From 838b869afc275ae26e39ada8b72f78b1f7f5c6dc Mon Sep 17 00:00:00 2001
From: H-Shay
In this manual, all top-level settings (ones with no indentation) are identified
-at the beginning of their section (i.e. "Config option: example_setting
") and
+at the beginning of their section (i.e. "### example_setting
") and
the sub-options, if any, are identified and listed in the body of the section.
In addition, each setting has an example of its usage, with the proper indentation
shown.
See here for more documentation on how to configure or create custom modules for Synapse.
Config option: modules
modules
Use the module
sub-option to add modules under this option to extend functionality.
The module
setting then has a sub-option, config
, which can be used to define some configuration
for the module
.
module
.
Define your homeserver name and other base options.
Config option: server_name
server_name
This sets the public-facing domain of the server.
The server_name
name will appear at the end of usernames and room addresses
created on your server. For example if the server_name
was example.com,
@@ -279,19 +279,19 @@ lowercase and may contain an explicit port.
server_name: localhost:8080
Config option: pid_file
pid_file
When running Synapse as a daemon, the file to store the pid in. Defaults to none.
Example configuration:
pid_file: DATADIR/homeserver.pid
Config option: web_client_location
web_client_location
The absolute URL to the web client which /
will redirect to. Defaults to none.
Example configuration:
web_client_location: https://riot.example.com/
Config option: public_baseurl
public_baseurl
The public-facing base URL that clients use to access this Homeserver (not including _matrix/...). This is the same URL a user might enter into the 'Custom Homeserver URL' field on their client. If you use Synapse with a @@ -303,7 +303,7 @@ Otherwise, it should be the URL to reach Synapse's client HTTP listener (see
public_baseurl: https://example.com/
Config option: serve_server_wellknown
serve_server_wellknown
By default, other servers will try to reach our server on port 8448, which can be inconvenient in some environments.
Provided https://<server_name>/
on port 443 is routed to Synapse, this
@@ -316,7 +316,7 @@ information.
serve_server_wellknown: true
Config option: soft_file_limit
soft_file_limit
Set the soft limit on the number of file descriptors synapse can use. Zero is used to indicate synapse should set the soft limit to the hard limit. Defaults to 0.
@@ -324,7 +324,7 @@ Defaults to 0.soft_file_limit: 3
Config option: presence
presence
Presence tracking allows users to see the state (e.g online/offline)
of other local and remote users. Set the enabled
sub-option to false to
disable presence tracking on this homeserver. Defaults to true.
@@ -334,7 +334,7 @@ This option replaces the previous top-level 'use_presence' option.
Config option: require_auth_for_profile_requests
require_auth_for_profile_requests
Whether to require authentication to retrieve profile data (avatars, display names) of other
users through the client API. Defaults to false. Note that profile data is also available
via the federation API, unless allow_profile_lookup_over_federation
is set to false.
allow_profile_lookup_over_federation
require_auth_for_profile_requests: true
Config option: limit_profile_requests_to_users_who_share_rooms
limit_profile_requests_to_users_who_share_rooms
Use this option to require a user to share a room with another user in order to retrieve their profile information. Only checked on Client-Server requests. Profile requests from other servers should be checked by the @@ -351,7 +351,7 @@ requesting server. Defaults to false.
limit_profile_requests_to_users_who_share_rooms: true
Config option: include_profile_data_on_invite
include_profile_data_on_invite
Use this option to prevent a user's profile data from being retrieved and displayed in a room until they have joined it. By default, a user's profile data is included in an invite event, regardless of the values @@ -361,7 +361,7 @@ Defaults to true.
include_profile_data_on_invite: false
Config option: allow_public_rooms_without_auth
allow_public_rooms_without_auth
If set to true, removes the need for authentication to access the server's public rooms directory through the client API, meaning that anyone can query the room directory. Defaults to false.
@@ -369,14 +369,14 @@ query the room directory. Defaults to false.allow_public_rooms_without_auth: true
Config option: allow_public_rooms_without_auth
allow_public_rooms_without_auth
If set to true, allows any other homeserver to fetch the server's public rooms directory via federation. Defaults to false.
Example configuration:
allow_public_rooms_over_federation: true
Config option: default_room_version
default_room_version
The default room version for newly created rooms on this server.
Known room versions are listed here
For example, for room version 1, default_room_version
should be set
@@ -386,14 +386,14 @@ to "1".
default_room_version: "8"
Config option: gc_thresholds
gc_thresholds
The garbage collection threshold parameters to pass to gc.set_threshold
, if defined.
Defaults to none.
Example configuration:
gc_thresholds: [700, 10, 10]
Config option: gc_min_interval
gc_min_interval
The minimum time in seconds between each GC for a generation, regardless of
the GC thresholds. This ensures that we don't do GC too frequently. A value of [1s, 10s, 30s]
indicates that a second must pass between consecutive generation 0 GCs, etc.
gc_min_interval: [0.5s, 30s, 1m]
Config option: filter_timeline_limit
filter_timeline_limit
Set the limit on the returned events in the timeline in the get and sync operations. Defaults to 100. A value of -1 means no upper limit.
Example configuration:
filter_timeline_limit: 5000
Config option: block_non_admin_invites
block_non_admin_invites
Whether room invites to users on this server should be blocked (except those sent by local server admins). Defaults to false.
Example configuration:
block_non_admin_invites: true
Config option: enable_search
enable_search
If set to false, new messages will not be indexed for searching and users will receive errors when searching for messages. Defaults to true.
