From 8a27e5ef22c6c58adc550884f57f5a47b9a6dd12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Thu, 25 Jun 2020 11:16:20 +0200
Subject: [PATCH 01/23] Import __matrix_synapse type from ungleich's dot-cdist

---
 type/__matrix_synapse/files/environment.sh    |    6 +
 .../__matrix_synapse/files/homeserver.yaml.sh | 1785 +++++++++++++++++
 type/__matrix_synapse/files/log.config.sh     |   60 +
 type/__matrix_synapse/man.rst                 |  180 ++
 type/__matrix_synapse/manifest                |  287 +++
 type/__matrix_synapse/parameter/boolean       |   14 +
 .../parameter/default/database_host           |    0
 .../parameter/default/database_password       |    0
 .../parameter/default/database_user           |    0
 .../parameter/default/event_cache_size        |    1 +
 .../parameter/default/global_cache_factor     |    1 +
 .../parameter/default/ldap_base_dn            |    0
 .../parameter/default/ldap_bind_dn            |    0
 .../parameter/default/ldap_bind_password      |    0
 .../parameter/default/ldap_filter             |    1 +
 .../parameter/default/ldap_mail_attribute     |    1 +
 .../parameter/default/ldap_name_attribute     |    1 +
 .../parameter/default/ldap_uid_attribute      |    1 +
 .../parameter/default/ldap_uri                |    0
 .../parameter/default/max_upload_size         |    1 +
 .../parameter/default/rc_login_burst          |    1 +
 .../parameter/default/rc_login_per_second     |    1 +
 .../parameter/default/rc_message_burst        |    1 +
 .../parameter/default/rc_message_per_second   |    1 +
 .../parameter/default/smtp_host               |    1 +
 .../parameter/default/smtp_pass               |    0
 .../parameter/default/smtp_port               |    1 +
 .../parameter/default/smtp_user               |    0
 .../parameter/default/turn_user_lifetime      |    1 +
 type/__matrix_synapse/parameter/optional      |   25 +
 .../parameter/optional_multiple               |    5 +
 type/__matrix_synapse/parameter/required      |    4 +
 type/__matrix_synapse/singleton               |    0
 33 files changed, 2380 insertions(+)
 create mode 100644 type/__matrix_synapse/files/environment.sh
 create mode 100755 type/__matrix_synapse/files/homeserver.yaml.sh
 create mode 100755 type/__matrix_synapse/files/log.config.sh
 create mode 100644 type/__matrix_synapse/man.rst
 create mode 100755 type/__matrix_synapse/manifest
 create mode 100644 type/__matrix_synapse/parameter/boolean
 create mode 100644 type/__matrix_synapse/parameter/default/database_host
 create mode 100644 type/__matrix_synapse/parameter/default/database_password
 create mode 100644 type/__matrix_synapse/parameter/default/database_user
 create mode 100644 type/__matrix_synapse/parameter/default/event_cache_size
 create mode 100644 type/__matrix_synapse/parameter/default/global_cache_factor
 create mode 100644 type/__matrix_synapse/parameter/default/ldap_base_dn
 create mode 100644 type/__matrix_synapse/parameter/default/ldap_bind_dn
 create mode 100644 type/__matrix_synapse/parameter/default/ldap_bind_password
 create mode 100644 type/__matrix_synapse/parameter/default/ldap_filter
 create mode 100644 type/__matrix_synapse/parameter/default/ldap_mail_attribute
 create mode 100644 type/__matrix_synapse/parameter/default/ldap_name_attribute
 create mode 100644 type/__matrix_synapse/parameter/default/ldap_uid_attribute
 create mode 100644 type/__matrix_synapse/parameter/default/ldap_uri
 create mode 100644 type/__matrix_synapse/parameter/default/max_upload_size
 create mode 100644 type/__matrix_synapse/parameter/default/rc_login_burst
 create mode 100644 type/__matrix_synapse/parameter/default/rc_login_per_second
 create mode 100644 type/__matrix_synapse/parameter/default/rc_message_burst
 create mode 100644 type/__matrix_synapse/parameter/default/rc_message_per_second
 create mode 100644 type/__matrix_synapse/parameter/default/smtp_host
 create mode 100644 type/__matrix_synapse/parameter/default/smtp_pass
 create mode 100644 type/__matrix_synapse/parameter/default/smtp_port
 create mode 100644 type/__matrix_synapse/parameter/default/smtp_user
 create mode 100644 type/__matrix_synapse/parameter/default/turn_user_lifetime
 create mode 100644 type/__matrix_synapse/parameter/optional
 create mode 100644 type/__matrix_synapse/parameter/optional_multiple
 create mode 100644 type/__matrix_synapse/parameter/required
 create mode 100644 type/__matrix_synapse/singleton

diff --git a/type/__matrix_synapse/files/environment.sh b/type/__matrix_synapse/files/environment.sh
new file mode 100644
index 0000000..99179be
--- /dev/null
+++ b/type/__matrix_synapse/files/environment.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+cat << EOF
+# Specify environment variables used when running Synapse
+SYNAPSE_CACHE_FACTOR=$CACHE_FACTOR
+EOF
diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
new file mode 100755
index 0000000..77be438
--- /dev/null
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -0,0 +1,1785 @@
+#!/bin/sh
+
+# NOTE: this template has been generated using the
+# matrix-synapse-1.5.1-1.fc31.noarch Fedora package for use with CDIST.
+
+generate_extra_settings () {
+    for line in $EXTRA_SETTINGS; do
+        echo "$line"
+    done
+}
+
+generate_database () {
+  if [ "$DATABASE_ENGINE" = "sqlite3" ]; then
+    cat << EOF
+database:
+  # The database engine name
+  name: "$DATABASE_ENGINE"
+  # Arguments to pass to the engine
+  args:
+    # Path to the database
+    database: "$DATABASE_NAME"
+EOF
+  else
+cat << EOF
+database:
+  # The database engine name
+  name: "$DATABASE_ENGINE"
+  # Arguments to pass to the engine
+  args:
+    database: "$DATABASE_NAME"
+    host: "$DATABASE_HOST"
+    user: "$DATABASE_USER"
+    password: "$DATABASE_PASSWORD"
+EOF
+  fi
+}
+
+generate_password_providers () {
+  if [ "$ENABLE_LDAP_AUTH" = "true" ]; then
+    cat <<EOF
+password_providers:
+    - module: "ldap_auth_provider.LdapAuthProvider"
+      config:
+        enabled: $ENABLE_LDAP_AUTH
+        uri: "$LDAP_URI"
+        start_tls: true
+        base: "$LDAP_BASE_DN"
+        attributes:
+           uid: "$LDAP_UID_ATTRIBUTE"
+           mail: "$LDAP_MAIL_ATTRIBUTE"
+           name: "$LDAP_NAME_ATTRIBUTE"
+        filter: "$LDAP_FILTER"
+EOF
+    if [ $LDAP_SEARCH_MODE ]; then
+        cat <<EOF
+        mode: "search"
+        bind_dn: "$LDAP_BIND_DN"
+        bind_password: "$LDAP_BIND_PASSWORD"
+EOF
+    fi
+  else # LDAP auth is disabled.
+    echo "password_providers: []"
+  fi
+}
+
+generate_resources () {
+    if [ "$EXPOSE_METRICS" = "true" ]; then
+      echo "[client, federation, metrics]"
+    else
+      echo "[client, federation]"
+    fi
+}
+
+generate_federation_whitelist () {
+    if [ "$DISABLE_FEDERATION" = "true" ]; then
+        # Empty federation whitelist.
+        cat << EOF
+federation_domain_whitelist: []
+EOF
+    fi
+
+}
+
+generate_registration_requirements () {
+    if [ "$REGISTRATION_REQUIRES_EMAIL" = "1" ]; then
+        cat << EOF
+# The user must provide all of the below types of 3PID when registering.
+
+registrations_require_3pid:
+  - email
+#  - msisdn
+EOF
+    fi
+}
+
+generate_allowed_3pid_patterns () {
+    if [ "$RESGISTRATION_ALLOWS_EMAIL_PATTERN" != "" ]; then
+        cat << EOF
+# Mandate that users are only allowed to associate certain formats of
+# 3PIDs with accounts on this server.
