_from_worker` Synapse option.

  1112. matrix_synapse_workers_user_dir_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['user_dir_workers_count'] }}"

  1113. matrix_synapse_workers_user_dir_workers_port_range_start: 18661

  1114. matrix_synapse_workers_user_dir_workers_metrics_range_start: 19661

  1115. matrix_synapse_workers_user_dir_workers_container_arguments: []

  1116. 

  1117. # matrix_synapse_update_user_directory_from_worker populates the `update_user_directory_from_worker` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).

  1118. # `update_user_directory_from_worker` is meant to point to a worker, which is dedicated to updating the user directory and servicing some user directory URL endpoints (`matrix_synapse_workers_user_dir_worker_client_server_endpoints`).

  1119. matrix_synapse_update_user_directory_from_worker: "{{ (matrix_synapse_workers_enabled_list | selectattr('type', 'equalto', 'user_dir') | list)[0].name if (matrix_synapse_workers_enabled and matrix_synapse_workers_enabled_list | selectattr('type', 'equalto', 'user_dir') | list | length > 0) else '' }}"

  1120. 

  1121. # matrix_synapse_workers_background_workers_count can only be 0 or 1. More instances are not supported.

  1122. # Our implementation uses a generic worker and assigns Synapse to perform background work on this worker using the `run_background_tasks_on` Synapse option.

  1123. matrix_synapse_workers_background_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['background_workers_count'] }}"

  1124. matrix_synapse_workers_background_workers_metrics_range_start: 19700

  1125. matrix_synapse_workers_background_workers_container_arguments: []

  1126. 

  1127. # matrix_synapse_run_background_tasks_on populates the `run_background_tasks_on` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).

  1128. # `run_background_tasks_on` is meant to point to a worker, which is dedicated to processing background tasks.

  1129. matrix_synapse_run_background_tasks_on: "{{ (matrix_synapse_workers_enabled_list | selectattr('type', 'equalto', 'background') | list)[0].name if (matrix_synapse_workers_enabled and matrix_synapse_workers_enabled_list | selectattr('type', 'equalto', 'background') | list | length > 0) else '' }}"

  1130. 

  1131. # Default list of workers to spawn.

  1132. #

  1133. # Unless you populate this manually, this list is dynamically generated

  1134. # based on other variables above:

  1135. # - `matrix_synapse_workers_*_workers_count`

  1136. # - `matrix_synapse_workers_*_workers_port_range_start`

  1137. # - `matrix_synapse_workers_*_workers_port_metrics_range_start`

  1138. #

  1139. # We advise that you use those variables and let this list be populated dynamically.

  1140. # Doing that is simpler and also protects you from shooting yourself in the foot,

  1141. # as certain workers can only be spawned just once.

  1142. #

  1143. # Each worker instance in the list defines the following fields:

  1144. # - `id` - a string that uniquely identifies the worker

  1145. # - `name` - a string that will be used as the container and systemd service name

  1146. # - `type` - the type of worker (`generic_worker`, `stream_writer`, `pusher`, etc.)

  1147. # - `app` - the Synapse app (https://matrix-org.github.io/synapse/latest/workers.html#available-worker-applications) that powers this worker (`generic_worker`, `federation_sender`, etc.).

  1148. #           The `app` usually matches the `type`, but not always. For example, `type = stream_writer` workers are served by the `generic_worker` type.

  1149. # - `port` - an HTTP port where the worker listens for requests (can be `0` for workers that don't do HTTP request processing)

  1150. # - `metrics_port` - an HTTP port where the worker exports Prometheus metrics

  1151. # - `replication_port` - an HTTP port where the worker serves `replication` endpoints (used by stream writers, etc.)

  1152. # - `webserving` - tells whether this type of worker serves web (client or federation) requests, so that it can be injected as a dependency to the reverse-proxy

  1153. #

  1154. # Example of what this needs to look like, if you're defining it manually:

  1155. # matrix_synapse_workers_enabled_list:

  1156. #   - { 'id': 'generic-worker-0', 'name': 'matrix-synapse-worker-generic-0', 'type': 'generic_worker', 'app': 'generic_worker', 'port': 18111, 'metrics_port': 19111, 'webserving': true }

  1157. #   - { 'id': 'generic-worker-1', 'name': 'matrix-synapse-worker-generic-1', 'type': 'generic_worker', 'app': 'generic_worker', 'port': 18112, 'metrics_port': 19112, 'webserving': true }

  1158. #   - { 'id': 'generic-worker-2', 'name': 'matrix-synapse-worker-generic-2', 'type': 'generic_worker', 'app': 'generic_worker', 'port': 18113, 'metrics_port': 19113, 'webserving': true }

  1159. #   - { 'id': 'generic-worker-3', 'name': 'matrix-synapse-worker-generic-3', 'type': 'generic_worker', 'app': 'generic_worker', 'port': 18114, 'metrics_port': 19114, 'webserving': true }