Example configuration:
enable_search: false
Config option: ip_range_blacklist
ip_range_blacklist
This option prevents outgoing requests from being sent to the specified blacklisted IP address CIDR ranges. If this option is not specified then it defaults to private IP address ranges (see the example below).
@@ -456,7 +456,7 @@ listed here, since they correspond to unroutable addresses.) - 'fec0::/10'Config option: ip_range_whitelist
ip_range_whitelist
List of IP address CIDR ranges that should be allowed for federation, identity servers, push servers, and for checking key validity for third-party invite events. This is useful for specifying exceptions to @@ -469,7 +469,7 @@ list.
- '192.168.1.1'Config option: listeners
listeners
List of ports that Synapse should listen on, their purpose and their configuration.
Sub-options for each listener include:
@@ -593,7 +593,7 @@ additional endpoints which should be loaded via dynamic modules. type: manholeConfig option: manhole_settings
manhole_settings
Connection settings for the manhole. You can find more information on the manhole here. Manhole sub-options include:
Config option: dummy_events_threshold
dummy_events_threshold
Forward extremities can build up in a room due to networking delays between homeservers. Once this happens in a large room, calculation of the state of that room can become quite expensive. To mitigate this, once the number of @@ -634,13 +634,13 @@ delete any device that hasn't been accessed for more than the specified amount o
Useful options for Synapse admins.
Config option: admin_contact
admin_contact
How to reach the server admin, used in ResourceLimitError
. Defaults to none.
Example configuration:
admin_contact: 'mailto:admin@server.com'
Config option: hs_disabled
and hs_disabled_message
hs_disabled
and hs_disabled_message
Blocks users from connecting to the homeserver and provides a human-readable reason why the connection was blocked. Defaults to false.
Example configuration:
@@ -648,7 +648,7 @@ why the connection was blocked. Defaults to false. hs_disabled_message: 'Reason for why the HS is blocked'Config option: limit_usage_by_mau
limit_usage_by_mau
This option disables/enables monthly active user blocking. Used in cases where the admin or
server owner wants to limit to the number of monthly active users. When enabled and a limit is
reached the server returns a ResourceLimitError
with error type Codes.RESOURCE_LIMIT_EXCEEDED
.
@@ -657,14 +657,14 @@ Defaults to false. If this is enabled, a value for max_mau_value
mu
limit_usage_by_mau: true
Config option: max_mau_value
max_mau_value
This option sets the hard limit of monthly active users above which the server will start
blocking user actions if limit_usage_by_mau
is enabled. Defaults to 0.
Example configuration:
max_mau_value: 50
Config option: mau_trial_days
mau_trial_days
The option mau_trial_days
is a means to add a grace period for active users. It
means that users must be active for the specified number of days before they
can be considered active and guards against the case where lots of users
@@ -674,7 +674,7 @@ session. Defaults to 0.
mau_trial_days: 5
Config option: mau_appservice_trial_days
mau_appservice_trial_days
The option mau_appservice_trial_days
is similar to mau_trial_days
, but applies a different
trial number if the user was registered by an appservice. A value
of 0 means no trial days are applied. Appservices not listed in this dictionary
@@ -685,7 +685,7 @@ use the value of mau_trial_days
instead.
Config option: mau_limit_alerting
mau_limit_alerting
The option mau_limit_alerting
is a means of limiting client-side alerting
should the mau limit be reached. This is useful for small instances
where the admin has 5 mau seats (say) for 5 specific people and no
@@ -695,7 +695,7 @@ means that alerting is enabled.
mau_limit_alerting: false
Config option: mau_stats_only
mau_stats_only
If enabled, the metrics for the number of monthly active users will
be populated, however no one will be limited based on these numbers. If limit_usage_by_mau
is true, this is implied to be true. Defaults to false.
mau_stats_only: true
Config option: mau_limit_reserved_threepids
mau_limit_reserved_threepids
Sometimes the server admin will want to ensure certain accounts are
never blocked by mau checking. These accounts are specified by this option.
Defaults to none. Add accounts by specifying the medium
and address
of the
@@ -714,14 +714,14 @@ reserved threepid (3rd party identifier).
Config option: server_context
server_context
This option is used by phonehome stats to group together related servers. Defaults to none.
Example configuration:
server_context: context
Config option: limit_remote_rooms
limit_remote_rooms
When this option is enabled, the room "complexity" will be checked before a user joins a new remote room. If it is above the complexity limit, the server will disallow joining, or will instantly leave. This is useful for homeservers that are @@ -743,14 +743,14 @@ users in the room.
admins_can_join: trueConfig option: require_membership_for_aliases
require_membership_for_aliases
Whether to require a user to be in the room to add an alias to it. Defaults to true.
Example configuration:
require_membership_for_aliases: false
Config option: allow_per_room_profiles
allow_per_room_profiles
Whether to allow per-room membership profiles through the sending of membership events with profile information that differs from the target's global profile. Defaults to true.
@@ -758,7 +758,7 @@ Defaults to true.allow_per_room_profiles: false
Config option: max_avatar_size
max_avatar_size
The largest permissible file size in bytes for a user avatar. Defaults to no restriction. Use M for MB and K for KB.
Note that user avatar changes will not work if this is set without using Synapse's media repository.
@@ -766,7 +766,7 @@ Use M for MB and K for KB.max_avatar_size: 10M
Config option: allowed_avatar_mimetypes
allowed_avatar_mimetypes
The MIME types allowed for user avatars. Defaults to no restriction.
Note that user avatar changes will not work if this is set without using Synapse's media repository.