+#
+allowed_local_3pids:
+EOF
+
+        for pattern in $RESGISTRATION_ALLOWS_EMAIL_PATTERN; do
+        cat << EOF
+  - medium: email
+    pattern: $pattern
+EOF
+        done
+
+        cat << EOF
+#  - medium: email
+#    pattern: '.*@vector\.im'
+#  - medium: msisdn
+#    pattern: '\+44'
+EOF
+
+    fi
+}
+
+generate_auto_join_rooms () {
+    if [ "$AUTO_JOIN_ROOMS" != "" ]; then
+        cat << EOF
+# Users who register on this homeserver will automatically be joined
+# to these rooms
+auto_join_rooms:
+EOF
+        for room in $AUTO_JOIN_ROOMS; do
+            cat << EOF
+    - "$room"
+EOF
+        done
+    fi
+}
+
+generate_app_service_config_files () {
+    if [ "$APP_SERVICE_CONFIG_FILES" != "" ]; then
+    cat << EOF
+app_service_config_files:
+EOF
+
+    for file in $APP_SERVICE_CONFIG_FILES; do
+        cat << EOF
+  - $file
+EOF
+done
+
+    fi
+}
+
+generate_server_notices () {
+    if [ "$ENABLE_SERVER_NOTICES" = "1" ]; then
+    cat << EOF
+server_notices:
+  system_mxid_localpart: notices
+  system_mxid_display_name: "Server Notices"
+#  system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
+  room_name: "Server Notices"
+EOF
+    else
+    cat << EOF
+#server_notices:
+# system_mxid_localpart: notices
+# system_mxid_display_name: "Server Notices"
+# system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
+# room_name: "Server Notices"
+EOF
+    fi
+}
+
+cat << EOF
+######################################################
+# THIS FILE IS CDIST-GENERATED. DO NOT EDIT BY HAND. #
+######################################################
+
+## Extra settings, if any ##
+
+$(generate_extra_settings)
+
+## Server ##
+
+# The domain name of the server, with optional explicit port.
+# This is used by remote servers to connect to this server,
+# e.g. matrix.org, localhost:8080, etc.
+# This is also the last part of your UserI1
+#
+server_name: "$SERVER_NAME"
+
+# When running as a daemon, the file to store the pid in
+#
+pid_file: "$PIDFILE"
+
+# The path to the web client which will be served at /_matrix/client/
+# if 'webclient' is configured under the 'listeners' configuration.
+#
+#web_client_location: "/path/to/web/root"
+
+# The public-facing base URL that clients use to access this HS
+# (not including _matrix/...). This is the same URL a user would
+# enter into the 'custom HS URL' field on their client. If you
+# use synapse with a reverse proxy, this should be the URL to reach
+# synapse via the proxy.
+#
+public_baseurl: "$BASE_URL"
+
+# Set the soft limit on the number of file descriptors synapse can use
+# Zero is used to indicate synapse should set the soft limit to the
+# hard limit.
+#
+#soft_file_limit: 0
+
+# Set to false to disable presence tracking on this homeserver.
+#
+#use_presence: false
+
+# Whether to require authentication to retrieve profile data (avatars,
+# display names) of other users through the client API. Defaults to
+# 'false'. Note that profile data is also available via the federation
+# API, so this setting is of limited value if federation is enabled on
+# the server.
+#
+#require_auth_for_profile_requests: true
+
+# If set to 'false', requires authentication to access the server's public rooms
+# directory through the client API. Defaults to 'true'.
+#
+allow_public_rooms_without_auth: $ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH
+
+# If set to 'false', forbids any other homeserver to fetch the server's public
+# rooms directory via federation. Defaults to 'true'.
+#
+allow_public_rooms_over_federation: $ALLOW_PUBLIC_ROOMS_OVER_FEDERATION
+
+# The default room version for newly created rooms.
+#
+# Known room versions are listed here:
+# https://matrix.org/docs/spec/#complete-list-of-room-versions
+#
+# For example, for room version 1, default_room_version should be set
+# to "1".
+#
+#default_room_version: "4"
+
+# The GC threshold parameters to pass to \`gc.set_threshold\`, if defined
+#
+#gc_thresholds: [700, 10, 10]
+
+# Set the limit on the returned events in the timeline in the get
+# and sync operations. The default value is -1, means no upper limit.
+#
+#filter_timeline_limit: 5000
+
+# Whether room invites to users on this server should be blocked
+# (except those sent by local server admins). The default is False.
+#
+#block_non_admin_invites: true
+
+# Room searching
+#
+# If disabled, new messages will not be indexed for searching and users
+# will receive errors when searching for messages. Defaults to enabled.
+#
+#enable_search: false
+
+# Restrict federation to the following whitelist of domains.
+# N.B. we recommend also firewalling your federation listener to limit
+# inbound federation traffic as early as possible, rather than relying
+# purely on this application-layer restriction.  If not specified, the
+# default is to whitelist everything.
+
+$(generate_federation_whitelist)
+
+#federation_domain_whitelist:
+#  - lon.example.com
+#  - nyc.example.com
+#  - syd.example.com
+
+# Prevent federation requests from being sent to the following
+# blacklist IP address CIDR ranges. If this option is not specified, or
+# specified with an empty list, no ip range blacklist will be enforced.
+#
+# As of Synapse v1.4.0 this option also affects any outbound requests to identity
+# servers provided by user input.
+#
+# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
+# listed here, since they correspond to unroutable addresses.)
+#
+federation_ip_range_blacklist:
+  - '127.0.0.0/8'
+  - '10.0.0.0/8'
+  - '172.16.0.0/12'
+  - '192.168.0.0/16'
+  - '100.64.0.0/10'
+  - '169.254.0.0/16'
+  - '::1/128'
+  - 'fe80::/64'
+  - 'fc00::/7'
+
+# List of ports that Synapse should listen on, their purpose and their
+# configuration.
+#
+# Options for each listener include:
+#
+#   port: the TCP port to bind to
+#
+#   bind_addresses: a list of local addresses to listen on. The default is
+#       'all local interfaces'.
+#
+#   type: the type of listener. Normally 'http', but other valid options are:
+#       'manhole' (see docs/manhole.md),
+#       'metrics' (see docs/metrics-howto.md),
+#       'replication' (see docs/workers.md).
+#
+#   tls: set to true to enable TLS for this listener. Will use the TLS
+#       key/cert specified in tls_private_key_path / tls_certificate_path.
+#
+#   x_forwarded: Only valid for an 'http' listener. Set to true to use the
+#       X-Forwarded-For header as the client IP. Useful when Synapse is
+#       behind a reverse-proxy.
+#
+#   resources: Only valid for an 'http' listener. A list of resources to host
+#       on this port. Options for each resource are:
+#
+#       names: a list of names of HTTP resources. See below for a list of
+#           valid resource names.
+#
+#       compress: set to true to enable HTTP comression for this resource.
+#
+#   additional_resources: Only valid for an 'http' listener. A map of
+#        additional endpoints which should be loaded via dynamic modules.
+#
+# Valid resource names are:
+#
+#   client: the client-server API (/_matrix/client), and the synapse admin
+#       API (/_synapse/admin). Also implies 'media' and 'static'.
+#
+#   consent: user consent forms (/_matrix/consent). See
+#       docs/consent_tracking.md.
+#
+#   federation: the server-server API (/_matrix/federation). Also implies
+#       'media', 'keys', 'openid'
+#
+#   keys: the key discovery API (/_matrix/keys).
+#
+#   media: the media API (/_matrix/media).
+#
+#   metrics: the metrics interface. See docs/metrics-howto.md.
+#
+#   openid: OpenID authentication.
+#
+#   replication: the HTTP replication API (/_synapse/replication). See
+#       docs/workers.md.
+#
+#   static: static resources under synapse/static (/_matrix/static). (Mostly
+#       useful for 'fallback authentication'.)
+#
+#   webclient: A web client. Requires web_client_location to be set.
+#
+listeners:
+  # TLS-enabled listener: for when matrix traffic is sent directly to synapse.
+  #
+  # Disabled by default. To enable it, uncomment the following. (Note that you
+  # will also need to give Synapse a TLS key and certificate: see the TLS section
+  # below.)
+  #
+  #- port: 8448
+  #  type: http
+  #  tls: true
+  #  resources:
+  #    - names: [client, federation]
+
+  # Unsecure HTTP listener: for when matrix traffic passes through a reverse proxy
+  # that unwraps TLS.
+  #
+  # If you plan to use a reverse proxy, please see
+  # https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md.
+  #
+  - port: 8008
+    tls: false
+    type: http
+    x_forwarded: true
+    bind_addresses: ['::1', '127.0.0.1']
+
+    resources:
+      - names: $(generate_resources)
+        compress: false
+
+    # example additional_resources:
+    #
+    #additional_resources:
+    #  "/_matrix/my/custom/endpoint":
+    #    module: my_module.CustomRequestHandler
+    #    config: {}
+
+  # Turn on the twisted ssh manhole service on localhost on the given
+  # port.
+  #
+  #- port: 9000
+  #  bind_addresses: ['::1', '127.0.0.1']
+  #  type: manhole
+
+
+## Homeserver blocking ##
+
+# How to reach the server admin, used in ResourceLimitError
+#
+#admin_contact: 'mailto:admin@server.com'
+
+# Global blocking
+#
+#hs_disabled: false
+#hs_disabled_message: 'Human readable reason for why the HS is blocked'
+
+# Monthly Active User Blocking
+#
+# Used in cases where the admin or server owner wants to limit to the
+# number of monthly active users.
+#
+# 'limit_usage_by_mau' disables/enables monthly active user blocking. When
+# anabled and a limit is reached the server returns a 'ResourceLimitError'
+# with error type Codes.RESOURCE_LIMIT_EXCEEDED
+#
+# 'max_mau_value' is the hard limit of monthly active users above which
+# the server will start blocking user actions.
+#
+# 'mau_trial_days' is a means to add a grace period for active users. It
+# means that users must be active for this number of days before they
+# can be considered active and guards against the case where lots of users
+# sign up in a short space of time never to return after their initial
+# session.
+#
+# 'mau_limit_alerting' is a means of limiting client side alerting
+# should the mau limit be reached. This is useful for small instances
+# where the admin has 5 mau seats (say) for 5 specific people and no
+# interest increasing the mau limit further. Defaults to True, which
+# means that alerting is enabled
+#
+#limit_usage_by_mau: false
+#max_mau_value: 50
+#mau_trial_days: 2
+#mau_limit_alerting: false
+
+# If enabled, the metrics for the number of monthly active users will
+# be populated, however no one will be limited. If limit_usage_by_mau
+# is true, this is implied to be true.
+#
+#mau_stats_only: false
+
+# Sometimes the server admin will want to ensure certain accounts are
+# never blocked by mau checking. These accounts are specified here.
+#
+#mau_limit_reserved_threepids:
+#  - medium: 'email'
+#    address: 'reserved_user@example.com'
+
+# Used by phonehome stats to group together related servers.
+#server_context: context
+
+# Resource-constrained Homeserver Settings
+#
+# If limit_remote_rooms.enabled is True, the room complexity will be
+# checked before a user joins a new remote room. If it is above
+# limit_remote_rooms.complexity, it will disallow joining or
+# instantly leave.
+#
+# limit_remote_rooms.complexity_error can be set to customise the text
+# displayed to the user when a room above the complexity threshold has
+# its join cancelled.
+#
+# Uncomment the below lines to enable:
+#limit_remote_rooms:
+#  enabled: true
+#  complexity: 1.0
+#  complexity_error: "This room is too complex."
+
+# Whether to require a user to be in the room to add an alias to it.
+# Defaults to 'true'.
+#
+#require_membership_for_aliases: false
+
+# Whether to allow per-room membership profiles through the send of membership
+# events with profile information that differ from the target's global profile.
+# Defaults to 'true'.
+#
+#allow_per_room_profiles: false
+
+# How long to keep redacted events in unredacted form in the database. After
+# this period redacted events get replaced with their redacted form in the DB.
+#
+# Defaults to \`7d\`. Set to \`null\` to disable.
+#
+#redaction_retention_period: 28d
+
+# How long to track users' last seen time and IPs in the database.
+#
+# Defaults to \`28d\`. Set to \`null\` to disable clearing out of old rows.
+#
+#user_ips_max_age: 14d
+
+
+## TLS ##
+
+# PEM-encoded X509 certificate for TLS.
+# This certificate, as of Synapse 1.0, will need to be a valid and verifiable
+# certificate, signed by a recognised Certificate Authority.
+#
+# See 'ACME support' below to enable auto-provisioning this certificate via
+# Let's Encrypt.
+#
+# If supplying your own, be sure to use a \`.pem\` file that includes the
+# full certificate chain including any intermediate certificates (for
+# instance, if using certbot, use \`fullchain.pem\` as your certificate,
+# not \`cert.pem\`).
+#
+#tls_certificate_path: "CONFDIR/SERVERNAME.tls.crt"
+
+# PEM-encoded private key for TLS
+#
+#tls_private_key_path: "CONFDIR/SERVERNAME.tls.key"
+
+# Whether to verify TLS server certificates for outbound federation requests.
+#
+# Defaults to \`true\`. To disable certificate verification, uncomment the
+# following line.
+#
+#federation_verify_certificates: false
+
+# The minimum TLS version that will be used for outbound federation requests.
+#
+# Defaults to \`1\`. Configurable to \`1\`, \`1.1\`, \`1.2\`, or \`1.3\`. Note
+# that setting this value higher than \`1.2\` will prevent federation to most
+# of the public Matrix network: only configure it to \`1.3\` if you have an
+# entirely private federation setup and you can ensure TLS 1.3 support.
+#
+#federation_client_minimum_tls_version: 1.2
+
+# Skip federation certificate verification on the following whitelist
+# of domains.
+#
+# This setting should only be used in very specific cases, such as
+# federation over Tor hidden services and similar. For private networks
+# of homeservers, you likely want to use a private CA instead.
+#
+# Only effective if federation_verify_certicates is \`true\`.
+#
+#federation_certificate_verification_whitelist:
+#  - lon.example.com
+#  - *.domain.com
+#  - *.onion
+
+# List of custom certificate authorities for federation traffic.
+#
+# This setting should only normally be used within a private network of
+# homeservers.
+#
+# Note that this list will replace those that are provided by your
+# operating environment. Certificates must be in PEM format.
+#
+#federation_custom_ca_list:
+#  - myCA1.pem
+#  - myCA2.pem
+#  - myCA3.pem
+
+# ACME support: This will configure Synapse to request a valid TLS certificate
+# for your configured \`server_name\` via Let's Encrypt.
+#
+# Note that provisioning a certificate in this way requires port 80 to be
+# routed to Synapse so that it can complete the http-01 ACME challenge.
+# By default, if you enable ACME support, Synapse will attempt to listen on
+# port 80 for incoming http-01 challenges - however, this will likely fail
+# with 'Permission denied' or a similar error.
+#
+# There are a couple of potential solutions to this:
+#
+#  * If you already have an Apache, Nginx, or similar listening on port 80,
+#    you can configure Synapse to use an alternate port, and have your web
+#    server forward the requests. For example, assuming you set 'port: 8009'
+#    below, on Apache, you would write:
+#
+#    ProxyPass /.well-known/acme-challenge http://localhost:8009/.well-known/acme-challenge
+#
+#  * Alternatively, you can use something like \`authbind\` to give Synapse
+#    permission to listen on port 80.
+#
+acme:
+    # ACME support is disabled by default. Set this to \`true\` and uncomment
+    # tls_certificate_path and tls_private_key_path above to enable it.
+    #
+    enabled: false
+
+    # Endpoint to use to request certificates. If you only want to test,
+    # use Let's Encrypt's staging url:
+    #     https://acme-staging.api.letsencrypt.org/directory
+    #
+    #url: https://acme-v01.api.letsencrypt.org/directory
+
+    # Port number to listen on for the HTTP-01 challenge. Change this if
+    # you are forwarding connections through Apache/Nginx/etc.
+    #
+    port: 80
+
+    # Local addresses to listen on for incoming connections.
+    # Again, you may want to change this if you are forwarding connections
+    # through Apache/Nginx/etc.
+    #
+    bind_addresses: ['::', '0.0.0.0']
+
+    # How many days remaining on a certificate before it is renewed.
+    #
+    reprovision_threshold: 30
+
+    # The domain that the certificate should be for. Normally this
+    # should be the same as your Matrix domain (i.e., 'server_name'), but,
+    # by putting a file at 'https://<server_name>/.well-known/matrix/server',
+    # you can delegate incoming traffic to another server. If you do that,
+    # you should give the target of the delegation here.
+    #
+    # For example: if your 'server_name' is 'example.com', but
+    # 'https://example.com/.well-known/matrix/server' delegates to
+    # 'matrix.example.com', you should put 'matrix.example.com' here.
+    #
+    # If not set, defaults to your 'server_name'.
+    #
+    domain: matrix.example.com
+
+    # file to use for the account key. This will be generated if it doesn't
+    # exist.
+    #
+    # If unspecified, we will use CONFDIR/client.key.
+    #
+    account_key_file: "$DATA_DIR/acme_account.key"
+
+# List of allowed TLS fingerprints for this server to publish along
+# with the signing keys for this server. Other matrix servers that
+# make HTTPS requests to this server will check that the TLS
+# certificates returned by this server match one of the fingerprints.
+#
+# Synapse automatically adds the fingerprint of its own certificate
+# to the list. So if federation traffic is handled directly by synapse
+# then no modification to the list is required.
+#
+# If synapse is run behind a load balancer that handles the TLS then it
+# will be necessary to add the fingerprints of the certificates used by
+# the loadbalancers to this list if they are different to the one
+# synapse is using.
+#
+# Homeservers are permitted to cache the list of TLS fingerprints
+# returned in the key responses up to the "valid_until_ts" returned in
+# key. It may be necessary to publish the fingerprints of a new
+# certificate and wait until the "valid_until_ts" of the previous key
+# responses have passed before deploying it.
+#
+# You can calculate a fingerprint from a given TLS listener via:
+# openssl s_client -connect $host:$port < /dev/null 2> /dev/null |
+#   openssl x509 -outform DER | openssl sha256 -binary | base64 | tr -d '='
+# or by checking matrix.org/federationtester/api/report?server_name=$host
+#
+#tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
+
+
+
+## Database ##
+
+$(generate_database)
+
+# Number of events to cache in memory.
+#
+event_cache_size: $EVENT_CACHE_SIZE
+
+caches:
+   # Controls the global cache factor, which is the default cache factor
+   # for all caches if a specific factor for that cache is not otherwise
+   # set.
+   #
+   # This can also be set by the "SYNAPSE_CACHE_FACTOR" environment
+   # variable. Setting by environment variable takes priority over
+   # setting through the config file.
+   #
+   # Defaults to 0.5, which will half the size of all caches.
+   #
+   global_factor: $GLOBAL_CACHE_FACTOR
+
+   # A dictionary of cache name to cache factor for that individual
+   # cache. Overrides the global cache factor for a given cache.
+   #
+   # These can also be set through environment variables comprised
+   # of "SYNAPSE_CACHE_FACTOR_" + the name of the cache in capital
+   # letters and underscores. Setting by environment variable
+   # takes priority over setting through the config file.
+   # Ex. SYNAPSE_CACHE_FACTOR_GET_USERS_WHO_SHARE_ROOM_WITH_USER=2.0
+   #
+   # Some caches have '*' and other characters that are not
+   # alphanumeric or underscores. These caches can be named with or
+   # without the special characters stripped. For example, to specify
+   # the cache factor for `*stateGroupCache*` via an environment
+   # variable would be `SYNAPSE_CACHE_FACTOR_STATEGROUPCACHE=2.0`.
+   #
+   per_cache_factors:
+     #get_users_who_share_room_with_user: 2.0
+
+## Logging ##
+
+# A yaml python logging config file as described by
+# https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+#
+log_config: "$LOG_CONFIG_PATH"
+
+
+## Ratelimiting ##
+
+# Ratelimiting settings for client actions (registration, login, messaging).
+#
+# Each ratelimiting configuration is made of two parameters:
+#   - per_second: number of requests a client can send per second.
+#   - burst_count: number of requests a client can send before being throttled.
+#
+# Synapse currently uses the following configurations:
+#   - one for messages that ratelimits sending based on the account the client
+#     is using
+#   - one for registration that ratelimits registration requests based on the
+#     client's IP address.
+#   - one for login that ratelimits login requests based on the client's IP
+#     address.
+#   - one for login that ratelimits login requests based on the account the
+#     client is attempting to log into.
+#   - one for login that ratelimits login requests based on the account the
+#     client is attempting to log into, based on the amount of failed login
+#     attempts for this account.
+#   - one for ratelimiting redactions by room admins. If this is not explicitly
+#     set then it uses the same ratelimiting as per rc_message. This is useful
+#     to allow room admins to deal with abuse quickly.
+#
+# The defaults are as shown below.
+#
+#rc_message:
+#  per_second: 0.2
+#  burst_count: 10
+#
+#rc_registration:
+#  per_second: 0.17
+#  burst_count: 3
+#
+#rc_login:
+#  address:
+#    per_second: 0.17
+#    burst_count: 3
+#  account:
+#    per_second: 0.17
+#    burst_count: 3
+#  failed_attempts:
+#    per_second: 0.17
+#    burst_count: 3
+#
+#rc_admin_redaction:
+#  per_second: 1
+#  burst_count: 50
+
+rc_message:
+  per_second: $RC_MESSAGE_PER_SECOND
+  burst_count: $RC_MESSAGE_BURST
+
+rc_login:
+  address:
+    per_second: $RC_LOGIN_PER_SECOND
+    burst_count: $RC_LOGIN_BURST
+  account:
+    per_second: $RC_LOGIN_PER_SECOND
+    burst_count: $RC_LOGIN_BURST
+  failed_attempts:
+    per_second: $RC_LOGIN_PER_SECOND
+    burst_count: $RC_LOGIN_BURST
+
+# Ratelimiting settings for incoming federation
+#
+# The rc_federation configuration is made up of the following settings:
+#   - window_size: window size in milliseconds
+#   - sleep_limit: number of federation requests from a single server in
+#     a window before the server will delay processing the request.
+#   - sleep_delay: duration in milliseconds to delay processing events
+#     from remote servers by if they go over the sleep limit.
+#   - reject_limit: maximum number of concurrent federation requests
+#     allowed from a single server
+#   - concurrent: number of federation requests to concurrently process
+#     from a single server
+#
+# The defaults are as shown below.
+#
+#rc_federation:
+#  window_size: 1000
+#  sleep_limit: 10
+#  sleep_delay: 500
+#  reject_limit: 50
+#  concurrent: 3
+
+# Target outgoing federation transaction frequency for sending read-receipts,
+# per-room.
+#
+# If we end up trying to send out more read-receipts, they will get buffered up
+# into fewer transactions.
+#
+#federation_rr_transactions_per_room_per_second: 50
+
+
+
+## Media Store ##
+
+# Enable the media store service in the Synapse master. Uncomment the
+# following if you are using a separate media store worker.
+#
+#enable_media_repo: false
+
+# Directory where uploaded images and attachments are stored.
+#
+media_store_path: "$DATA_DIR/media_store"
+
+# Media storage providers allow media to be stored in different
+# locations.
+#
+#media_storage_providers:
+#  - module: file_system
+#    # Whether to write new local files.
+#    store_local: false
+#    # Whether to write new remote media
+#    store_remote: false
+#    # Whether to block upload requests waiting for write to this
+#    # provider to complete
+#    store_synchronous: false
+#    config:
+#       directory: /mnt/some/other/directory
+
+# Directory where in-progress uploads are stored.
+#
+uploads_path: "$DATA_DIR/uploads"
+
+# The largest allowed upload size in bytes
+#
+max_upload_size: "$MAX_UPLOAD_SIZE"
+
+# Maximum number of pixels that will be thumbnailed
+#
+#max_image_pixels: 32M
+
+# Whether to generate new thumbnails on the fly to precisely match
+# the resolution requested by the client. If true then whenever
+# a new resolution is requested by the client the server will
+# generate a new thumbnail. If false the server will pick a thumbnail
+# from a precalculated list.
+#
+#dynamic_thumbnails: false
+
+# List of thumbnails to precalculate when an image is uploaded.
+#
+#thumbnail_sizes:
+#  - width: 32
+#    height: 32
+#    method: crop
+#  - width: 96
+#    height: 96
+#    method: crop
+#  - width: 320
+#    height: 240
+#    method: scale
+#  - width: 640
+#    height: 480
+#    method: scale
+#  - width: 800
+#    height: 600
+#    method: scale
+
+# Is the preview URL API enabled?
+#
+# 'false' by default: uncomment the following to enable it (and specify a
+# url_preview_ip_range_blacklist blacklist).
+#
+#url_preview_enabled: true
+
+# List of IP address CIDR ranges that the URL preview spider is denied
+# from accessing.  There are no defaults: you must explicitly
+# specify a list for URL previewing to work.  You should specify any
+# internal services in your network that you do not want synapse to try
+# to connect to, otherwise anyone in any Matrix room could cause your
+# synapse to issue arbitrary GET requests to your internal services,
+# causing serious security issues.
+#
+# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
+# listed here, since they correspond to unroutable addresses.)
+#
+# This must be specified if url_preview_enabled is set. It is recommended that
+# you uncomment the following list as a starting point.
+#
+#url_preview_ip_range_blacklist:
+#  - '127.0.0.0/8'
+#  - '10.0.0.0/8'
+#  - '172.16.0.0/12'
+#  - '192.168.0.0/16'
+#  - '100.64.0.0/10'
+#  - '169.254.0.0/16'
+#  - '::1/128'
+#  - 'fe80::/64'
+#  - 'fc00::/7'
+
+# List of IP address CIDR ranges that the URL preview spider is allowed
+# to access even if they are specified in url_preview_ip_range_blacklist.
+# This is useful for specifying exceptions to wide-ranging blacklisted
+# target IP ranges - e.g. for enabling URL previews for a specific private
+# website only visible in your network.
+#
+#url_preview_ip_range_whitelist:
+#   - '192.168.1.1'
+
+# Optional list of URL matches that the URL preview spider is
+# denied from accessing.  You should use url_preview_ip_range_blacklist
+# in preference to this, otherwise someone could define a public DNS
+# entry that points to a private IP address and circumvent the blacklist.
+# This is more useful if you know there is an entire shape of URL that
+# you know that will never want synapse to try to spider.
+#
+# Each list entry is a dictionary of url component attributes as returned
+# by urlparse.urlsplit as applied to the absolute form of the URL.  See
+# https://docs.python.org/2/library/urlparse.html#urlparse.urlsplit
+# The values of the dictionary are treated as an filename match pattern
+# applied to that component of URLs, unless they start with a ^ in which
+# case they are treated as a regular expression match.  If all the
+# specified component matches for a given list item succeed, the URL is
+# blacklisted.
+#
+#url_preview_url_blacklist:
+#  # blacklist any URL with a username in its URI
+#  - username: '*'
+#
+#  # blacklist all *.google.com URLs
+#  - netloc: 'google.com'
+#  - netloc: '*.google.com'
+#
+#  # blacklist all plain HTTP URLs
+#  - scheme: 'http'
+#
+#  # blacklist http(s)://www.acme.com/foo
+#  - netloc: 'www.acme.com'
+#    path: '/foo'
+#
+#  # blacklist any URL with a literal IPv4 address
+#  - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
+
+# The largest allowed URL preview spidering size in bytes
+#
+#max_spider_size: 10M
+
+
+## Captcha ##
+# See docs/CAPTCHA_SETUP for full details of configuring this.
+
+# This Home Server's ReCAPTCHA public key.
+#
+#recaptcha_public_key: "YOUR_PUBLIC_KEY"
+
+# This Home Server's ReCAPTCHA private key.
+#
+#recaptcha_private_key: "YOUR_PRIVATE_KEY"
+
+# Enables ReCaptcha checks when registering, preventing signup
+# unless a captcha is answered. Requires a valid ReCaptcha
+# public/private key.
+#
+#enable_registration_captcha: false
+
+# A secret key used to bypass the captcha test entirely.
+#
+#captcha_bypass_secret: "YOUR_SECRET_HERE"
+
+# The API endpoint to use for verifying m.login.recaptcha responses.
+#
+#recaptcha_siteverify_api: "https://www.recaptcha.net/recaptcha/api/siteverify"
+
+
+## TURN ##
+
+# The public URIs of the TURN server to give to clients
+#
+turn_uris: $TURN_URIS
+
+# The shared secret used to compute passwords for the TURN server
+#
+turn_shared_secret: "$TURN_SHARED_SECRET"
+
+# The Username and password if the TURN server needs them and
+# does not use a token
+#
+#turn_username: "TURNSERVER_USERNAME"
+#turn_password: "TURNSERVER_PASSWORD"
+
+# How long generated TURN credentials last
+#
+turn_user_lifetime: "$TURN_USER_LIFETIME"
+
+# Whether guests should be allowed to use the TURN server.
+# This defaults to True, otherwise VoIP will be unreliable for guests.
+# However, it does introduce a slight security risk as it allows users to
+# connect to arbitrary endpoints without having first signed up for a
+# valid account (e.g. by passing a CAPTCHA).
+#
+#turn_allow_guests: true
+
+## Registration ##
+#
+# Registration can be rate-limited using the parameters in the "Ratelimiting"
+# section of this file.
+
+# Enable registration for new users.
+#
+enable_registration: $ALLOW_REGISTRATION
+
+# Optional account validity configuration. This allows for accounts to be denied
+# any request after a given period.
+#
+# \`\`enabled\`\` defines whether the account validity feature is enabled. Defaults
+# to False.
+#
+# \`\`period\`\` allows setting the period after which an account is valid
+# after its registration. When renewing the account, its validity period
+# will be extended by this amount of time. This parameter is required when using
+# the account validity feature.
+#
+# \`\`renew_at\`\` is the amount of time before an account's expiry date at which
+# Synapse will send an email to the account's email address with a renewal link.
+# This needs the \`\`email\`\` and \`\`public_baseurl\`\` configuration sections to be
+# filled.
+#
+# \`\`renew_email_subject\`\` is the subject of the email sent out with the renewal
+# link. \`\`%(app)s\`\` can be used as a placeholder for the \`\`app_name\`\` parameter
+# from the \`\`email\`\` section.
+#
+# Once this feature is enabled, Synapse will look for registered users without an
+# expiration date at startup and will add one to every account it found using the
+# current settings at that time.
+# This means that, if a validity period is set, and Synapse is restarted (it will
+# then derive an expiration date from the current validity period), and some time
+# after that the validity period changes and Synapse is restarted, the users'
+# expiration dates won't be updated unless their account is manually renewed. This
+# date will be randomly selected within a range [now + period - d ; now + period],
+# where d is equal to 10% of the validity period.
+#
+#account_validity:
+#  enabled: true
+#  period: 6w
+#  renew_at: 1w
+#  renew_email_subject: "Renew your %(app)s account"
+#  # Directory in which Synapse will try to find the HTML files to serve to the
+#  # user when trying to renew an account. Optional, defaults to
+#  # synapse/res/templates.
+#  template_dir: "res/templates"
+#  # HTML to be displayed to the user after they successfully renewed their
+#  # account. Optional.
+#  account_renewed_html_path: "account_renewed.html"
+#  # HTML to be displayed when the user tries to renew an account with an invalid
+#  # renewal token. Optional.
+#  invalid_token_html_path: "invalid_token.html"
+
+# Time that a user's session remains valid for, after they log in.
