n0mad1k
7484a0e034
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
95 lines
2.1 KiB
Django/Jinja
95 lines
2.1 KiB
Django/Jinja
## Synapse Homeserver Configuration
|
|
## Generated by phantom
|
|
|
|
server_name: "{{ matrix_server_name }}"
|
|
public_baseurl: "https://{{ matrix_domain }}/"
|
|
pid_file: /var/run/matrix-synapse.pid
|
|
|
|
listeners:
|
|
- port: 8008
|
|
tls: false
|
|
type: http
|
|
x_forwarded: true
|
|
bind_addresses:
|
|
- '127.0.0.1'
|
|
resources:
|
|
- names: [client, federation]
|
|
compress: false
|
|
|
|
database:
|
|
name: sqlite3
|
|
args:
|
|
database: /var/lib/matrix-synapse/homeserver.db
|
|
|
|
log_config: "/etc/matrix-synapse/log.yaml"
|
|
media_store_path: /var/lib/matrix-synapse/media
|
|
signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"
|
|
|
|
registration_shared_secret: "{{ matrix_signing_key }}"
|
|
enable_registration: {{ matrix_registration_enabled | lower }}
|
|
{% if not matrix_registration_enabled %}
|
|
enable_registration_without_verification: false
|
|
{% endif %}
|
|
allow_guest_access: false
|
|
|
|
form_secret: "{{ matrix_form_secret | default(matrix_signing_key[:28]) }}"
|
|
macaroon_secret_key: "{{ matrix_macaroon_secret | default(matrix_signing_key[:30]) }}"
|
|
|
|
trusted_key_servers:
|
|
- server_name: "matrix.org"
|
|
|
|
# Rate limiting
|
|
rc_message:
|
|
per_second: 0.2
|
|
burst_count: 10
|
|
rc_login:
|
|
address:
|
|
per_second: 0.17
|
|
burst_count: 3
|
|
account:
|
|
per_second: 0.17
|
|
burst_count: 3
|
|
rc_registration:
|
|
per_second: 0.17
|
|
burst_count: 3
|
|
rc_admin_redaction:
|
|
per_second: 1
|
|
burst_count: 50
|
|
|
|
# Privacy / access control
|
|
require_auth_for_profile_requests: true
|
|
limit_profile_requests_to_users_who_share_rooms: true
|
|
allow_public_rooms_without_auth: false
|
|
allow_public_rooms_over_federation: false
|
|
|
|
# Media
|
|
enable_media_repo: true
|
|
max_upload_size: 50M
|
|
max_image_pixels: 32M
|
|
|
|
# Telemetry
|
|
enable_metrics: false
|
|
report_stats: false
|
|
|
|
# Session / auth hardening
|
|
session_lifetime: 24h
|
|
bcrypt_rounds: 12
|
|
|
|
# Federation TLS
|
|
federation_client_minimum_tls_version: 1.2
|
|
|
|
# URL preview with SSRF protection
|
|
url_preview_enabled: true
|
|
url_preview_ip_range_blacklist:
|
|
- '127.0.0.0/8'
|
|
- '10.0.0.0/8'
|
|
- '172.16.0.0/12'
|
|
- '192.168.0.0/16'
|
|
- '100.64.0.0/10'
|
|
- '169.254.0.0/16'
|
|
- '::1/128'
|
|
- 'fe80::/10'
|
|
- 'fc00::/7'
|
|
|
|
suppress_key_server_warning: true
|