@@ -774,7 +774,7 @@ using Synapse's media repository.allowed_avatar_mimetypes: ["image/png", "image/jpeg", "image/gif"]
Config option: redaction_retention_period
redaction_retention_period
How long to keep redacted events in unredacted form in the database. After this period redacted events get replaced with their redacted form in the DB.
Defaults to 7d
. Set to null
to disable.
redaction_retention_period: 28d
Config option: user_ips_max_age
user_ips_max_age
How long to track users' last seen time and IPs in the database.
Defaults to 28d
. Set to null
to disable clearing out of old rows.
Example configuration:
user_ips_max_age: 14d
Config option: request_token_inhibit_3pid_errors
request_token_inhibit_3pid_errors
Inhibits the /requestToken
endpoints from returning an error that might leak
information about whether an e-mail address is in use or not on this
homeserver. Defaults to false.
@@ -801,7 +801,7 @@ act as if no error happened and return a fake session ID ('sid') to clients.
request_token_inhibit_3pid_errors: true
Config option: next_link_domain_whitelist
next_link_domain_whitelist
A list of domains that the domain portion of next_link
parameters
must match.
This parameter is optionally provided by clients while requesting @@ -817,7 +817,7 @@ all domains.
next_link_domain_whitelist: ["matrix.org"]
Config option: templates
and custom_template_directory
templates
and custom_template_directory
These options define templates to use when generating email or HTML page contents.
The custom_template_directory
determines which directory Synapse will try to
find template files in to use to generate email or HTML page contents.
@@ -830,7 +830,7 @@ information about using custom templates.
Config option: retention
retention
This option and the associated options determine message retention policy at the server level.
Room admins and mods can define a retention period for their rooms using the @@ -902,7 +902,7 @@ configuration).
Options related to TLS.
Config option: tls_certificate_path
tls_certificate_path
This option specifies a PEM-encoded X509 certificate for TLS. This certificate, as of Synapse 1.0, will need to be a valid and verifiable certificate, signed by a recognised Certificate Authority. Defaults to none.
@@ -913,20 +913,20 @@ any intermediate certificates (for instance, if using certbot, usetls_certificate_path: "CONFDIR/SERVERNAME.tls.crt"
Config option: tls_private_key_path
tls_private_key_path
PEM-encoded private key for TLS. Defaults to none.
Example configuration:
tls_private_key_path: "CONFDIR/SERVERNAME.tls.key"
Config option: federation_verify_certificates
-Whether to verify TLS server certificates for outbound federation requests.
federation_verify_certificates
Whether to verify TLS server certificates for outbound federation requests.
Defaults to true. To disable certificate verification, set the option to false.
Example configuration:
federation_verify_certificates: false
Config option: federation_client_minimum_tls_version
federation_client_minimum_tls_version
The minimum TLS version that will be used for outbound federation requests.
Defaults to 1
. Configurable to 1
, 1.1
, 1.2
, or 1.3
. Note
that setting this value higher than 1.2
will prevent federation to most
@@ -936,7 +936,7 @@ entirely private federation setup and you can ensure TLS 1.3 support.
federation_client_minimum_tls_version: 1.2
Config option: federation_certificate_verification_whitelist
federation_certificate_verification_whitelist
Skip federation certificate verification on a given whitelist of domains.
This setting should only be used in very specific cases, such as @@ -950,7 +950,7 @@ of homeservers, you likely want to use a private CA instead.
- "*.onion"Config option: federation_custom_ca_list
federation_custom_ca_list
List of custom certificate authorities for federation traffic.
This setting should only normally be used within a private network of homeservers.
@@ -966,7 +966,7 @@ operating environment. Certificates must be in PEM format.Options related to federation.
Config option: federation_domain_whitelist
federation_domain_whitelist
Restrict federation to the given whitelist of domains. N.B. we recommend also firewalling your federation listener to limit inbound federation traffic as early as possible, rather than relying @@ -979,7 +979,7 @@ default is to whitelist everything.
- syd.example.comConfig option: federation_metrics_domains
federation_metrics_domains
Report prometheus metrics on the age of PDUs being sent to and received from the given domains. This can be used to give an idea of "delay" on inbound and outbound federation, though be aware that any delay can be due to problems @@ -991,7 +991,7 @@ at either end or with the intermediate network.
- example.comConfig option: allow_profile_lookup_over_federation
allow_profile_lookup_over_federation
Set to false to disable profile lookup over federation. By default, the Federation API allows other homeservers to obtain profile data of any user on this homeserver.
@@ -999,7 +999,7 @@ on this homeserver.allow_profile_lookup_over_federation: false
Config option: allow_device_name_lookup_over_federation
allow_device_name_lookup_over_federation
Set this option to true to allow device display name lookup over federation. By default, the Federation API prevents other homeservers from obtaining the display names of any user devices on this homeserver.
@@ -1010,14 +1010,14 @@ on this homeserver.Options related to caching
Config option: event_cache_size
event_cache_size
The number of events to cache in memory. Not affected by
caches.global_factor
. Defaults to 10K.
Example configuration:
event_cache_size: 15K
Config option: cache
and associated values
cache
and associated valuesA cache 'factor' is a multiplier that can be applied to each of Synapse's caches in order to increase or decrease the maximum number of entries that can be stored.
@@ -1109,7 +1109,7 @@ file in Synapse'scontrib
directory, you can send a SIGHUPDatabase
Config options related to database settings.
-Config option: database
+database
The database
setting defines the database that synapse uses to store all of
its data.
