From 6dbfe29923eb271471bbd74723137f9b0987e644 Mon Sep 17 00:00:00 2001
From: DMRobertson
The quickest way to get up and running with ArchLinux is probably with the community package -https://archlinux.org/packages/community/x86_64/matrix-synapse/, which should pull in most of +
The quickest way to get up and running with ArchLinux is probably with the package provided by ArchLinux +https://archlinux.org/packages/extra/x86_64/matrix-synapse/, which should pull in most of the necessary dependencies.
pip may be outdated (6.0.7-1 and needs to be upgraded to 6.0.8-1 ):
sudo pip install --upgrade pip
@@ -1779,6 +1779,12 @@ dpkg -i matrix-synapse-py3_1.3.0+stretch1_amd64.deb
+user
property for /register
Application services can no longer call /register
with a user
property to create new users.
+The standard username
property should be used instead. See the
+Application Service specification
+for more information.
The minimum supported Python version has been increased from v3.7 to v3.8. @@ -4043,6 +4049,23 @@ on this port. Sub-options for each resource are:
additional endpoints which should be loaded via dynamic modules. +Unix socket support (Added in Synapse 1.89.0):
+path
: A path and filename for a Unix socket. Make sure it is located in a
+directory with read and write permissions, and that it already exists (the directory
+will not be created). Defaults to None
.
+path
and port
options for the same listener
is not
+compatible.x_forwarded
option defaults to true when using Unix sockets and can be omitted.bind_addresses
and tls
will be ignored and can be removed.mode
: The file permissions to set on the UNIX socket. Defaults to 666
type: http
(does not support metrics
and manhole
).
+Also make sure that metrics
is not included in resources
-> names
Valid resource names are:
media
: the media API (/_matrix/media).
metrics
: the metrics interface. See here.
metrics
: the metrics interface. See here. (Not compatible with Unix sockets)
openid
: OpenID authentication. See here.
Example configuration #3:
+listeners:
+ # Unix socket listener: Ideal for Synapse deployments behind a reverse proxy, offering
+ # lightweight interprocess communication without TCP/IP overhead, avoid port
+ # conflicts, and providing enhanced security through system file permissions.
+ #
+ # Note that x_forwarded will default to true, when using a UNIX socket. Please see
+ # https://matrix-org.github.io/synapse/latest/reverse_proxy.html.
+ #
+ - path: /var/run/synapse/main_public.sock
+ type: http
+ resources:
+ - names: [client, federation]
+
manhole_settings
Connection settings for the manhole. You can find more information @@ -7035,13 +7072,14 @@ events may be dropped).
instance_map
When using workers this should be a map from worker_name
to the
-HTTP replication listener of the worker, if configured, and to the main process.
-Each worker declared under stream_writers
needs
-a HTTP replication listener, and that listener should be included in the instance_map
.
-The main process also needs an entry on the instance_map
, and it should be listed under
-main
if even one other worker exists. Ensure the port matches with what is declared
-inside the listener
block for a replication
listener.
When using workers this should be a map from worker_name
to the HTTP
+replication listener of the worker, if configured, and to the main process. Each worker
+declared under stream_writers
and
+outbound_federation_restricted_to
needs a HTTP
+replication listener, and that listener should be included in the instance_map
. The
+main process also needs an entry on the instance_map
, and it should be listed under
+main
if even one other worker exists. Ensure the port matches with what is
+declared inside the listener
block for a replication
listener.
Example configuration:
instance_map:
main:
@@ -7051,6 +7089,13 @@ inside the listener
block for a replication
listener.<
host: localhost
port: 8034
+Example configuration(#2, for UNIX sockets):
+instance_map:
+ main:
+ path: /var/run/synapse/main_replication.sock
+ worker1:
+ path: /var/run/synapse/worker1_replication.sock
+
stream_writers
Experimental: When using workers you can define which workers should
@@ -7064,6 +7109,19 @@ Any worker specified here must also be in the outbound_federation_restricted_to
+
When using workers, you can restrict outbound federation traffic to only go through a
+specific subset of workers. Any worker specified here must also be in the
+instance_map
.
+worker_replication_secret
must also be configured to
+authorize inter-worker communication.
outbound_federation_restricted_to:
+ - federation_sender1
+ - federation_sender2
+
+run_background_tasks_on
The worker that is used to run background tasks (e.g. cleaning up expired data). If not provided this @@ -7190,6 +7248,17 @@ requests from other workers.
resources: - names: [client, federation] +Example configuration(#2, using UNIX sockets with a replication
listener):
worker_listeners:
+ - type: http
+ path: /var/run/synapse/worker_public.sock
+ resources:
+ - names: [client, federation]
+ - type: http
+ path: /var/run/synapse/worker_replication.sock
+ resources:
+ - names: [replication]
+
worker_manhole
A worker may have a listener for manhole
.
@@ -10832,9 +10901,15 @@ for the main process
instance_map
-with the main
process defined, as well as the relevant connection information from
-it's HTTP replication
listener (defined in step 1 above). Note that the host
defined
-is the address the worker needs to look for the main
process at, not necessarily the same address that is bound to.main
process defined, as well as the relevant connection information from
+it's HTTP replication
listener (defined in step 1 above).
+host
defined is the address the worker needs to look for the main
+process at, not necessarily the same address that is bound to.replication
resource, make sure to
+use a path
to the socket file instead of a port
.systemd
where available: for information on se
The following applies to Synapse installations that have been installed from source using poetry
.
You can start the main Synapse process with Poetry by running the following command:
-poetry run synapse_homeserver -c [your homeserver.yaml]
+poetry run synapse_homeserver --config-file [your homeserver.yaml]
For worker setups, you can run the following command
-poetry run synapse_worker -c [your worker.yaml]
+poetry run synapse_worker --config-file [your homeserver.yaml] --config-file [your worker.yaml]
Available worker applications
synapse.app.generic_worker
@@ -11235,6 +11310,26 @@ the stream writer for the receipts
stream:
the stream writer for the presence
stream:
^/_matrix/client/(api/v1|r0|v3|unstable)/presence/
+Restrict outbound federation traffic to a specific set of workers
+The
+outbound_federation_restricted_to
+configuration is useful to make sure outbound federation traffic only goes through a
+specified subset of workers. This allows you to set more strict access controls (like a
+firewall) for all workers and only allow the federation_sender
's to contact the
+outside world.
+instance_map:
+ main:
+ host: localhost
+ port: 8030
+ federation_sender1:
+ host: localhost
+ port: 8034
+
+outbound_federation_restricted_to:
+ - federation_sender1
+
+worker_replication_secret: "secret_secret"
+
Background tasks
There is also support for moving background tasks to a separate
worker. Background tasks are run periodically or started via replication. Exactly
@@ -14284,7 +14379,8 @@ when admins wish to do actions on behalf of a user.
An optional valid_until_ms
field can be specified in the request body as an
integer timestamp that specifies when the token should expire. By default tokens
-do not expire.
+do not expire. Note that this API does not allow a user to login as themselves
+(to create more tokens).
A response body like the following is returned:
{
"access_token": "<opaque_access_token_string>"
@@ -16111,6 +16207,7 @@ See the worker documentation for addit
Passing ASYNCIO_REACTOR=1
as an environment variable to use the Twisted asyncio reactor instead of the default one.
Passing PODMAN=1
will use the podman container runtime, instead of docker.
+Passing UNIX_SOCKETS=1
will utilise Unix socket functionality for Synapse, Redis, and Postgres(when applicable).
To increase the log level for the tests, set SYNAPSE_TEST_LOG_LEVEL
, e.g:
SYNAPSE_TEST_LOG_LEVEL=DEBUG COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh -run TestImportHistoricalMessages
--
cgit 1.5.1