  1160. #   - { 'id': 'generic-worker-4', 'name': 'matrix-synapse-worker-generic-4', 'type': 'generic_worker', 'app': 'generic_worker', 'port': 18115, 'metrics_port': 19115, 'webserving': true }

  1161. #   - { 'id': 'generic-worker-5', 'name': 'matrix-synapse-worker-generic-5', 'type': 'generic_worker', 'app': 'generic_worker', 'port': 18116, 'metrics_port': 19116, 'webserving': true }

  1162. #   - { 'id': 'stream-writer-0-events', 'name': 'matrix-synapse-worker-stream-writer-0-events', 'type': 'stream_writer', 'app': 'generic_worker', 'stream_writer_stream': 'events', 'port': 0, 'replication_port': 25011, metrics_port: 19111, 'webserving': false }

  1163. #   - { 'id': 'stream-writer-1-typing', 'name': 'matrix-synapse-worker-stream-writer-1-typing', 'type': 'stream_writer', 'app': 'generic_worker', 'stream_writer_stream': 'typing', 'port': 20012, 'replication_port': 25012, metrics_port: 19112, 'webserving': true }

  1164. #   - { 'id': 'pusher-0', 'name': 'matrix-synapse-worker-pusher-0', 'type': 'pusher', 'app': 'pusher', 'port': 0, 'metrics_port': 19200, 'webserving': false }

  1165. #   - { 'id': 'appservice-0', 'name': 'matrix-synapse-worker-appservice-0', 'type': 'appservice', 'port': 0, 'metrics_port': 19300, 'webserving': false }

  1166. #   - { 'id': 'federation-sender-0', 'name': 'matrix-synapse-worker-federation-sender-0', 'type': 'federation_sender', 'port': 0, 'metrics_port': 19400, 'webserving': false }

  1167. #   - { 'id': 'media-repository-0', 'name': 'matrix-synapse-worker-media-repository-0', 'type': 'media_repository', 'port': 18551, 'metrics_port': 19551, 'webserving': true }

  1168. matrix_synapse_workers_enabled_list: []

  1169. 

  1170. # matrix_synapse_instance_map holds the instance map used for mapping worker names (for the main process and certain generic workers only!) to where they live (host, port which handles replication traffic).

  1171. # This map starts off being populated with the Synapse main (master) process,

  1172. # but will be populated with workers automatically during runtime, based on `matrix_synapse_workers_enabled_list`.

  1173. matrix_synapse_instance_map: |

  1174.   {{

  1175.     {

  1176.       'main': {

  1177.         'host': 'matrix-synapse',

  1178.         'port': matrix_synapse_replication_http_port,

  1179.       },

  1180.     } if matrix_synapse_workers_enabled else {}

  1181.   }}

  1182. 

  1183. # Redis information

  1184. matrix_synapse_redis_enabled: false

  1185. matrix_synapse_redis_host: ""

  1186. matrix_synapse_redis_port: 6379

  1187. matrix_synapse_redis_password: ""

  1188. matrix_synapse_redis_dbid: 0

  1189. matrix_synapse_redis_use_tls: false

  1190. 

  1191. # Controls whether Synapse starts a replication listener necessary for workers.

  1192. #

  1193. # If Redis is available, we prefer to use that, instead of talking over Synapse's custom replication protocol.

  1194. #

  1195. # matrix_synapse_replication_listener_enabled: "{{ matrix_synapse_workers_enabled and matrix_synapse_redis_enabled }}"

  1196. # We force-enable this listener for now until we debug why communication via Redis fails.

  1197. matrix_synapse_replication_listener_enabled: true

  1198. 

  1199. # Port used for communication between main synapse process and workers.

  1200. # Only gets used if `matrix_synapse_replication_listener_enabled: true`

  1201. matrix_synapse_replication_http_port: 9093

  1202. 

  1203. # Send ERROR logs to sentry.io for easier tracking

  1204. # To set this up: go to sentry.io, create a python project, and set

  1205. # matrix_synapse_sentry_dsn to the URL it gives you.

  1206. # See https://github.com/matrix-org/synapse/issues/4632 for important privacy concerns

  1207. matrix_synapse_sentry_dsn: ""

  1208. 

  1209. # Postgres database information

  1210. matrix_synapse_database_txn_limit: 0

  1211. matrix_synapse_database_host: ''

  1212. matrix_synapse_database_port: 5432

  1213. matrix_synapse_database_cp_min: 5

  1214. matrix_synapse_database_cp_max: 10

  1215. matrix_synapse_database_user: "synapse"

  1216. matrix_synapse_database_password: ""

  1217. matrix_synapse_database_database: "synapse"

  1218. 

  1219. matrix_synapse_turn_uris: []

  1220. matrix_synapse_turn_shared_secret: ""

  1221. matrix_synapse_turn_username: ""

  1222. matrix_synapse_turn_password: ""

  1223. matrix_synapse_turn_allow_guests: false

  1224. 

