Synapse config.
This commit is contained in:
mustard
parent
60134f2833
commit
11b3595a85
3 changed files with 225 additions and 0 deletions
74
config/nginx/docker-compose-synapse.yaml
Normal file
74
config/nginx/docker-compose-synapse.yaml
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
services:
|
||||
reverse-proxy:
|
||||
image: ghcr.io/nginxinc/nginx-unprivileged:mainline-alpine-slim
|
||||
container_name: reverse_proxy
|
||||
restart: always
|
||||
ports:
|
||||
- "443:8443"
|
||||
volumes:
|
||||
- ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
- ./config/nginx/tls.conf:/etc/nginx/conf.d/tls.conf:ro
|
||||
- ./data/certs:/etc/nginx/ssl:ro
|
||||
networks:
|
||||
- frontend
|
||||
synapse:
|
||||
depends_on:
|
||||
- postgres
|
||||
restart: always
|
||||
image: "ghcr.io/polarix-containers/synapse:latest"
|
||||
user: "${UID:-3000}:${GID:-3000}"
|
||||
container_name: "synapse"
|
||||
volumes:
|
||||
- ./config/synapse/homeserver.yaml:/config/homeserver.yaml:ro,z
|
||||
- ./data/synapse:/data:z
|
||||
# - ./data/certs:/certs:ro
|
||||
networks:
|
||||
backend:
|
||||
frontend:
|
||||
aliases:
|
||||
- synapse
|
||||
ports:
|
||||
- "8448:8448"
|
||||
secrets:
|
||||
- database.yml
|
||||
- experimental-synapse.homelab0ne.xyz.signing.key
|
||||
environment:
|
||||
SYNAPSE_SERVER_NAME: "experimental-synapse.homelab0ne.xyz"
|
||||
SYNAPSE_REPORT_STATS: "yes"
|
||||
SYNAPSE_HTTP_PORT: "8448"
|
||||
command:
|
||||
- run
|
||||
- "--config-path"
|
||||
- "/config/homeserver.yaml"
|
||||
- "--config-path"
|
||||
- "/var/run/secrets/database.yml"
|
||||
acme.sh:
|
||||
command:
|
||||
- daemon
|
||||
container_name: acme.sh
|
||||
environment:
|
||||
DEDYN_TOKEN: "${DEDYN_TOKEN}"
|
||||
image: 'ghcr.io/polarix-containers/acme.sh:latest'
|
||||
restart: always
|
||||
volumes:
|
||||
- ./data/acme.sh:/acme.sh:Z
|
||||
- ./data/certs:/certs:z
|
||||
postgres:
|
||||
container_name: postgres
|
||||
image: cgr.dev/chainguard/postgres:latest
|
||||
volumes:
|
||||
- ./data/postgres:/var/lib/postgresql/data:Z
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
|
||||
networks:
|
||||
- backend
|
||||
networks:
|
||||
backend:
|
||||
frontend:
|
||||
driver: bridge
|
||||
secrets:
|
||||
experimental-synapse.homelab0ne.xyz.signing.key:
|
||||
file: ./secrets/experimental-synapse.homelab0ne.xyz.signing.key
|
||||
database.yml:
|
||||
file: ./secrets/synapse_database.yaml
|
||||
68
config/nginx/synapse.conf
Normal file
68
config/nginx/synapse.conf
Normal file
|
|
@ -0,0 +1,68 @@
|
|||
worker_processes auto;
|
||||
|
||||
error_log /var/log/nginx/error.log notice;
|
||||
pid /tmp/nginx.pid;
|
||||
|
||||
|
||||
events
|
||||
{
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
|
||||
http
|
||||
{
|
||||
proxy_temp_path /tmp/proxy_temp;
|
||||
client_body_temp_path /tmp/client_temp;
|
||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
||||
scgi_temp_path /tmp/scgi_temp;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
|
||||
keepalive_timeout 65;
|
||||
|
||||
#gzip on;
|
||||
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
|
||||
|
||||
server
|
||||
{
|
||||
listen 8443 ssl;
|
||||
listen [::]:8443 ssl;
|
||||
ssl_certificate /etc/nginx/ssl/cert.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/key.pem;
|
||||
server_name experimental-synapse.homelab0ne.xyz;
|
||||
location /
|
||||
{
|
||||
proxy_pass http://synapse:8448;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
# Nginx by default only allows file uploads up to 1M in size
|
||||
# Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
|
||||
client_max_body_size 50M;
|
||||
proxy_http_version 1.1;
|
||||
}
|
||||
|
||||
location /.well-known/_matrix/server {
|
||||
return 200 '{ "m.homeserver": "experimental-synapse.homelab0ne.xyz:443" }';
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
83
config/synapse/homeserver.yaml
Normal file
83
config/synapse/homeserver.yaml
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
# Configuration file for Synapse.
|
||||
#
|
||||
# This is a YAML file: see [1] for a quick introduction. Note in particular
|
||||
# that *indentation is important*: all the elements of a list or dictionary
|
||||
# should have the same indentation.
|
||||
#
|
||||
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
|
||||
#
|
||||
# For more information on how to configure Synapse, including a complete accounting of
|
||||
# each option, go to docs/usage/configuration/config_documentation.md or
|
||||
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
|
||||
server_name: "experimental-synapse.homelab0ne.xyz"
|
||||
pid_file: /data/homeserver.pid
|
||||
serve_server_wellknown: true
|
||||
listeners:
|
||||
- port: 8448
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
# bind_addresses: ['::1', '127.0.0.1']
|
||||
resources:
|
||||
- names: [client, federation]
|
||||
compress: false
|
||||
log_config: "/data/experimental-synapse.homelab0ne.xyz.log.config"
|
||||
media_store_path: /data/media_store
|
||||
report_stats: true
|
||||
signing_key_path: "/var/run/secrets/experimental-synapse.homelab0ne.xyz.signing.key"
|
||||
trusted_key_servers:
|
||||
- server_name: "matrix.org"
|
||||
experimental_features:
|
||||
msc3026_enabled: true # "Busy" presence state
|
||||
msc3266_enabled: true # Room summary API
|
||||
msc3720_enabled: false # Account status endpoint
|
||||
msc2654_enabled: true # Unread counts
|
||||
msc2815_enabled: true # Allow room moderators to view redacted event content
|
||||
msc3391_enabled: true # Deleting account data
|
||||
msc3773_enabled: true # Notifications for threads
|
||||
msc3664_enabled: true # Notifications for relations
|
||||
msc3848_enabled: true # Introduce errcodes for specific event sending failures
|
||||
msc3881_enabled: true # Remotely toggle push notifications for another client
|
||||
msc3874_enabled: true # Filtering the /messages API by relation type
|
||||
msc3890_enabled: true # Remotely silence local notifications
|
||||
msc3381_polls_enabled: true # MSC3930: Polls push rules/notifications
|
||||
msc3912_enabled: true # Relation-based redactions
|
||||
msc1767_enabled: true # Extensible events
|
||||
msc3967_enabled: false # Do not require UIA when first uploading cross signing keys
|
||||
msc3981_recurse_relations: true # Recurse relations
|
||||
msc4010_push_rules_account_data: true # Do
|
||||
media_retention:
|
||||
local_media_lifetime: 1y
|
||||
remote_media_lifetime: 1y
|
||||
url_preview_enabled: true
|
||||
url_preview_ip_range_blacklist:
|
||||
- '127.0.0.0/8'
|
||||
- '10.0.0.0/8'
|
||||
- '172.16.0.0/12'
|
||||
- '192.168.0.0/16'
|
||||
- '100.64.0.0/10'
|
||||
- '192.0.0.0/24'
|
||||
- '169.254.0.0/16'
|
||||
- '192.88.99.0/24'
|
||||
- '198.18.0.0/15'
|
||||
- '192.0.2.0/24'
|
||||
- '198.51.100.0/24'
|
||||
- '203.0.113.0/24'
|
||||
- '224.0.0.0/4'
|
||||
- '::1/128'
|
||||
- 'fe80::/10'
|
||||
- 'fc00::/7'
|
||||
- '2001:db8::/32'
|
||||
- 'ff00::/8'
|
||||
- 'fec0::/10'
|
||||
allow_device_name_lookup_over_federation: true
|
||||
enable_registration: false
|
||||
retention:
|
||||
enabled: false
|
||||
redaction_retention_period: 30d
|
||||
forgotten_room_retention_period: 7d
|
||||
user_ips_max_age: 60d
|
||||
delete_stale_devices_after: 120d
|
||||
forget_rooms_on_leave: true
|
||||
|
||||
# vim:ft=yaml
|
||||
Loading…
Reference in a new issue