--- homeserver.yaml.orig 2017-06-05 12:56:46.729514635 +0200 +++ homeserver.yaml 2018-04-17 13:40:25.760622831 +0200 @@ -4,10 +4,10 @@ # autogenerates on launch with your own SSL certificate + key pair # if you like. Any required intermediary certificates can be # appended after the primary certificate in hierarchical order. -tls_certificate_path: "/home/synapse/.synapse/erfurt.chat.tls.crt" +tls_certificate_path: "/home/synapse/ssl/fullchain.pem" # PEM encoded private key for TLS -tls_private_key_path: "/home/synapse/.synapse/erfurt.chat.tls.key" +tls_private_key_path: "/home/synapse/ssl/privkey.pem" # PEM dh parameters for ephemeral keys tls_dh_params_path: "/home/synapse/.synapse/erfurt.chat.tls.dh" @@ -50,7 +50,7 @@ pid_file: /home/synapse/.synapse/homeserver.pid # Whether to serve a web client from the HTTP/HTTPS root resource. -web_client: True +web_client: False # The root directory to server for the above web client. # If left undefined, synapse will serve the matrix-angular-sdk web client. @@ -59,7 +59,7 @@ # web_client_location: "/path/to/web/root" # The public-facing base URL for the client API (not including _matrix/...) -# public_baseurl: https://example.com:8448/ +public_baseurl: https://erfurt.chat:8448/ # Set the soft limit on the number of file descriptors synapse can use # Zero is used to indicate synapse should set the soft limit to the @@ -71,7 +71,9 @@ # Set the limit on the returned events in the timeline in the get # and sync operations. The default value is -1, means no upper limit. -# filter_timeline_limit: 5000 + +## activated by maddi +filter_timeline_limit: 500 # List of ports that Synapse should listen on, their purpose and their # configuration. @@ -85,11 +87,11 @@ # Local addresses to listen on. # This will listen on all IPv4 addresses by default. bind_addresses: - - '0.0.0.0' + #- '0.0.0.0' # Uncomment to listen on all IPv6 interfaces # N.B: On at least Linux this will also listen on all IPv4 # addresses, so you will need to comment out the line above. - # - '::' + - '::' # This is a 'http' listener, allows us to specify 'resources'. type: http @@ -123,7 +125,7 @@ bind_addresses: ['0.0.0.0'] type: http - x_forwarded: false + x_forwarded: True resources: - names: [client, webclient] @@ -141,14 +143,18 @@ # Database configuration database: # The database engine name - name: "sqlite3" + name: "psycopg2" # Arguments to pass to the engine args: - # Path to the database - database: "/home/synapse/.synapse/homeserver.db" + #user: synapse + database: synapse + #host: localhost + #password: + cp_min: 5 + cp_max: 25 # Number of events to cache in memory. -event_cache_size: "10K" +event_cache_size: "1K" @@ -156,7 +162,7 @@ verbose: 0 # File to write logging to. Ignored if log_config is specified. -log_file: "/home/synapse/.synapse/homeserver.log" +log_file: "/home/synapse/.synapse/log/homeserver.log" # A yaml python logging config file log_config: "/home/synapse/.synapse/erfurt.chat.log.config" @@ -171,7 +177,9 @@ rc_message_burst_count: 10.0 # The federation window size in milliseconds -federation_rc_window_size: 1000 +## edit by maddi +# federation_rc_window_size: 2000 +federation_rc_window_size: 2000 # The number of federation requests from a single server in a window # before the server will delay processing the request. @@ -183,14 +191,19 @@ # The maximum number of concurrent federation requests allowed # from a single server -federation_rc_reject_limit: 50 +## edit by maddi +# federation_rc_reject_limit: 50 +federation_rc_reject_limit: 10 # The number of federation requests to concurrently process from a # single server -federation_rc_concurrent: 3 - - - +#federation_rc_concurrent: 3 +## edit by maddi +federation_rc_concurrent: 1 + +## add by maddi +federation_domain_whitelist: ['erfurt.chat','matrix.ffggrz.de','bau-ha.us','zner0l.de','byteschmeisser.de'] + # Directory where uploaded images and attachments are