Associated sub-options:
@@ -1164,7 +1164,7 @@ see here.
Logging
Config options related to logging.
-Config option: log_config
+log_config
This option specifies a yaml python logging config file as described here.
Example configuration:
log_config: "CONFDIR/SERVERNAME.log.config"
@@ -1178,7 +1178,7 @@ see here.
burst_count
: number of requests a client can send before being throttled.
-Config option: rc_message
+rc_message
Ratelimiting settings for client messaging.
This is a ratelimiting option for messages that ratelimits sending based on the account the client
is using. It defaults to: per_second: 0.2
, burst_count: 10
.
@@ -1188,7 +1188,7 @@ is using. It defaults to: per_second: 0.2
, burst_count: 10
-Config option: rc_registration
+rc_registration
This option ratelimits registration requests based on the client's IP address.
It defaults to per_second: 0.17
, burst_count: 3
.
Example configuration:
@@ -1197,7 +1197,7 @@ It defaults to per_second: 0.17
, burst_count: 3
.
burst_count: 2
Config option: rc_registration_token_validity
rc_registration_token_validity
This option checks the validity of registration tokens that ratelimits requests based on
the client's IP address.
Defaults to per_second: 0.1
, burst_count: 5
.
per_second: 0.1
, burst_count: 5
.
burst_count: 6
Config option: rc_login
rc_login
This option specifies several limits for login:
per_second: 0.17
, burs
burst_count: 7
Config option: rc_admin_redaction
rc_admin_redaction
This option sets ratelimiting redactions by room admins. If this is not explicitly
set then it uses the same ratelimiting as per rc_message
. This is useful
to allow room admins to deal with abuse quickly.
Config option: rc_joins
rc_joins
This option allows for ratelimiting number of rooms a user can join. This setting has the following sub-options:
Config option: rc_3pid_validation
rc_3pid_validation
This option ratelimits how often a user or IP can attempt to validate a 3PID.
Defaults to per_second: 0.003
, burst_count: 5
.
Example configuration:
@@ -1280,7 +1280,7 @@ Defaults toper_second: 0.003
, burst_count: 5
.
burst_count: 5
Config option: rc_invites
rc_invites
This option sets ratelimiting how often invites can be sent in a room or to a
specific user. per_room
defaults to per_second: 0.3
, burst_count: 10
and
per_user
defaults to per_second: 0.003
, burst_count: 5
.
Config option: rc_third_party_invite
rc_third_party_invite
This option ratelimits 3PID invites (i.e. invites sent to a third-party ID
such as an email address or a phone number) based on the account that's
sending the invite. Defaults to per_second: 0.2
, burst_count: 10
.
per_second: 0.2
, burst_count:
burst_count: 10
Config option: rc_federation
rc_federation
Defines limits on federation requests.
The rc_federation
configuration has the following sub-options:
Config option: federation_rr_transactions_per_room_per_second
federation_rr_transactions_per_room_per_second
Sets outgoing federation transaction frequency for sending read-receipts, per-room.
If we end up trying to send out more read-receipts, they will get buffered up @@ -1350,20 +1350,20 @@ into fewer transactions. Defaults to 50.
Config options related to Synapse's media store.
Config option: enable_media_repo
enable_media_repo
Enable the media store service in the Synapse master. Defaults to true. Set to false if you are using a separate media store worker.
Example configuration:
enable_media_repo: false
Config option: media_store_path
media_store_path
Directory where uploaded images and attachments are stored.
Example configuration:
media_store_path: "DATADIR/media_store"
Config option: media_storage_providers
media_storage_providers
Media storage providers allow media to be stored in different locations. Defaults to none. Associated sub-options are:
Config option: max_upload_size
max_upload_size
The largest allowed upload size in bytes.
If you are using a reverse proxy you may also need to set this value in your reverse proxy's config. Defaults to 50M. Notably Nginx has a small max body size by default. @@ -1392,13 +1392,13 @@ See here for more on using a reverse prox
max_upload_size: 60M
Config option: max_image_pixels
max_image_pixels
Maximum number of pixels that will be thumbnailed. Defaults to 32M.
Example configuration:
max_image_pixels: 35M
Config option: dynamic_thumbnails
dynamic_thumbnails
Whether to generate new thumbnails on the fly to precisely match the resolution requested by the client. If true then whenever a new resolution is requested by the client the server will @@ -1408,7 +1408,7 @@ from a precalculated list. Defaults to false.
dynamic_thumbnails: true
Config option: thumbnail_sizes
thumbnail_sizes
List of thumbnails to precalculate when an image is uploaded. Associated sub-options are:
width
Config option: media_retention
media_retention
Controls whether local media and entries in the remote media cache (media that is downloaded from other homeservers) should be removed under certain conditions, typically for the purpose of saving space.
@@ -1460,7 +1460,7 @@ will not be deleted. remote_media_lifetime: 14dConfig option: url_preview_enabled
url_preview_enabled
This setting determines whether the preview URL API is enabled.
It is disabled by default. Set to true to enable. If enabled you must specify a
url_preview_ip_range_blacklist
blacklist.
url_preview_enabled: true
Config option: url_preview_ip_range_blacklist
url_preview_ip_range_blacklist
List of IP address CIDR ranges that the URL preview spider is denied from accessing. There are no defaults: you must explicitly specify a list for URL previewing to work. You should specify any @@ -1504,7 +1504,7 @@ you use the following example list as a starting point.
- 'fec0::/10'Config option: url_preview_ip_range_whitelist
url_preview_ip_range_whitelist
This option sets a list of IP address CIDR ranges that the URL preview spider is allowed
to access even if they are specified in url_preview_ip_range_blacklist
.
This is useful for specifying exceptions to wide-ranging blacklisted
@@ -1515,7 +1515,7 @@ website only visible in your network. Defaults to none.
Config option: url_preview_url_blacklist
url_preview_url_blacklist
Optional list of URL matches that the URL preview spider is
denied from accessing. You should use url_preview_ip_range_blacklist
in preference to this, otherwise someone could define a public DNS
@@ -1557,13 +1557,13 @@ blacklisted.
Config option: max_spider_size
max_spider_size
The largest allowed URL preview spidering size in bytes. Defaults to 10M.
Example configuration:
max_spider_size: 8M
Config option: url_preview_language
url_preview_language
A list of values for the Accept-Language HTTP header used when downloading webpages during URL preview generation. This allows Synapse to specify the preferred languages that URL previews should @@ -1582,7 +1582,7 @@ using quality value syntax (;q=). '*' translates to any language.
- '*;q=0.7'Config option: oembed
oembed
oEmbed allows for easier embedding content from a website. It can be
used for generating URLs previews of services which support it. A default list of oEmbed providers
is included with Synapse. Set disable_default_providers
to true to disable using
@@ -1598,21 +1598,21 @@ should be in the form of providers.json). By default this list is empty.
See here for full details on setting up captcha.
Config option: recaptcha_public_key
recaptcha_public_key
This homeserver's ReCAPTCHA public key. Must be specified if enable_registration_captcha
is
enabled.
Example configuration:
recaptcha_public_key: "YOUR_PUBLIC_KEY"
Config option: recaptcha_private_key
recaptcha_private_key
This homeserver's ReCAPTCHA private key. Must be specified if enable_registration_captcha
is
enabled.
Example configuration:
recaptcha_private_key: "YOUR_PRIVATE_KEY"
Config option: enable_registration_captcha
enable_registration_captcha
Set to true to enable ReCaptcha checks when registering, preventing signup unless a captcha is answered. Requires a valid ReCaptcha public/private key. Defaults to false.
@@ -1620,7 +1620,7 @@ Defaults to false.enable_registration_captcha: true
Config option: recaptcha_siteverify_api
recaptcha_siteverify_api
The API endpoint to use for verifying m.login.recaptcha
responses.
Defaults to https://www.recaptcha.net/recaptcha/api/siteverify
.
Example configuration:
@@ -1630,13 +1630,13 @@ Defaults tohttps://www.recaptcha.net/recaptcha/api/siteverify
.
Options related to adding a TURN server to Synapse.
Config option: turn_uris
turn_uris
The public URIs of the TURN server to give to clients.
Example configuration:
turn_uris: [turn:example.org]
Config option: turn_shared_secret
turn_shared_secret
The shared secret used to compute passwords for the TURN server.
Example configuration:
turn_shared_secret: "YOUR_SHARED_SECRET"
@@ -1649,13 +1649,13 @@ Defaults to https://www.recaptcha.net/recaptcha/api/siteverify
.
turn_password: "TURNSERVER_PASSWORD"
Config option: turn_user_lifetime
turn_user_lifetime
How long generated TURN credentials last. Defaults to 1h.
Example configuration:
turn_user_lifetime: 2h
Config option: turn_allow_guests
turn_allow_guests
Whether guests should be allowed to use the TURN server. This defaults to true, otherwise VoIP will be unreliable for guests. However, it does introduce a slight security risk as it allows users to connect to arbitrary endpoints without having first signed up for a valid account (e.g. by passing a CAPTCHA).
@@ -1666,7 +1666,7 @@ it allows users to connect to arbitrary endpoints without having first signed upRegistration can be rate-limited using the parameters in the Ratelimiting section of this manual.
Config option: enable_registration
enable_registration
Enable registration for new users. Defaults to false. It is highly recommended that if you enable registration,
you use either captcha, email, or token-based verification to verify that new users are not bots. In order to enable registration
without any verification, you must also set enable_registration_without_verification
to true.
enable_registration_without_ve
enable_registration: true
-Config option: enable_registration_without_verification
-Enable registration without email or captcha verification. Note: this option is not recommended,
+
enable_registration_without_verification
+Enable registration without email or captcha verification. Note: this option is not recommended,
as registration without verification is a known vector for spam and abuse. Defaults to false. Has no effect
unless enable_registration
is also enabled.
Example configuration:
enable_registration_without_verification: true
-Config option: session_lifetime
+session_lifetime
Time that a user's session remains valid for, after they log in.
Note that this is not currently compatible with guest logins.
Note also that this is calculated at login time: changes are not applied retrospectively to users who have already
@@ -1692,7 +1692,7 @@ logged in.
session_lifetime: 24h
-Config option: refresh_access_token_lifetime
+refresh_access_token_lifetime
Time that an access token remains valid for, if the session is using refresh tokens.
For more information about refresh tokens, please see the manual.
Note that this only applies to clients which advertise support for refresh tokens.
@@ -1703,7 +1703,7 @@ existing sessions until they are refreshed.
refreshable_access_token_lifetime: 10m
-Config option: refresh_token_lifetime: 24h
+refresh_token_lifetime: 24h
Time that a refresh token remains valid for (provided that it is not
exchanged for another one first).
This option can be used to automatically log-out inactive sessions.