+#
+# Note that this is not currently compatible with guest logins.
+#
+# Note also that this is calculated at login time: changes are not applied
+# retrospectively to users who have already logged in.
+#
+# By default, this is infinite.
+#
+#session_lifetime: 24h
+
+$(generate_registration_requirements)
+
+# Explicitly disable asking for MSISDNs from the registration
+# flow (overrides registrations_require_3pid if MSISDNs are set as required)
+#
+#disable_msisdn_registration: true
+
+$(generate_allowed_3pid_patterns)
+
+# Enable 3PIDs lookup requests to identity servers from this server.
+#
+#enable_3pid_lookup: true
+
+# If set, allows registration of standard or admin accounts by anyone who
+# has the shared secret, even if registration is otherwise disabled.
+#
+# registration_shared_secret: <PRIVATE STRING>
+
+# Set the number of bcrypt rounds used to generate password hash.
+# Larger numbers increase the work factor needed to generate the hash.
+# The default number is 12 (which equates to 2^12 rounds).
+# N.B. that increasing this will exponentially increase the time required
+# to register or login - e.g. 24 => 2^24 rounds which will take >20 mins.
+#
+#bcrypt_rounds: 12
+
+# Allows users to register as guests without a password/email/etc, and
+# participate in rooms hosted on this server which have been made
+# accessible to anonymous users.
+#
+allow_guest_access: $ALLOW_GUEST_ACCESS
+
+# The identity server which we suggest that clients should use when users log
+# in on this server.
+#
+# (By default, no suggestion is made, so it is left up to the client.
+# This setting is ignored unless public_baseurl is also set.)
+#
+#default_identity_server: https://matrix.org
+
+# The list of identity servers trusted to verify third party
+# identifiers by this server.
+#
+# Also defines the ID server which will be called when an account is
+# deactivated (one will be picked arbitrarily).
+#
+# Note: This option is deprecated. Since v0.99.4, Synapse has tracked which identity
+# server a 3PID has been bound to. For 3PIDs bound before then, Synapse runs a
+# background migration script, informing itself that the identity server all of its
+# 3PIDs have been bound to is likely one of the below.
+#
+# As of Synapse v1.4.0, all other functionality of this option has been deprecated, and
+# it is now solely used for the purposes of the background migration script, and can be
+# removed once it has run.
+#trusted_third_party_id_servers:
+#  - matrix.org
+#  - vector.im
+
+# Handle threepid (email/phone etc) registration and password resets through a set of
+# *trusted* identity servers. Note that this allows the configured identity server to
+# reset passwords for accounts!
+#
+# Be aware that if \`email\` is not set, and SMTP options have not been
+# configured in the email config block, registration and user password resets via
+# email will be globally disabled.
+#
+# Additionally, if \`msisdn\` is not set, registration and password resets via msisdn
+# will be disabled regardless. This is due to Synapse currently not supporting any
+# method of sending SMS messages on its own.
+#
+# To enable using an identity server for operations regarding a particular third-party
+# identifier type, set the value to the URL of that identity server as shown in the
+# examples below.
+#
+# Servers handling the these requests must answer the \`/requestToken\` endpoints defined
+# by the Matrix Identity Service API specification:
+# https://matrix.org/docs/spec/identity_service/latest
+#
+# If a delegate is specified, the config option public_baseurl must also be filled out.
+#
+account_threepid_delegates:
+    #email: https://example.com     # Delegate email sending to example.org
+    #msisdn: http://localhost:8090  # Delegate SMS sending to this local process
+
+
+$(generate_auto_join_rooms)
+
+# Where auto_join_rooms are specified, setting this flag ensures that the
+# the rooms exist by creating them when the first user on the
+# homeserver registers.
+# Setting to false means that if the rooms are not manually created,
+# users cannot be auto-joined since they do not exist.
+#
+#autocreate_auto_join_rooms: true
+
+
+## Metrics ###
+
+# Enable collection and rendering of performance metrics
+#
+enable_metrics: $EXPOSE_METRICS
+
+# Enable sentry integration
+# NOTE: While attempts are made to ensure that the logs don't contain
+# any sensitive information, this cannot be guaranteed. By enabling
+# this option the sentry server may therefore receive sensitive
+# information, and it in turn may then diseminate sensitive information
+# through insecure notification channels if so configured.
+#
+#sentry:
+#    dsn: "..."
+
+# Flags to enable Prometheus metrics which are not suitable to be
+# enabled by default, either for performance reasons or limited use.
+#
+metrics_flags:
+    # Publish synapse_federation_known_servers, a g auge of the number of
+    # servers this homeserver knows about, including itself. May cause
+    # performance problems on large homeservers.
+    #
+    #known_servers: true
+
+# Whether or not to report anonymized homeserver usage statistics.
+report_stats: $REPORT_STATS
+
+# The endpoint to report the anonymized homeserver usage statistics to.
+# Defaults to https://matrix.org/report-usage-stats/push
+#
+#report_stats_endpoint: https://example.com/report-usage-stats/push
+
+
+## API Configuration ##
+
+# A list of event types that will be included in the room_invite_state
+#
+#room_invite_state_types:
+#  - "m.room.join_rules"
+#  - "m.room.canonical_alias"
+#  - "m.room.avatar"
+#  - "m.room.encryption"
+#  - "m.room.name"
+
+# A list of application service config files to use
+#
+$(generate_app_service_config_files)
+
+# Uncomment to enable tracking of application service IP addresses. Implicitly
+# enables MAU tracking for application service users.
+#
+#track_appservice_user_ips: true
+
+
+# a secret which is used to sign access tokens. If none is specified,
+# the registration_shared_secret is used, if one is given; otherwise,
+# a secret key is derived from the signing key.
+#
+# macaroon_secret_key: <PRIVATE STRING>
+
+# a secret which is used to calculate HMACs for form values, to stop
+# falsification of values. Must be specified for the User Consent
+# forms to work.
+#
+# form_secret: <PRIVATE STRING>
+
+## Signing Keys ##
+
+# Path to the signing key to sign messages with
+#
+signing_key_path: "$SIGNING_KEY_PATH"
+
+# The keys that the server used to sign messages with but won't use
+# to sign new messages. E.g. it has lost its private key
+#
+#old_signing_keys:
+#  "ed25519:auto":
+#    # Base64 encoded public key
+#    key: "The public part of your old signing key."
+#    # Millisecond POSIX timestamp when the key expired.
+#    expired_ts: 123456789123
+
+# How long key response published by this server is valid for.
+# Used to set the valid_until_ts in /key/v2 APIs.
+# Determines how quickly servers will query to check which keys
+# are still valid.
+#
+#key_refresh_interval: 1d
+
+# The trusted servers to download signing keys from.
+#
+# When we need to fetch a signing key, each server is tried in parallel.
+#
+# Normally, the connection to the key server is validated via TLS certificates.
+# Additional security can be provided by configuring a \`verify key\`, which
+# will make synapse check that the response is signed by that key.
+#
+# This setting supercedes an older setting named \`perspectives\`. The old format
+# is still supported for backwards-compatibility, but it is deprecated.
+#
+# 'trusted_key_servers' defaults to matrix.org, but using it will generate a
+# warning on start-up. To suppress this warning, set
+# 'suppress_key_server_warning' to true.
+#
+# Options for each entry in the list include:
+#
+#    server_name: the name of the server. required.
+#
+#    verify_keys: an optional map from key id to base64-encoded public key.
+#       If specified, we will check that the response is signed by at least
+#       one of the given keys.
+#
+#    accept_keys_insecurely: a boolean. Normally, if \`verify_keys\` is unset,
+#       and federation_verify_certificates is not \`true\`, synapse will refuse
+#       to start, because this would allow anyone who can spoof DNS responses
+#       to masquerade as the trusted key server. If you know what you are doing
+#       and are sure that your network environment provides a secure connection
+#       to the key server, you can set this to \`true\` to override this
+#       behaviour.