  1225. matrix_synapse_email_enabled: false

  1226. matrix_synapse_email_smtp_host: ""

  1227. matrix_synapse_email_smtp_port: 587

  1228. matrix_synapse_email_smtp_user: ""

  1229. matrix_synapse_email_smtp_pass: ""

  1230. matrix_synapse_email_smtp_require_transport_security: false

  1231. matrix_synapse_email_notif_from: "Matrix <matrix@{{ matrix_domain }}>"

  1232. matrix_synapse_email_app_name: Matrix

  1233. matrix_synapse_email_client_base_url: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_server_fqn_element }}"

  1234. matrix_synapse_email_invite_client_location: "https://app.element.io"

  1235. 

  1236. 

  1237. ################################################################################

  1238. #

  1239. # Next-generation auth for Matrix, based on OAuth 2.0/OIDC

  1240. #

  1241. ################################################################################

  1242. 

  1243. # Controls whether to enable the "send typing, presence and receipts to appservices" experimental feature.

  1244. #

  1245. # See:

  1246. # - https://github.com/matrix-org/matrix-spec-proposals/pull/2409

  1247. # - https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html#running-with-synapse

  1248. matrix_synapse_experimental_features_msc2409_to_device_messages_enabled: false

  1249. 

  1250. # Controls whether to enable the "device masquerading" for encrypted appservices experimental feature.

  1251. #

  1252. # See:

  1253. # - https://github.com/matrix-org/matrix-spec-proposals/pull/3202

  1254. # - https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html#running-with-synapse

  1255. matrix_synapse_experimental_features_msc3202_device_masquerading_enabled: false

  1256. 

  1257. # Controls whether to enable the "transaction extensions" for encrypted appservices experimental feature.

  1258. #

  1259. # See:

  1260. # - https://github.com/matrix-org/matrix-spec-proposals/pull/3202

  1261. # - https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html#running-with-synapse

  1262. matrix_synapse_experimental_features_msc3202_transaction_extensions_enabled: false

  1263. 

  1264. # Controls whether to enable the "Next-generation auth for Matrix, based on OAuth 2.0/OIDC" experimental feature.

  1265. #

  1266. # See:

  1267. # - https://matrix.org/blog/2023/09/better-auth/

  1268. # - https://github.com/matrix-org/matrix-spec-proposals/pull/3861

  1269. matrix_synapse_experimental_features_msc3861_enabled: false

  1270. 

  1271. # Specifies the issuer URL for the OAuth 2.0/OIDC authentication provider.

  1272. #

  1273. # This can be set to a private (container) URL.

  1274. #

  1275. # Example: https://matrix.example.com/auth/

  1276. matrix_synapse_experimental_features_msc3861_issuer: ''

  1277. 

  1278. # Specifies the introspection endpoint URL for the OAuth 2.0/OIDC authentication provider.

  1279. #

  1280. # This can be set to a private (container) URL.

  1281. #

  1282. # If this is left empty, `{issuer}/.well-known/openid-configuration` will be fetched and the `introspection_endpoint` will be extracted from there.

  1283. # We define it explicitly, because this allows us to override it and use an internal (container network) URL instead of using the public one.

  1284. # Avoiding public addresses is an optimization that decreases overhead due to public networking and SSL termination.

  1285. #

  1286. # Example: https://matrix.example.com/auth/oauth2/introspect

  1287. matrix_synapse_experimental_features_msc3861_introspection_endpoint: "{{ matrix_synapse_experimental_features_msc3861_issuer + 'oauth2/introspect' }}"

  1288. 

  1289. # A unique identifier for the client.

  1290. #

  1291. # It must be a valid ULID (https://github.com/ulid/spec),

  1292. # and it happens that 0000000000000000000SYNAPSE is a valid ULID.

  1293. matrix_synapse_experimental_features_msc3861_client_id: '0000000000000000000SYNAPSE'

  1294. 

  1295. matrix_synapse_experimental_features_msc3861_client_auth_method: client_secret_basic

  1296. 

  1297. matrix_synapse_experimental_features_msc3861_client_secret: ''

  1298. 

  1299. # A token that can be used to make admin API calls.

  1300. # Matches `matrix.secret` in the matrix-authentication-service config

  1301. matrix_synapse_experimental_features_msc3861_admin_token: ''

  1302. 

  1303. # URL to advertise to clients where users can self-manage their account.

  1304. matrix_synapse_experimental_features_msc3861_account_management_url: ''

  1305. 

  1306. # Controls whether to enable the "QR code login" experimental feature.

  1307. # Enabling this requires that MSC3861 (see `matrix_synapse_experimental_features_msc3861_enabled`) is also enabled.

  1308. matrix_synapse_experimental_features_msc4108_enabled: false

  1309. 

  1310. ################################################################################

  1311. #

  1312. # /Next-generation auth for Matrix, based on OAuth 2.0/OIDC

  1313. #

  1314. ################################################################################

  1315. 

  1316. 

  1317. # Controls whether to enable the "room summary API" experimental feature.