stored. media_store_path: "/home/synapse/.synapse/media_store" @@ -231,7 +244,7 @@ # Is the preview URL API enabled? If enabled, you *must* specify # an explicit url_preview_ip_range_blacklist of IPs that the spider is # denied from accessing. -url_preview_enabled: False +url_preview_enabled: True # List of IP address CIDR ranges that the URL preview spider is denied # from accessing. There are no defaults: you must explicitly @@ -241,14 +254,14 @@ # synapse to issue arbitrary GET requests to your internal services, # causing serious security issues. # -# url_preview_ip_range_blacklist: -# - '127.0.0.0/8' -# - '10.0.0.0/8' -# - '172.16.0.0/12' -# - '192.168.0.0/16' -# - '100.64.0.0/10' -# - '169.254.0.0/16' -# +url_preview_ip_range_blacklist: + - '127.0.0.0/8' + - '10.0.0.0/8' + - '172.16.0.0/12' + - '192.168.0.0/16' + - '100.64.0.0/10' + - '169.254.0.0/16' + # List of IP address CIDR ranges that the URL preview spider is allowed # to access even if they are specified in url_preview_ip_range_blacklist. # This is useful for specifying exceptions to wide-ranging blacklisted @@ -322,10 +335,10 @@ ## Turn ## # The public URIs of the TURN server to give to clients -turn_uris: [] +turn_uris: [ "turn:erfurt.chat:3478?transport=udp", "turn:erfurt.chat:3478?transport=tcp" ] # The shared secret used to compute passwords for the TURN server -turn_shared_secret: "YOUR_SHARED_SECRET" +turn_shared_secret: "$$$SECRET$$$" # The Username and password if the TURN server needs them and # does not use a token @@ -346,7 +359,7 @@ ## Registration ## # Enable registration for new users. -enable_registration: False +enable_registration: True # If set, allows registration by anyone who also has the shared # secret, even if registration is otherwise disabled. @@ -360,7 +373,7 @@ # Allows users to register as guests without a password/email/etc, and # participate in rooms hosted on this server which have been made # accessible to anonymous users. -allow_guest_access: False +allow_guest_access: True # The list of identity servers trusted to verify third party # identifiers by this server. @@ -388,7 +401,9 @@ # A list of application service config file to use -app_service_config_files: [] +#app_service_config_files: [ "ircbridge_registration.yaml" ] +## deactivated by maddi +app_service_config_files: [ ] macaroon_secret_key: "$$$SECRET$$$" @@ -402,7 +417,7 @@ signing_key_path: "/home/synapse/.synapse/erfurt.chat.signing.key" # The keys that the server used to sign messages with but won't use -# to sign new messages. E.g. it has lost its private key +# to sign new messages. dE.g. it has lost its private key old_signing_keys: {} # "ed25519:auto": # # Base64 encoded public key @@ -461,7 +476,8 @@ enabled: true # Uncomment and change to a secret random string for extra security. # DO NOT CHANGE THIS AFTER INITIAL SETUP! - #pepper: "" + pepper: "$$$SECRET$$$" + @@ -473,20 +489,20 @@ # If your SMTP server requires authentication, the optional smtp_user & # smtp_pass variables should be used # -#email: -# enable_notifs: false -# smtp_host: "localhost" -# smtp_port: 25 -# smtp_user: "exampleusername" -# smtp_pass: "examplepassword" -# require_transport_security: False -# notif_from: "Your Friendly %(app)s Home Server " -# app_name: Matrix -# template_dir: res/templates -# notif_template_html: notif_mail.html -# notif_template_text: notif_mail.txt -# notif_for_new_users: True -# riot_base_url: "http://localhost/riot" +email: + enable_notifs: True + smtp_host: "localhost" + smtp_port: 587 + smtp_user: "synapse@erfurt.chat" + smtp_pass: "$$$SECRET$$$" + require_transport_security: True + notif_from: "Your Friendly %(app)s Home Server " + app_name: Matrix + template_dir: /home/synapse/.synapse/res/templates/ + notif_template_html: notif_mail.html + notif_template_text: notif_mail.txt + notif_for_new_users: True + riot_base_url: "https://erfurt.chat/riot" # password_providers: