# EDR internal chat — Synapse homeserver config.
#
# Rendered to /data/homeserver.yaml at container start by docker-entrypoint.sh
# (envsubst over this template) so secrets come from the runtime env file,
# never baked into the image — same convention as freight-api's .env.
#
# server_name is PERMANENT: it is baked into every user id and event and
# cannot change without wiping the server. Do not repoint this at a
# different value after go-live.
server_name: "${MATRIX_SERVER_NAME}"
public_baseurl: "${MATRIX_PUBLIC_BASEURL}"
pid_file: /data/homeserver.pid

listeners:
  - port: 8008
    tls: false
    type: http
    x_forwarded: true
    resources:
      - names: [client, federation]
        compress: false

database:
  name: psycopg2
  args:
    user: "${MATRIX_DB_USER}"
    password: "${MATRIX_DB_PASSWORD}"
    dbname: "${MATRIX_DB_NAME}"
    host: "${MATRIX_DB_HOST}"
    port: ${MATRIX_DB_PORT}
    cp_min: 5
    cp_max: 10

media_store_path: /data/media_store
max_upload_size: 50M

log_config: "/synapse/log.config"

# Internal comms tool: no federation, no open registration, no E2EE-by-default.
# ponytail: E2EE off — turn on per-room (HR/legal) if compliance asks.
federation_domain_whitelist: []
enable_registration: false
encryption_enabled_by_default_for_room_type: "off"

# Employees authenticate via freight-api's SSO handoff, never a Matrix
# password prompt. This is the entire auth story for this deployment.
password_config:
  enabled: false

jwt_config:
  enabled: true
  secret: "${MATRIX_JWT_SECRET}"
  algorithm: "HS256"
  issuer: "edr-freight-api"
  audiences: ["matrix"]
  # Matches the `name` claim chat-sso.service.ts puts in the JWT — only read
  # on first login (auto-registration), never updates it on later logins.
  display_name_claim: "name"

# Consumes the login_token minted by freight-api's SSO endpoint via
# POST /_matrix/client/v1/login/get_token (issued against an existing,
# already-JWT-authenticated session — not a bare password grant).
login_via_existing_session:
  enabled: true
  require_ui_auth: false
  token_timeout: 5m

# Bootstrap-only: used once by ops to register the first admin account
# (register_new_matrix_user against /_synapse/admin/v1/register), whose
# access token becomes MATRIX_ADMIN_TOKEN for freight-api's provisioning
# service. Rotate/remove after bootstrap if desired — nothing else depends
# on shared-secret registration once the admin account exists.
registration_shared_secret: "${MATRIX_REGISTRATION_SHARED_SECRET}"

trusted_key_servers: []
suppress_key_server_warning: true

report_stats: false

# Synapse's default rc_login is sized to defend against internet-facing
# password brute-forcing. That threat doesn't exist on this deployment —
# password login is off (see password_config above), and the only path in
# requires a freight-api-signed JWT — so the default is mostly just
# punishing legitimate rapid logins from the same office/NAT IP or normal
# page-refresh retries. Loosened, not disabled, to keep some ceiling.
rc_login:
  address:
    per_second: 100
    burst_count: 200
  account:
    per_second: 100
    burst_count: 200
  failed_attempts:
    per_second: 100
    burst_count: 200