@@ -1715,7 +1715,7 @@ changes are not applied to existing sessions until they are refreshed.
refresh_token_lifetime: 24h
-Config option: nonrefreshable_access_token_lifetime
+nonrefreshable_access_token_lifetime
Time that an access token remains valid for, if the session is NOT
using refresh tokens.
Please note that not all clients support refresh tokens, so setting
@@ -1728,7 +1728,7 @@ retrospectively to existing sessions for users that have already logged in.
nonrefreshable_access_token_lifetime: 24h
-Config option: registrations_require_3pid
+registrations_require_3pid
If this is set, the user must provide all of the specified types of 3PID when registering.
Example configuration:
registrations_require_3pid:
@@ -1736,14 +1736,14 @@ retrospectively to existing sessions for users that have already logged in.
- msisdn
-Config option: disable_msisdn_registration
+disable_msisdn_registration
Explicitly disable asking for MSISDNs from the registration
flow (overrides registrations_require_3pid
if MSISDNs are set as required).
Example configuration:
disable_msisdn_registration: true
-Config option: allowed_local_3pids
+allowed_local_3pids
Mandate that users are only allowed to associate certain formats of
3PIDs with accounts on this server, as specified by the medium
and pattern
sub-options.
Example configuration:
@@ -1756,13 +1756,13 @@ flow (overrides registrations_require_3pid
if MSISDNs are set as re
pattern: '\+44'
Config option: enable_3pid_lookup
enable_3pid_lookup
Enable 3PIDs lookup requests to identity servers from this server. Defaults to true.
Example configuration:
enable_3pid_lookup: false
Config option: registration_requires_token
registration_requires_token
Require users to submit a token during registration.
Tokens can be managed using the admin API.
Note that enable_registration
must be set to true.
@@ -1772,14 +1772,14 @@ Defaults to false. Set to true to enable.
registration_requires_token: true
Config option: registration_shared_secret
registration_shared_secret
If set, allows registration of standard or admin accounts by anyone who has the shared secret, even if registration is otherwise disabled.
Example configuration:
registration_shared_secret: <PRIVATE STRING>
Config option: bcrypt_rounds
bcrypt_rounds
Set the number of bcrypt rounds used to generate password hash. Larger numbers increase the work factor needed to generate the hash. The default number is 12 (which equates to 2^12 rounds). @@ -1789,7 +1789,7 @@ Example configuration:
bcrypt_rounds: 14
Config option: allow_guest_access
allow_guest_access
Allows users to register as guests without a password/email/etc, and participate in rooms hosted on this server which have been made accessible to anonymous users. Defaults to false.
@@ -1797,7 +1797,7 @@ accessible to anonymous users. Defaults to false.allow_guest_access: true
Config option: default_identity_server
default_identity_server
The identity server which we suggest that clients should use when users log in on this server.
(By default, no suggestion is made, so it is left up to the client.
@@ -1806,7 +1806,7 @@ This setting is ignored unless public_baseurl
is also explicitly se
default_identity_server: https://matrix.org
Config option: account_threepid_delegates
account_threepid_delegates
Handle threepid (email/phone etc) registration and password resets through a set of trusted identity servers. Note that this allows the configured identity server to reset passwords for accounts!
@@ -1828,7 +1828,7 @@ by the Matrix Identity Service APIenable_set_displayname
Whether users are allowed to change their displayname after it has been initially set. Useful when provisioning users based on the contents of a third-party directory.
@@ -1837,7 +1837,7 @@ contents of a third-party directory.enable_set_displayname: false
Config option: enable_set_avatar_url
enable_set_avatar_url
Whether users are allowed to change their avatar after it has been initially set. Useful when provisioning users based on the contents of a third-party directory.
@@ -1846,7 +1846,7 @@ of a third-party directory.enable_set_avatar_url: false
Config option: enable_3pid_changes
enable_3pid_changes
Whether users can change the third-party IDs associated with their accounts (email address and msisdn).
Defaults to true.
@@ -1854,7 +1854,7 @@ of a third-party directory.enable_3pid_changes: false
Config option: auto_join_rooms
auto_join_rooms
Users who register on this homeserver will automatically be joined to the rooms listed under this option.
By default, any room aliases included in this list will be created @@ -1868,7 +1868,7 @@ relating to auto-joining rooms below.
- "#anotherexampleroom:example.com"Config option: autocreate_auto_join_rooms
autocreate_auto_join_rooms
Where auto_join_rooms
are specified, setting this flag ensures that
the rooms exist by creating them when the first user on the
homeserver registers.
autocreate_auto_join_rooms: false
Config option: autocreate_auto_join_rooms_federated
autocreate_auto_join_rooms_federated
Whether the rooms listen in auto_join_rooms
that are auto-created are available
via federation. Only has an effect if autocreate_auto_join_rooms
is true.
Note that whether a room is federated cannot be modified after @@ -1894,7 +1894,7 @@ joining these rooms.
autocreate_auto_join_rooms_federated: false
Config option: autocreate_auto_join_room_preset
autocreate_auto_join_room_preset
The room preset to use when auto-creating one of auto_join_rooms
. Only has an
effect if autocreate_auto_join_rooms
is true.
Possible values for this option are:
@@ -1912,7 +1912,7 @@ assigned a power level of 100 upon joining the room.autocreate_auto_join_room_preset: private_chat
Config option: auto_join_mxid_localpart
auto_join_mxid_localpart
The local part of the user id which is used to create auto_join_rooms
if
autocreate_auto_join_rooms
is true. If this is not provided then the
initial user account that registers will be used to create the rooms.
auto_join_mxid_localpart: system
Config option: auto_join_rooms_for_guests
auto_join_rooms_for_guests
When auto_join_rooms
is specified, setting this flag to false prevents
guest accounts from being automatically joined to the rooms.
