mirror of
https://github.com/Tria-plc/edr-platform.git
synced 2026-08-26 18:42:49 +00:00
114 lines
4.0 KiB
Cheetah
114 lines
4.0 KiB
Cheetah
# EDR internal chat — Synapse homeserver config.
|
|
#
|
|
# Rendered to /data/homeserver.yaml at container start by docker-entrypoint.sh
|
|
# (envsubst over this template) so secrets come from the runtime env file,
|
|
# never baked into the image — same convention as freight-api's .env.
|
|
#
|
|
# server_name is PERMANENT: it is baked into every user id and event and
|
|
# cannot change without wiping the server. Do not repoint this at a
|
|
# different value after go-live.
|
|
server_name: "${MATRIX_SERVER_NAME}"
|
|
public_baseurl: "${MATRIX_PUBLIC_BASEURL}"
|
|
pid_file: /data/homeserver.pid
|
|
|
|
listeners:
|
|
- port: 8008
|
|
tls: false
|
|
type: http
|
|
x_forwarded: true
|
|
resources:
|
|
- names: [client, federation]
|
|
compress: false
|
|
|
|
database:
|
|
name: psycopg2
|
|
args:
|
|
user: "${MATRIX_DB_USER}"
|
|
password: "${MATRIX_DB_PASSWORD}"
|
|
dbname: "${MATRIX_DB_NAME}"
|
|
host: "${MATRIX_DB_HOST}"
|
|
port: ${MATRIX_DB_PORT}
|
|
cp_min: 5
|
|
cp_max: 10
|
|
|
|
media_store_path: /data/media_store
|
|
max_upload_size: 50M
|
|
|
|
log_config: "/synapse/log.config"
|
|
|
|
# Internal comms tool: no federation, no open registration, no E2EE-by-default.
|
|
# ponytail: E2EE off — turn on per-room (HR/legal) if compliance asks.
|
|
federation_domain_whitelist: []
|
|
enable_registration: false
|
|
encryption_enabled_by_default_for_room_type: "off"
|
|
|
|
# Turning rooms' encryption off above is not enough on its own: Element still
|
|
# bootstraps cross-signing on a user's first login, and from then on gates
|
|
# EVERY later login behind "Verify this device" (MatrixChat: crossSigningIsSetUp
|
|
# -> Views.COMPLETE_SECURITY). Nobody on this deployment can clear that gate —
|
|
# each SSO click is a brand-new device, so there is never a second verified
|
|
# device to accept the request, and resetting the identity needs UIA, which
|
|
# password_config.enabled: false makes impossible.
|
|
#
|
|
# This tells Element encryption is off here, so it skips the bootstrap
|
|
# (shouldSkipSetupEncryption) and the gate is never armed. Only helps accounts
|
|
# that have no cross-signing keys yet — anyone already bootstrapped keeps
|
|
# hitting the gate until their keys are cleared.
|
|
extra_well_known_client_content:
|
|
io.element.e2ee:
|
|
default: false
|
|
force_disable: true
|
|
secure_backup_required: false
|
|
|
|
# Employees authenticate via freight-api's SSO handoff, never a Matrix
|
|
# password prompt. This is the entire auth story for this deployment.
|
|
password_config:
|
|
enabled: false
|
|
|
|
jwt_config:
|
|
enabled: true
|
|
secret: "${MATRIX_JWT_SECRET}"
|
|
algorithm: "HS256"
|
|
issuer: "edr-freight-api"
|
|
audiences: ["matrix"]
|
|
# Matches the `name` claim chat-sso.service.ts puts in the JWT — only read
|
|
# on first login (auto-registration), never updates it on later logins.
|
|
display_name_claim: "name"
|
|
|
|
# Consumes the login_token minted by freight-api's SSO endpoint via
|
|
# POST /_matrix/client/v1/login/get_token (issued against an existing,
|
|
# already-JWT-authenticated session — not a bare password grant).
|
|
login_via_existing_session:
|
|
enabled: true
|
|
require_ui_auth: false
|
|
token_timeout: 5m
|
|
|
|
# Bootstrap-only: used once by ops to register the first admin account
|
|
# (register_new_matrix_user against /_synapse/admin/v1/register), whose
|
|
# access token becomes MATRIX_ADMIN_TOKEN for freight-api's provisioning
|
|
# service. Rotate/remove after bootstrap if desired — nothing else depends
|
|
# on shared-secret registration once the admin account exists.
|
|
registration_shared_secret: "${MATRIX_REGISTRATION_SHARED_SECRET}"
|
|
|
|
trusted_key_servers: []
|
|
suppress_key_server_warning: true
|
|
|
|
report_stats: false
|
|
|
|
# Synapse's default rc_login is sized to defend against internet-facing
|
|
# password brute-forcing. That threat doesn't exist on this deployment —
|
|
# password login is off (see password_config above), and the only path in
|
|
# requires a freight-api-signed JWT — so the default is mostly just
|
|
# punishing legitimate rapid logins from the same office/NAT IP or normal
|
|
# page-refresh retries. Loosened, not disabled, to keep some ceiling.
|
|
rc_login:
|
|
address:
|
|
per_second: 100
|
|
burst_count: 200
|
|
account:
|
|
per_second: 100
|
|
burst_count: 200
|
|
failed_attempts:
|
|
per_second: 100
|
|
burst_count: 200
|