+#
+# An example configuration might look like:
+#
+#trusted_key_servers:
+#  - server_name: "my_trusted_server.example.com"
+#    verify_keys:
+#      "ed25519:auto": "abcdefghijklmnopqrstuvwxyzabcdefghijklmopqr"
+#  - server_name: "my_other_trusted_server.example.com"
+#
+trusted_key_servers:
+  - server_name: "matrix.org"
+
+# Uncomment the following to disable the warning that is emitted when the
+# trusted_key_servers include 'matrix.org'. See above.
+#
+#suppress_key_server_warning: true
+
+# The signing keys to use when acting as a trusted key server. If not specified
+# defaults to the server signing key.
+#
+# Can contain multiple keys, one per line.
+#
+#key_server_signing_keys_path: "key_server_signing_keys.key"
+
+
+# Enable SAML2 for registration and login. Uses pysaml2.
+#
+# At least one of \`sp_config\` or \`config_path\` must be set in this section to
+# enable SAML login.
+#
+# (You will probably also want to set the following options to \`false\` to
+# disable the regular login/registration flows:
+#   * enable_registration
+#   * password_config.enabled
+#
+# Once SAML support is enabled, a metadata file will be exposed at
+# https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
+# use to configure your SAML IdP with. Alternatively, you can manually configure
+# the IdP to use an ACS location of
+# https://<server>:<port>/_matrix/saml2/authn_response.
+#
+saml2_config:
+  # \`sp_config\` is the configuration for the pysaml2 Service Provider.
+  # See pysaml2 docs for format of config.
+  #
+  # Default values will be used for the 'entityid' and 'service' settings,
+  # so it is not normally necessary to specify them unless you need to
+  # override them.
+  #
+  #sp_config:
+  #  # point this to the IdP's metadata. You can use either a local file or
+  #  # (preferably) a URL.
+  #  metadata:
+  #    #local: ["saml2/idp.xml"]
+  #    remote:
+  #      - url: https://our_idp/metadata.xml
+  #
+  #    # By default, the user has to go to our login page first. If you'd like
+  #    # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
+  #    # 'service.sp' section:
+  #    #
+  #    #service:
+  #    #  sp:
+  #    #    allow_unsolicited: true
+  #
+  #    # The examples below are just used to generate our metadata xml, and you
+  #    # may well not need them, depending on your setup. Alternatively you
+  #    # may need a whole lot more detail - see the pysaml2 docs!
+  #
+  #    description: ["My awesome SP", "en"]
+  #    name: ["Test SP", "en"]
+  #
+  #    organization:
+  #      name: Example com
+  #      display_name:
+  #        - ["Example co", "en"]
+  #      url: "http://example.com"
+  #
+  #    contact_person:
+  #      - given_name: Bob
+  #        sur_name: "the Sysadmin"
+  #        email_address": ["admin@example.com"]
+  #        contact_type": technical
+
+  # Instead of putting the config inline as above, you can specify a
+  # separate pysaml2 configuration file:
+  #
+  #config_path: "CONFDIR/sp_conf.py"
+
+  # the lifetime of a SAML session. This defines how long a user has to
+  # complete the authentication process, if allow_unsolicited is unset.
+  # The default is 5 minutes.
+  #
+  #saml_session_lifetime: 5m
+
+  # The SAML attribute (after mapping via the attribute maps) to use to derive
+  # the Matrix ID from. 'uid' by default.
+  #
+  #mxid_source_attribute: displayName
+
+  # The mapping system to use for mapping the saml attribute onto a matrix ID.
+  # Options include:
+  #  * 'hexencode' (which maps unpermitted characters to '=xx')
+  #  * 'dotreplace' (which replaces unpermitted characters with '.').
+  # The default is 'hexencode'.
+  #
+  #mxid_mapping: dotreplace
+
+  # In previous versions of synapse, the mapping from SAML attribute to MXID was
+  # always calculated dynamically rather than stored in a table. For backwards-
+  # compatibility, we will look for user_ids matching such a pattern before
+  # creating a new account.
+  #
+  # This setting controls the SAML attribute which will be used for this
+  # backwards-compatibility lookup. Typically it should be 'uid', but if the
+  # attribute maps are changed, it may be necessary to change it.
+  #
+  # The default is 'uid'.
+  #
+  #grandfathered_mxid_source_attribute: upn
+
+
+
+# Enable CAS for registration and login.
+#
+#cas_config:
+#   enabled: true
+#   server_url: "https://cas-server.com"
+#   service_url: "https://homeserver.domain.com:8448"
+#   #displayname_attribute: name
+#   #required_attributes:
+#   #    name: value
+
+
+# The JWT needs to contain a globally unique "sub" (subject) claim.
+#
+#jwt_config:
+#   enabled: true
+#   secret: "a secret"
+#   algorithm: "HS256"
+
+
+password_config:
+   # Uncomment to disable password login
+   #
+   #enabled: false
+
+   # Uncomment to disable authentication against the local password
+   # database. This is ignored if \`enabled\` is false, and is only useful
+   # if you have other password_providers.
+   #
+   #localdb_enabled: false
+
+   # Uncomment and change to a secret random string for extra security.
+   # DO NOT CHANGE THIS AFTER INITIAL SETUP!
+   #
+   #pepper: "EVEN_MORE_SECRET"
+
+
+
+# Enable sending emails for password resets, notification events or
+# account expiry notices
+#
+# If your SMTP server requires authentication, the optional smtp_user &
+# smtp_pass variables should be used
+#
+email:
+   enable_notifs: $ENABLE_NOTIFICATIONS
+   smtp_host: "$SMTP_HOST"
+   smtp_port: $SMTP_PORT # SSL: 465, STARTTLS: 587
+   smtp_user: "$SMTP_USER"
+   smtp_pass: $SMTP_PASS
+   require_transport_security: $SMTP_TLS
+   notif_from: "%(app)s <$SMTP_USER>"
+   app_name: Matrix
+
+   # Enable email notifications by default
+   #
+   notif_for_new_users: $ENABLE_NOTIFICATIONS_BY_DEFAULT
+
+   # Defining a custom URL for Riot is only needed if email notifications
+   # should contain links to a self-hosted installation of Riot; when set
+   # the "app_name" setting is ignored
+   #
+   riot_base_url: "$RIOT_BASE_URL"
+
+   # Configure the time that a validation email or text message code
+   # will expire after sending
+   #
+   # This is currently used for password resets
+   #
+   #validation_token_lifetime: 1h
+
+   # Template directory. All template files should be stored within this
+   # directory. If not set, default templates from within the Synapse
+   # package will be used
+   #
+   # For the list of default templates, please see
+   # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
+   #
+   #template_dir: res/templates
+
+   # Templates for email notifications
+   #
+   notif_template_html: notif_mail.html
+   notif_template_text: notif_mail.txt
+
+   # Templates for account expiry notices
+   #
+   expiry_template_html: notice_expiry.html
+   expiry_template_text: notice_expiry.txt
+
+   # Templates for password reset emails sent by the homeserver
+   #
+   #password_reset_template_html: password_reset.html
+   #password_reset_template_text: password_reset.txt
+
+   # Templates for registration emails sent by the homeserver
+   #
+   #registration_template_html: registration.html
+   #registration_template_text: registration.txt
+
+   # Templates for validation emails sent by the homeserver when adding an email to
+   # your user account
+   #
+   #add_threepid_template_html: add_threepid.html
+   #add_threepid_template_text: add_threepid.txt
+
+   # Templates for password reset success and failure pages that a user
+   # will see after attempting to reset their password
+   #
+   #password_reset_template_success_html: password_reset_success.html
+   #password_reset_template_failure_html: password_reset_failure.html
+
+   # Templates for registration success and failure pages that a user
+   # will see after attempting to register using an email or phone
+   #
+   #registration_template_success_html: registration_success.html
+   #registration_template_failure_html: registration_failure.html
+
+   # Templates for success and failure pages that a user will see after attempting
+   # to add an email or phone to their account
+   #
+   #add_threepid_success_html: add_threepid_success.html
+   #add_threepid_failure_html: add_threepid_failure.html
+
+$(generate_password_providers)
+
+# Clients requesting push notifications can either have the body of
+# the message sent in the notification poke along with other details
+# like the sender, or just the event ID and room ID (\`event_id_only\`).
