## Synapse Homeserver Configuration
## Generated by phantom

server_name: "{{ matrix_server_name }}"
public_baseurl: "https://{{ matrix_domain }}/"
pid_file: /var/run/matrix-synapse.pid

listeners:
  - port: 8008
    tls: false
    type: http
    x_forwarded: true
    bind_addresses:
      - '127.0.0.1'
    resources:
      - names: [client, federation]
        compress: false

database:
  name: sqlite3
  args:
    database: /var/lib/matrix-synapse/homeserver.db

log_config: "/etc/matrix-synapse/log.yaml"
media_store_path: /var/lib/matrix-synapse/media
signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"

registration_shared_secret: "{{ matrix_signing_key }}"
enable_registration: {{ matrix_registration_enabled | lower }}
{% if not matrix_registration_enabled %}
enable_registration_without_verification: false
{% endif %}
allow_guest_access: false

form_secret: "{{ matrix_form_secret | default(matrix_signing_key[:28]) }}"
macaroon_secret_key: "{{ matrix_macaroon_secret | default(matrix_signing_key[:30]) }}"

trusted_key_servers:
  - server_name: "matrix.org"

# Rate limiting
rc_message:
  per_second: 0.2
  burst_count: 10
rc_login:
  address:
    per_second: 0.17
    burst_count: 3
  account:
    per_second: 0.17
    burst_count: 3
rc_registration:
  per_second: 0.17
  burst_count: 3
rc_admin_redaction:
  per_second: 1
  burst_count: 50

# Privacy / access control
require_auth_for_profile_requests: true
limit_profile_requests_to_users_who_share_rooms: true
allow_public_rooms_without_auth: false
allow_public_rooms_over_federation: false

# Media
enable_media_repo: true
max_upload_size: 50M
max_image_pixels: 32M

# Telemetry
enable_metrics: false
report_stats: false

# Session / auth hardening
session_lifetime: 24h
bcrypt_rounds: 12

# Federation TLS
federation_client_minimum_tls_version: 1.2

# URL preview with SSRF protection
url_preview_enabled: true
url_preview_ip_range_blacklist:
  - '127.0.0.0/8'
  - '10.0.0.0/8'
  - '172.16.0.0/12'
  - '192.168.0.0/16'
  - '100.64.0.0/10'
  - '169.254.0.0/16'
  - '::1/128'
  - 'fe80::/10'
  - 'fc00::/7'

suppress_key_server_warning: true