  1318. # See https://github.com/matrix-org/matrix-spec-proposals/pull/3266

  1319. # Despite being experimental, this feature is mandatory for the next-generation Element X clients, which is why it is enabled by default:

  1320. # https://github.com/element-hq/element-x-ios/issues/3713#issuecomment-2620958291

  1321. # If you're worried about the privacy implications of this unauthenticated API, see:

  1322. # https://github.com/deepbluev7/matrix-doc/blob/room-summaries/proposals/3266-room-summary.md#client-server-api

  1323. # Set this to false if you still want to disable to API for some reason. Note that doing so breaks Element X compatibility though.

  1324. matrix_synapse_experimental_features_msc3266_enabled: true

  1325. 

  1326. # Controls whether to enable the "Delayed Events" experimental feature.

  1327. # Delayed events are required for proper call (Element Call) participation signalling.

  1328. # If disabled it is very likely that you end up with stuck calls in Matrix rooms.

  1329. #

  1330. # Related to:

  1331. # - `matrix_synapse_max_event_delay_duration`

  1332. # - `matrix_synapse_rc_delayed_event_mgmt`

  1333. #

  1334. # See https://github.com/matrix-org/matrix-spec-proposals/pull/4140

  1335. matrix_synapse_experimental_features_msc4140_enabled: false

  1336. 

  1337. # Controls the maximum allowed duration by which sent events can be delayed, as per MSC4140.

  1338. #

  1339. # See `matrix_synapse_experimental_features_msc4140_enabled`.

  1340. matrix_synapse_max_event_delay_duration: 24h

  1341. 

  1342. # Controls whether to enable the MSC4133 experimental feature (Custom profile fields).

  1343. #

  1344. # This allows clients to set custom profile fields (e.g. User Time Zone in Element Web)

  1345. #

  1346. # See https://github.com/matrix-org/matrix-spec-proposals/pull/4133

  1347. matrix_synapse_experimental_features_msc4133_enabled: false

  1348. 

  1349. # Controls whether to enable the MSC4222 experimental feature (adding `state_after` to sync v2).

  1350. #

  1351. # Allow clients to opt-in to a change of the sync v2 API that allows them to correctly track the state of the room.

  1352. # This is required by Element Call to track room state reliably.

  1353. #

  1354. # See https://github.com/matrix-org/matrix-spec-proposals/pull/4222

  1355. matrix_synapse_experimental_features_msc4222_enabled: false

  1356. 

  1357. # Enable this to activate the REST auth password provider module.

  1358. # See: https://github.com/ma1uta/matrix-synapse-rest-password-provider

  1359. matrix_synapse_ext_password_provider_rest_auth_enabled: false

  1360. matrix_synapse_ext_password_provider_rest_auth_download_url: "https://raw.githubusercontent.com/ma1uta/matrix-synapse-rest-password-provider/ed377fb70513c2e51b42055eb364195af1ccaf33/rest_auth_provider.py"

  1361. matrix_synapse_ext_password_provider_rest_auth_endpoint: ""

  1362. matrix_synapse_ext_password_provider_rest_auth_registration_enforce_lowercase: false

  1363. matrix_synapse_ext_password_provider_rest_auth_registration_profile_name_autofill: true

  1364. matrix_synapse_ext_password_provider_rest_auth_login_profile_name_autofill: false

  1365. 

  1366. # Enable this to activate the Shared Secret Auth password provider module.

  1367. # See: https://github.com/devture/matrix-synapse-shared-secret-auth

  1368. matrix_synapse_ext_password_provider_shared_secret_auth_enabled: false

  1369. matrix_synapse_ext_password_provider_shared_secret_auth_download_url: "https://raw.githubusercontent.com/devture/matrix-synapse-shared-secret-auth/2.0.3/shared_secret_authenticator.py"

  1370. matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret: ""

  1371. matrix_synapse_ext_password_provider_shared_secret_auth_m_login_password_support_enabled: true

  1372. matrix_synapse_ext_password_provider_shared_secret_auth_com_devture_shared_secret_auth_support_enabled: true

  1373. matrix_synapse_ext_password_provider_shared_secret_config: "{{ matrix_synapse_ext_password_provider_shared_secret_config_yaml | from_yaml }}"

  1374. matrix_synapse_ext_password_provider_shared_secret_config_yaml: |

  1375.   shared_secret: {{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret | string | to_json }}

  1376.   m_login_password_support_enabled: {{ matrix_synapse_ext_password_provider_shared_secret_auth_m_login_password_support_enabled | to_json }}

  1377.   com_devture_shared_secret_auth_support_enabled: {{ matrix_synapse_ext_password_provider_shared_secret_auth_com_devture_shared_secret_auth_support_enabled | to_json }}

  1378. 

  1379. # Enable this to activate LDAP password provider

  1380. matrix_synapse_ext_password_provider_ldap_enabled: false

  1381. matrix_synapse_ext_password_provider_ldap_uri: "ldap://ldap.example.com:389"

  1382. matrix_synapse_ext_password_provider_ldap_start_tls: true

  1383. matrix_synapse_ext_password_provider_ldap_mode: "search"

  1384. matrix_synapse_ext_password_provider_ldap_base: ""

  1385. matrix_synapse_ext_password_provider_ldap_attributes_uid: "uid"

  1386. matrix_synapse_ext_password_provider_ldap_attributes_mail: "mail"

  1387. matrix_synapse_ext_password_provider_ldap_attributes_name: "cn"

  1388. matrix_synapse_ext_password_provider_ldap_bind_dn: ""

  1389. matrix_synapse_ext_password_provider_ldap_bind_password: ""

  1390. matrix_synapse_ext_password_provider_ldap_filter: ""

  1391. matrix_synapse_ext_password_provider_ldap_active_directory: false

  1392. matrix_synapse_ext_password_provider_ldap_default_domain: ""

  1393. 

  1394. # Enable this to activate the Synapse Antispam spam-checker module.

  1395. # See: https://github.com/t2bot/synapse-simple-antispam

  1396. matrix_synapse_ext_spam_checker_synapse_simple_antispam_enabled: false

  1397. matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_repository_url: "https://github.com/t2bot/synapse-simple-antispam"

  1398. matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_version: "5ab711971e3a4541a7a40310ff85e17f8262cc05"

  1399. matrix_synapse_ext_spam_checker_synapse_simple_antispam_config_blocked_homeservers: []

  1400. 

  1401. # Enable this to activate the Mjolnir Antispam spam-checker module.

  1402. # See: https://github.com/matrix-org/mjolnir#synapse-module

  1403. matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled: false

  1404. matrix_synapse_ext_spam_checker_mjolnir_antispam_git_repository_url: "https://github.com/matrix-org/mjolnir"

  1405. # renovate: datasource=docker depName=matrixdotorg/mjolnir

  1406. matrix_synapse_ext_spam_checker_mjolnir_antispam_git_version: "v1.9.2"

  1407. matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_invites: true

  1408. # Flag messages sent by servers/users in the ban lists as spam. Currently

  1409. # this means that spammy messages will appear as empty to users. Default

  1410. # false.

  1411. matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_messages: false

  1412. # Remove users from the user directory search by filtering Matrix IDs and

  1413. # display names by the entries in the user ban list. Default false.

  1414. matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_usernames: false

  1415. # The room IDs of the ban lists to honour. Unlike other parts of Mjolnir,

  1416. # this list cannot be room aliases or permalinks. This server is expected

  1417. # to already be joined to the room - Mjolnir will not automatically join

  1418. # these rooms.

  1419. # ["!qporfwt:example.com"]

  1420. matrix_synapse_ext_spam_checker_mjolnir_antispam_config_ban_lists: []

  1421. # A dictionary with various fields controlling max length.

  1422. # See https://github.com/matrix-org/mjolnir/blob/main/docs/synapse_module.md for details.

  1423. matrix_synapse_ext_spam_checker_mjolnir_antispam_config_message_max_length: {}

  1424. # Actual configuration passed to the mjolnir-antispam Synapse module

  1425. matrix_synapse_ext_spam_checker_mjolnir_antispam_config:

  1426.   block_invites: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_invites }}"

  1427.   block_messages: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_messages }}"

  1428.   block_usernames: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_usernames }}"

  1429.   ban_lists: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_ban_lists }}"

  1430.   message_max_length: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_message_max_length }}"

  1431. 

  1432. # Enable this to activate the E2EE disabling Synapse module.

  1433. # See: https://github.com/digitalentity/matrix_encryption_disabler

  1434. matrix_synapse_ext_encryption_disabler_enabled: false

  1435. matrix_synapse_ext_encryption_disabler_download_url: "https://raw.githubusercontent.com/digitalentity/matrix_encryption_disabler/cdc37a07441acb7c2a3288bcb29b376658d5e766/matrix_e2ee_filter.py"

  1436. # A list of server domain names for which to deny encryption if the event sender's domain matches the domain in the list.

  1437. # By default, with the configuration below, we prevent all homeserver users from initiating encryption in ANY room.

  1438. matrix_synapse_ext_encryption_disabler_deny_encryption_for_users_of: ["{{ matrix_domain }}"]

  1439. # A list of server domain names for which to deny encryption if the destination room ID's domain matches the domain in the list.

  1440. # By default, with the configuration below, we prevent locally-created encryption events by ANY user encrypt rooms on the homeserver.

  1441. # Note: foreign users with enough room privileges will still be able to send an encryption event to your rooms and encrypt them.

  1442. matrix_synapse_ext_encryption_disabler_deny_encryption_for_rooms_of: ["{{ matrix_domain }}"]

  1443. # Specifies whether the power levels event (setting) provided during room creation should be patched.

  1444. # This makes it impossible for anybody (locally or over federation) from enabling room encryption

  1445. # for the lifetime of rooms created while this setting is enabled (irreversible).

  1446. # Enabling this may have incompatiblity consequences with servers / clients.

  1447. # Familiarize yourself with the caveats upstream: https://github.com/digitalentity/matrix_encryption_disabler

  1448. matrix_synapse_ext_encryption_disabler_patch_power_levels: false

  1449. matrix_synapse_ext_encryption_config: "{{ matrix_synapse_ext_encryption_config_yaml | from_yaml }}"

  1450. matrix_synapse_ext_encryption_config_yaml: |

  1451.   deny_encryption_for_users_of: {{ matrix_synapse_ext_encryption_disabler_deny_encryption_for_users_of | to_json }}

  1452.   deny_encryption_for_rooms_of: {{ matrix_synapse_ext_encryption_disabler_deny_encryption_for_rooms_of | to_json }}

  1453.   patch_power_levels: {{ matrix_synapse_ext_encryption_disabler_patch_power_levels | to_json }}

  1454. 

  1455. 

  1456. # matrix_synapse_ext_synapse_s3_storage_provider_enabled controls whether to enable https://github.com/matrix-org/synapse-s3-storage-provider

  1457. # Installing it requires building a customized Docker image for Synapse (see `matrix_synapse_container_image_customizations_enabled`).

  1458. # Enabling this will enable customizations and inject the appropriate Dockerfile clauses for installing synapse-s3-storage-provider.

  1459. matrix_synapse_ext_synapse_s3_storage_provider_enabled: false

  1460. matrix_synapse_ext_synapse_s3_storage_provider_version: 1.5.0

  1461. # Controls whether media from this (local) server is stored in s3-storage-provider

  1462. matrix_synapse_ext_synapse_s3_storage_provider_store_local: true

  1463. # Controls whether media from remote servers is stored in s3-storage-provider

  1464. matrix_synapse_ext_synapse_s3_storage_provider_store_remote: true

  1465. # Controls whether files are stored to S3 at the same time they are stored on the local filesystem.

  1466. # For slightly improved reliability, consider setting this to `true`.

  1467. # Even with asynchronous uploading to S3 (`false` value), data loss shouldn't be possible,

  1468. # because the local filesystem is a reliable data store anyway.

  1469. matrix_synapse_ext_synapse_s3_storage_provider_store_synchronous: false

  1470. matrix_synapse_ext_synapse_s3_storage_provider_config_bucket: ''

  1471. # Prefix for all media in bucket, can't be changed once media has been uploaded.

  1472. # Useful if sharing the bucket between Synapses

  1473. # Example value: prefix/to/files/in/bucket

  1474. matrix_synapse_ext_synapse_s3_storage_provider_config_prefix: ''

  1475. matrix_synapse_ext_synapse_s3_storage_provider_config_region_name: ''

  1476. matrix_synapse_ext_synapse_s3_storage_provider_config_endpoint_url: ''

  1477. matrix_synapse_ext_synapse_s3_storage_provider_config_access_key_id: ''

  1478. matrix_synapse_ext_synapse_s3_storage_provider_config_secret_access_key: ''

  1479. # Enable this to use EC2 instance profile metadata to grab IAM credentials instead of passing credentials directly

  1480. # via matrix_synapse_ext_synapse_s3_storage_provider_config_access_key_id and matrix_synapse_ext_synapse_s3_storage_provider_config_secret_access_key

  1481. matrix_synapse_ext_synapse_s3_storage_provider_config_ec2_instance_profile: false

  1482. matrix_synapse_ext_synapse_s3_storage_provider_config_sse_customer_enabled: false

  1483. matrix_synapse_ext_synapse_s3_storage_provider_config_sse_customer_key: ''

  1484. matrix_synapse_ext_synapse_s3_storage_provider_config_sse_customer_algo: 'AES256'

  1485. matrix_synapse_ext_synapse_s3_storage_provider_config_storage_class: STANDARD

  1486. matrix_synapse_ext_synapse_s3_storage_provider_config_threadpool_size: 40

  1487. # matrix_synapse_ext_synapse_s3_storage_provider_update_db_day_count is a day value (number) for the `s3_media_upload update-db` command.

  1488. # It specifies how old files need to have been inactive to be eligible for migration from the local filesystem to the S3 data store.

  1489. # By default, we use `0` which says "all files are eligible for migration".

  1490. matrix_synapse_ext_synapse_s3_storage_provider_update_db_day_count: 0

  1491. # Specifies how often periodic migration (`matrix-synapse-s3-storage-provider-migrate.timer`) will run.

  1492. # This is a systemd timer OnCalendar definition. Learn more here: https://man.archlinux.org/man/systemd.time.7#CALENDAR_EVENTS

  1493. matrix_synapse_ext_synapse_s3_storage_provider_periodic_migration_schedule: '*-*-* 05:00:00'

  1494. 

  1495. # Synapse module to automatically accept room invites.

  1496. #

  1497. # Since Synapse v1.109.0 (https://github.com/element-hq/synapse/pull/17147),

  1498. # this functionality has been merged into Synapse. See `matrix_synapse_auto_accept_invites_enabled`.

  1499. #

  1500. # See: https://github.com/matrix-org/synapse-auto-accept-invite

  1501. # Installing it requires building a customized Docker image for Synapse (see `matrix_synapse_container_image_customizations_enabled`).

  1502. # Enabling this will enable customizations and inject the appropriate Dockerfile clauses for installing synapse-auto-accept-invite.

  1503. matrix_synapse_ext_synapse_auto_accept_invite_enabled: false

  1504. matrix_synapse_ext_synapse_auto_accept_invite_version: 1.1.3

  1505. # Specifies whether only direct messages (1:1 rooms) will be auto accepted.

  1506. matrix_synapse_ext_synapse_auto_accept_invite_accept_invites_only_direct_messages: false

  1507. # Specifies whether only invites from local users will be auto accepted.

  1508. matrix_synapse_ext_synapse_auto_accept_invite_accept_invites_only_from_local_users: false

  1509. # When Synapse workers enabled it is possible (but not required) to assign a worker to run this module on (null = main process).

  1510. matrix_synapse_ext_synapse_auto_accept_invite_worker_to_run_on: null

  1511. 

  1512. # Specifies whether an external media repository is enabled.

  1513. # If it is, the Synapse media repo and media-repo workers will be disabled automatically.

  1514. matrix_synapse_ext_media_repo_enabled: false

  1515. 

  1516. matrix_s3_media_store_enabled: false

  1517. matrix_s3_media_store_custom_endpoint_enabled: false

  1518. matrix_s3_goofys_docker_image: "{{ matrix_s3_goofys_docker_image_registry_prefix }}ewoutp/goofys:latest"

  1519. matrix_s3_goofys_docker_image_registry_prefix: "{{ matrix_s3_goofys_docker_image_registry_prefix_upstream }}"

  1520. matrix_s3_goofys_docker_image_registry_prefix_upstream: "{{ matrix_s3_goofys_docker_image_registry_prefix_upstream_default }}"

  1521. matrix_s3_goofys_docker_image_registry_prefix_upstream_default: "docker.io/"

  1522. matrix_s3_goofys_docker_image_force_pull: "{{ matrix_s3_goofys_docker_image.endswith(':latest') }}"

  1523. matrix_s3_media_store_custom_endpoint: "your-custom-endpoint"

  1524. matrix_s3_media_store_bucket_name: "your-bucket-name"

  1525. matrix_s3_media_store_aws_access_key: "your-aws-access-key"

  1526. matrix_s3_media_store_aws_secret_key: "your-aws-secret-key"

  1527. matrix_s3_media_store_region: "eu-central-1"

  1528. matrix_s3_media_store_path: "{{ matrix_synapse_media_store_path }}"

  1529. 

  1530. # Controls whether the self-check feature should validate SSL certificates.

  1531. matrix_synapse_self_check_validate_certificates: true

  1532. 

  1533. # Controls whether searching the public room list is enabled.

  1534. matrix_synapse_enable_room_list_search: true

  1535. 

  1536. # Controls who's allowed to create aliases on this server.

  1537. matrix_synapse_alias_creation_rules:

  1538.   - user_id: "*"

  1539.     alias: "*"

  1540.     room_id: "*"

  1541.     action: allow

  1542. 

  1543. # Controls who can publish and which rooms can be published in the public room list.

  1544. matrix_synapse_room_list_publication_rules:

  1545.   - user_id: "*"

  1546.     alias: "*"

  1547.     room_id: "*"

  1548.     action: allow

  1549. 

  1550. matrix_synapse_default_room_version: "10"

  1551. 

  1552. # Controls whether leaving a room will automatically forget it.

  1553. # The upstream default is `false`, but we try to make Synapse less wasteful of resources, so we do things differently.

  1554. # Also see: `matrix_synapse_forgotten_room_retention_period`

  1555. matrix_synapse_forget_rooms_on_leave: true

  1556. 

  1557. # Controls the Synapse `modules` list.

  1558. # You can define your own list of modules here. See the `modules` syntax in `homeserver.yaml.j2`

  1559. # Certain Synapse extensions that you can enable below auto-inject themselves into `matrix_synapse_modules` at runtime.

  1560. matrix_synapse_modules: []

  1561. 

  1562. # matrix_synapse_media_storage_providers contains the Synapse `media_storage_providers` configuration setting.

  1563. # To add your own custom `media_storage_providers`, use `matrix_synapse_media_storage_providers_custom`.

  1564. matrix_synapse_media_storage_providers: "{{ matrix_synapse_media_storage_providers_auto + matrix_synapse_media_storage_providers_custom }}"

  1565. 