Defaults to true.
@@ -1937,7 +1937,7 @@ guest accounts from being automatically joined to the rooms.auto_join_rooms_for_guests: false
Config option: inhibit_user_in_use_error
inhibit_user_in_use_error
Whether to inhibit errors raised when registering a new account if the user ID
already exists. If turned on, requests to /register/available
will always
show a user ID as available, and Synapse won't raise an error when starting
@@ -1951,14 +1951,14 @@ raise an error if the registration completes and the username conflicts.
Config options related to metrics.
Config option: enable_metrics
enable_metrics
Set to true to enable collection and rendering of performance metrics. Defaults to false.
Example configuration:
enable_metrics: true
Config option: sentry
sentry
Use this option to enable sentry integration. Provide the DSN assigned to you by sentry
with the dsn
setting.
NOTE: While attempts are made to ensure that the logs don't contain @@ -1971,7 +1971,7 @@ through insecure notification channels if so configured.
dsn: "..."Config option: metrics_flags
metrics_flags
Flags to enable Prometheus metrics which are not suitable to be
enabled by default, either for performance reasons or limited use.
Currently the only option is known_servers
, which publishes
@@ -1983,7 +1983,7 @@ performance problems on large homeservers.
Config option: report_stats
report_stats
Whether or not to report anonymized homeserver usage statistics. This is originally set when generating the config. Set this option to true or false to change the current behavior.
@@ -1991,7 +1991,7 @@ behavior.report_stats: true
Config option: report_stats_endpoint
report_stats_endpoint
The endpoint to report the anonymized homeserver usage statistics to. Defaults to https://matrix.org/report-usage-stats/push
Example configuration:
@@ -2001,7 +2001,7 @@ Defaults to https://matrix.org/report-usage-stats/pushConfig settings related to the client/server API
Config option: room_prejoin_state:
room_prejoin_state:
Controls for the state that is shared with users who receive an invite to a room. By default, the following state event types are shared with users who receive invites to the room:
@@ -2030,7 +2030,7 @@ to a room. By default, this list is empty (so only the default event types are s - m.room.join_rulesConfig option: track_puppeted_user_ips
track_puppeted_user_ips
We record the IP address of clients used to access the API for various reasons, including displaying it to the user in the "Where you're signed in" dialog.
@@ -2045,7 +2045,7 @@ above.)track_puppeted_user_ips: true
Config option: app_service_config_files
app_service_config_files
A list of application service config files to use.
Example configuration:
app_service_config_files:
@@ -2053,14 +2053,14 @@ above.)
- app_service_2.yaml
Config option: track_appservice_user_ips
track_appservice_user_ips
Defaults to false. Set to true to enable tracking of application service IP addresses. Implicitly enables MAU tracking for application service users.
Example configuration:
track_appservice_user_ips: true
Config option: macaroon_secret_key
macaroon_secret_key
A secret which is used to sign access tokens. If none is specified,
the registration_shared_secret
is used, if one is given; otherwise,
a secret key is derived from the signing key.
macaroon_secret_key: <PRIVATE STRING>
Config option: form_secret
form_secret
A secret which is used to calculate HMACs for form values, to stop falsification of values. Must be specified for the User Consent forms to work.
@@ -2079,13 +2079,13 @@ forms to work.Config options relating to signing keys
Config option: signing_key_path
signing_key_path
Path to the signing key to sign messages with.
Example configuration:
signing_key_path: "CONFDIR/SERVERNAME.signing.key"
Config option: old_signing_keys
old_signing_keys
The keys that the server used to sign messages with but won't use
to sign new messages. For each key, key
should be the base64-encoded public key, and
expired_ts
should be the time (in milliseconds since the unix epoch) that
@@ -2097,7 +2097,7 @@ it was last used.
Config option: key_refresh_interval
key_refresh_interval
How long key response published by this server is valid for.
Used to set the valid_until_ts
in /key/v2
APIs.
Determines how quickly servers will query to check which keys
@@ -2106,7 +2106,7 @@ are still valid. Defaults to 1d.
key_refresh_interval: 2d
Config option: trusted_key_servers:
trusted_key_servers:
The trusted servers to download signing keys from.
When we need to fetch a signing key, each server is tried in parallel.
Normally, the connection to the key server is validated via TLS certificates.
@@ -2142,14 +2142,14 @@ to the key server, you can set this to true
to override this behavi
- server_name: "matrix.org"
Config option: suppress_key_server_warning
suppress_key_server_warning
Set the following to true to disable the warning that is emitted when the
trusted_key_servers
include 'matrix.org'. See above.
Example configuration:
suppress_key_server_warning: true
Config option: key_server_signing_keys_path
key_server_signing_keys_path
The signing keys to use when acting as a trusted key server. If not specified defaults to the server signing key.
Can contain multiple keys, one per line.
@@ -2169,7 +2169,7 @@ disable the regular login/registration flows:You will also want to investigate the settings under the "sso" configuration section below.
Config option: saml2_config
saml2_config
Enable SAML2 for registration and login. Uses pysaml2. To learn more about pysaml and to find a full list options for configuring pysaml, read the docs here.
At least one of sp_config
or config_path
must be set in this section to
@@ -2310,7 +2310,7 @@ the IdP to use an ACS location of
idp_entityid: 'https://our_idp/entityid'
Config option: oidc_providers
oidc_providers
List of OpenID Connect (OIDC) / OAuth 2.0 identity providers, for registration and login. See here for information on how to configure these options.