  1566. # matrix_synapse_media_storage_providers_auto contains a list of storage providers that are added by the playbook based on other configuration

  1567. matrix_synapse_media_storage_providers_auto: |

  1568.   {{

  1569.     []

  1570.     +

  1571.     [

  1572.       lookup('ansible.builtin.template', role_path + '/templates/synapse/ext/s3-storage-provider/media_storage_provider.yaml.j2') | from_yaml

  1573.     ] if matrix_synapse_ext_synapse_s3_storage_provider_enabled else []

  1574.   }}

  1575. 

  1576. # matrix_synapse_media_storage_providers_custom contains your own custom list of storage providers.

  1577. # You're meant to define each custom module as valid keys and values, not as a YAML string that needs to be parsed.

  1578. #

  1579. # Example:

  1580. # matrix_synapse_media_storage_providers_custom:

  1581. # - module: module.SomeModule

  1582. #   store_local: True

  1583. #   # …

  1584. matrix_synapse_media_storage_providers_custom: []

  1585. 

  1586. matrix_synapse_encryption_enabled_by_default_for_room_type: "off"

  1587. 

  1588. matrix_synapse_trusted_key_servers:

  1589.   - server_name: "matrix.org"

  1590. 

  1591. 

  1592. # Enable the following to disable the warning that is emitted when the

  1593. # matrix_synapse_trusted_key_servers include 'matrix.org'. See above.

  1594. matrix_synapse_suppress_key_server_warning: false

  1595. 

  1596. matrix_synapse_redaction_retention_period: 7d

  1597. 

  1598. # Controls how long to keep locally forgotten rooms before purging them from the DB.

  1599. # Defaults to `null`, meaning it's disabled.

  1600. # Also see: `matrix_synapse_forget_rooms_on_leave`

  1601. # Example value: 28d

  1602. matrix_synapse_forgotten_room_retention_period: 28d

  1603. 

  1604. matrix_synapse_user_ips_max_age: 28d

  1605. 

  1606. 

  1607. matrix_synapse_rust_synapse_compress_state_docker_image: "{{ matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix }}mb-saces/rust-synapse-tools:v0.0.1"

  1608. matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix: "{{ matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix_upstream }}"

  1609. matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix_upstream: "{{ matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix_upstream_default }}"

  1610. matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix_upstream_default: "registry.gitlab.com/"

  1611. matrix_synapse_rust_synapse_compress_state_docker_image_force_pull: "{{ matrix_synapse_rust_synapse_compress_state_docker_image.endswith(':stable') or matrix_synapse_rust_synapse_compress_state_docker_image.endswith(':latest') }}"

  1612. 

  1613. matrix_synapse_rust_synapse_compress_state_base_path: "{{ matrix_base_data_path }}/rust-synapse-compress-state"

  1614. matrix_synapse_rust_synapse_compress_state_synapse_compress_state_in_container_path: "/usr/local/bin/synapse_compress_state"

  1615. 

  1616. 

  1617. # Default Synapse configuration template which covers the generic use case.

  1618. # You can customize it by controlling the various variables inside it.

  1619. #

  1620. # For a more advanced customization, you can extend the default (see `matrix_synapse_configuration_extension_yaml`)

  1621. # or completely replace this variable with your own template.

  1622. matrix_synapse_configuration_yaml: "{{ lookup('template', 'templates/synapse/homeserver.yaml.j2') }}"

  1623. 

  1624. matrix_synapse_configuration_extension_yaml: |

  1625.   # Your custom YAML configuration for Synapse goes here.

  1626.   # This configuration extends the default starting configuration (`matrix_synapse_configuration_yaml`).

  1627.   #

  1628.   # You can override individual variables from the default configuration, or introduce new ones.

  1629.   #

  1630.   # If you need something more special, you can take full control by

  1631.   # completely redefining `matrix_synapse_configuration_yaml`.

  1632.   #

  1633.   # Example configuration extension follows:

  1634.   #

  1635.   # server_notices:

  1636.   #   system_mxid_localpart: notices

  1637.   #   system_mxid_display_name: "Server Notices"

  1638.   #   system_mxid_avatar_url: "mxc://example.com/oumMVlgDnLYFaPVkExemNVVZ"

  1639.   #   room_name: "Server Notices"

  1640. 

  1641. matrix_synapse_configuration_extension: "{{ matrix_synapse_configuration_extension_yaml | from_yaml if matrix_synapse_configuration_extension_yaml | from_yaml is mapping else {} }}"

  1642. 

  1643. # Holds the final Synapse configuration (a combination of the default and its extension).

  1644. # You most likely don't need to touch this variable. Instead, see `matrix_synapse_configuration_yaml`.

  1645. matrix_synapse_configuration: "{{ matrix_synapse_configuration_yaml | from_yaml | combine(matrix_synapse_configuration_extension, recursive=True) }}"

  1646. 

  1647. # Holds the path to the register-user script provided by the Matrix Authentication Service.

  1648. # When the Matrix Authentication Service is enabled, the register-user script from this role cannot be used

  1649. # and users will be pointed to the one provided by Matrix Authentication Service.

  1650. matrix_synapse_register_user_script_matrix_authentication_service_path: ""