@@ -2527,7 +2527,7 @@ claim MUST contain "admin". value: "synapseUsers"Config option: cas_config
cas_config
Enable Central Authentication Service (CAS) for registration and login. Has the following sub-options:
Config option: sso
sso
Additional settings to use with single-sign on systems such as OpenID Connect, SAML2 and CAS.
Server admins can configure custom templates for pages related to SSO. See @@ -2585,7 +2585,7 @@ information when first signing in. Defaults to false. update_profile_information: true
Config option: jwt_config
jwt_config
JSON web token integration. The following settings can be used to make Synapse JSON web tokens for authentication, instead of its internal password database.
@@ -2626,7 +2626,7 @@ validation will fail without configuring audiences. - "provided-by-your-issuer"Config option: password_config
password_config
Use this setting to enable password-based logins.
This setting has the following sub-options:
Config option: ui_auth
ui_auth
The amount of time to allow a user-interactive authentication session to be active.
This defaults to 0, meaning the user is queried for their credentials before every action, but this can be overridden to allow a single @@ -2686,7 +2686,7 @@ adding a 3PID).
session_timeout: "15s"Config option: email
email
Configuration for sending emails from Synapse.
Server admins can configure custom templates for email content. See here for more information.
@@ -2812,7 +2812,7 @@ ownership. Defaults to "[%(server_name)s] Validate your email"Configuration settings related to push notifications
Config option: push
push
This setting defines options for push notifications.
This option has a number of sub-options. They are as follows:
Config options relating to rooms.
Config option: encryption_enabled_by_default
encryption_enabled_by_default
Controls whether locally-created rooms should be end-to-end encrypted by default.
Possible options are "all", "invite", and "off". They are defined as:
@@ -2859,7 +2859,7 @@ will also not affect rooms created by other servers.encryption_enabled_by_default_for_room_type: invite
Config option: user_directory
user_directory
This setting defines options related to the user directory.
This option has the following sub-options:
Config option: user_consent
user_consent
For detailed instructions on user consent configuration, see here.
Parts of this section are required if enabling the consent
resource under
listeners
, in particular template_dir
and version
. # TODO: link listeners
Config option: stats
stats
Settings for local room and user statistics collection. See here for more.
Config option: server_notices
server_notices
Use this setting to enable a room which can be used to send notices from the server to users. It is a special room which users cannot leave; notices in the room come from a special "notices" user id.
@@ -2977,7 +2977,7 @@ notices. room_name: "Server Notices"Config option: enable_room_list_search
enable_room_list_search
Set to false to disable searching the public room list. When disabled blocks searching local and remote room lists for local and remote users by always returning an empty list for all queries. Defaults to true.
@@ -2985,7 +2985,7 @@ users by always returning an empty list for all queries. Defaults to true.enable_room_list_search: false
Config option: alias_creation
alias_creation
The alias_creation
option controls who is allowed to create aliases
on this server.
The format of this option is a list of rules that contain globs that @@ -3035,7 +3035,7 @@ can publish rooms.
action: allowConfig option: default_power_level_content_override
default_power_level_content_override
The default_power_level_content_override
option controls the default power
levels for rooms.
Useful if you know that your users need special permissions in rooms
@@ -3057,7 +3057,7 @@ except com.example.foo
.
Configuration options related to Opentracing support.
Config option: opentracing
opentracing
These settings enable and configure opentracing, which implements distributed tracing. This allows you to observe the causal chains of events across servers including requests, key lookups etc., across any server running @@ -3097,14 +3097,14 @@ mostly related to trace sampling which is documented Workers
Configuration options related to workers.
Config option: send_federation
send_federation
Controls sending of outbound federation transactions on the main process. Set to false if using a federation sender worker. Defaults to true.
Example configuration:
send_federation: false
Config option: federation_sender_instances
federation_sender_instances
It is possible to run multiple federation sender workers, in which case the work is balanced across them. Use this setting to list the senders.
This configuration setting must be shared between all federation sender workers, and if @@ -3116,7 +3116,7 @@ events may be dropped).
- federation_sender1Config option: instance_map
instance_map
When using workers this should be a map from worker name to the HTTP replication listener of the worker, if configured.
Example configuration:
@@ -3126,7 +3126,7 @@ HTTP replication listener of the worker, if configured. port: 8034Config option: stream_writers
stream_writers
Experimental: When using workers you can define which workers should
handle event persistence and typing notifications. Any worker
specified here must also be in the instance_map
.
instance_map
.
typing: worker1
Config option: run_background_tasks_on
run_background_tasks_on
The worker that is used to run background tasks (e.g. cleaning up expired data). If not provided this defaults to the main process.
Example configuration:
run_background_tasks_on: worker1
Config option: worker_replication_secret
worker_replication_secret
A shared secret used by the replication APIs to authenticate HTTP requests from workers.
By default this is unused and traffic is not authenticated.
Example configuration:
worker_replication_secret: "secret_secret"
-Config option: redis
redis
Configuration for Redis when using workers. This must be enabled when using workers (unless using old style direct TCP configuration). This setting has the following sub-options:
@@ -3170,7 +3170,7 @@ localhost and 6379Configuration settings related to background updates.
Config option: background_updates
background_updates
Background updates are database updates that are run in the background in batches. The duration, minimum batch size, default batch size, whether to sleep between batches and if so, how long to sleep can all be configured. This is helpful to speed up or slow down the updates. -- cgit 1.5.1