+# If clients choose the former, this option controls whether the
+# notification request includes the content of the event (other details
+# like the sender are still included). For \`event_id_only\` push, it
+# has no effect.
+#
+# For modern android devices the notification content will still appear
+# because it is loaded by the app. iPhone, however will send a
+# notification saying only that a message arrived and who it came from.
+#
+#push:
+#  include_content: true
+
+
+#spam_checker:
+#  module: "my_custom_project.SuperSpamChecker"
+#  config:
+#    example_option: 'things'
+
+
+# Uncomment to allow non-server-admin users to create groups on this server
+#
+#enable_group_creation: true
+
+# If enabled, non server admins can only create groups with local parts
+# starting with this prefix
+#
+#group_creation_prefix: "unofficial/"
+
+
+
+# User Directory configuration
+#
+# 'enabled' defines whether users can search the user directory. If
+# false then empty responses are returned to all queries. Defaults to
+# true.
+#
+# 'search_all_users' defines whether to search all users visible to your HS
+# when searching the user directory, rather than limiting to users visible
+# in public rooms.  Defaults to false.  If you set it True, you'll have to
+# rebuild the user_directory search indexes, see
+# https://github.com/matrix-org/synapse/blob/master/docs/user_directory.md
+#
+#user_directory:
+#  enabled: true
+#  search_all_users: false
+
+
+# User Consent configuration
+#
+# for detailed instructions, see
+# https://github.com/matrix-org/synapse/blob/master/docs/consent_tracking.md
+#
+# Parts of this section are required if enabling the 'consent' resource under
+# 'listeners', in particular 'template_dir' and 'version'.
+#
+# 'template_dir' gives the location of the templates for the HTML forms.
+# This directory should contain one subdirectory per language (eg, 'en', 'fr'),
+# and each language directory should contain the policy document (named as
+# '<version>.html') and a success page (success.html).
+#
+# 'version' specifies the 'current' version of the policy document. It defines
+# the version to be served by the consent resource if there is no 'v'
+# parameter.
+#
+# 'server_notice_content', if enabled, will send a user a "Server Notice"
+# asking them to consent to the privacy policy. The 'server_notices' section
+# must also be configured for this to work. Notices will *not* be sent to
+# guest users unless 'send_server_notice_to_guests' is set to true.
+#
+# 'block_events_error', if set, will block any attempts to send events
+# until the user consents to the privacy policy. The value of the setting is
+# used as the text of the error.
+#
+# 'require_at_registration', if enabled, will add a step to the registration
+# process, similar to how captcha works. Users will be required to accept the
+# policy before their account is created.
+#
+# 'policy_name' is the display name of the policy users will see when registering
+# for an account. Has no effect unless \`require_at_registration\` is enabled.
+# Defaults to "Privacy Policy".
+#
+#user_consent:
+#  template_dir: res/templates/privacy
+#  version: 1.0
+#  server_notice_content:
+#    msgtype: m.text
+#    body: >-
+#      To continue using this homeserver you must review and agree to the
+#      terms and conditions at %(consent_uri)s
+#  send_server_notice_to_guests: true
+#  block_events_error: >-
+#    To continue using this homeserver you must review and agree to the
+#    terms and conditions at %(consent_uri)s
+#  require_at_registration: false
+#  policy_name: Privacy Policy
+#
+
+
+
+# Local statistics collection. Used in populating the room directory.
+#
+# 'bucket_size' controls how large each statistics timeslice is. It can
+# be defined in a human readable short form -- e.g. "1d", "1y".
+#
+# 'retention' controls how long historical statistics will be kept for.
+# It can be defined in a human readable short form -- e.g. "1d", "1y".
+#
+#
+#stats:
+#   enabled: true
+#   bucket_size: 1d
+#   retention: 1y
+
+
+# Server Notices room configuration
+#
+# Uncomment this section to enable a room which can be used to send notices
+# from the server to users. It is a special room which cannot be left; notices
+# come from a special "notices" user id.
+#
+# If you uncomment this section, you *must* define the system_mxid_localpart
+# setting, which defines the id of the user which will be used to send the
+# notices.
+#
+# It's also possible to override the room name, the display name of the
+# "notices" user, and the avatar for the user.
+
+$(generate_server_notices)
+
+
+# Uncomment to disable searching the public room list. When disabled
+# blocks searching local and remote room lists for local and remote
+# users by always returning an empty list for all queries.
+#
+#enable_room_list_search: false
+
+# The \`alias_creation\` option controls who's allowed to create aliases
+# on this server.
+#
+# The format of this option is a list of rules that contain globs that
+# match against user_id, room_id and the new alias (fully qualified with
+# server name). The action in the first rule that matches is taken,
+# which can currently either be "allow" or "deny".
+#
+# Missing user_id/room_id/alias fields default to "*".
+#
+# If no rules match the request is denied. An empty list means no one
+# can create aliases.
+#
+# Options for the rules include:
+#
+#   user_id: Matches against the creator of the alias
+#   alias: Matches against the alias being created
+#   room_id: Matches against the room ID the alias is being pointed at
+#   action: Whether to "allow" or "deny" the request if the rule matches
+#
+# The default is:
+#
+#alias_creation_rules:
+#  - user_id: "*"
+#    alias: "*"
+#    room_id: "*"
+#    action: allow
+
+# The \`room_list_publication_rules\` option controls who can publish and
+# which rooms can be published in the public room list.
+#
+# The format of this option is the same as that for
+# \`alias_creation_rules\`.
+#
+# If the room has one or more aliases associated with it, only one of
+# the aliases needs to match the alias rule. If there are no aliases
+# then only rules with \`alias: *\` match.
+#
+# If no rules match the request is denied. An empty list means no one
+# can publish rooms.
+#
+# Options for the rules include:
+#
+#   user_id: Matches agaisnt the creator of the alias
+#   room_id: Matches against the room ID being published
+#   alias: Matches against any current local or canonical aliases
+#            associated with the room
+#   action: Whether to "allow" or "deny" the request if the rule matches
+#
+# The default is:
+#
+#room_list_publication_rules:
+#  - user_id: "*"
+#    alias: "*"
+#    room_id: "*"
+#    action: allow
+
+
+# Server admins can define a Python module that implements extra rules for
+# allowing or denying incoming events. In order to work, this module needs to
+# override the methods defined in synapse/events/third_party_rules.py.
+#
+# This feature is designed to be used in closed federations only, where each
+# participating server enforces the same rules.
+#
+#third_party_event_rules:
+#  module: "my_custom_project.SuperRulesSet"
+#  config:
+#    example_option: 'things'
+
+
+## Opentracing ##
+
+# These settings enable opentracing, which implements distributed tracing.
+# This allows you to observe the causal chains of events across servers
+# including requests, key lookups etc., across any server running
+# synapse or any other other services which supports opentracing
+# (specifically those implemented with Jaeger).
+#
+opentracing:
+# tracing is disabled by default. Uncomment the following line to enable it.
+#
+#enabled: true
+
+    # The list of homeservers we wish to send and receive span contexts and span baggage.
+    # See docs/opentracing.rst
+    # This is a list of regexes which are matched against the server_name of the
+    # homeserver.
+    #
+    # By defult, it is empty, so no servers are matched.
+    #
+    #homeserver_whitelist:
+    #  - ".*"
+
+    # Jaeger can be configured to sample traces at different rates.
+    # All configuration options provided by Jaeger can be set here.
+    # Jaeger's configuration mostly related to trace sampling which
+    # is documented here:
+    # https://www.jaegertracing.io/docs/1.13/sampling/.
+    #
+    #jaeger_config:
+    #  sampler:
+    #    type: const
+    #    param: 1
+
+    #  Logging whether spans were started and reported
+    #
+    #  logging:
+    #    false
+    #
+EOF
diff --git a/type/__matrix_synapse/files/log.config.sh b/type/__matrix_synapse/files/log.config.sh
new file mode 100755
index 0000000..2a9a9dd
--- /dev/null
+++ b/type/__matrix_synapse/files/log.config.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+
+cat << EOF
+
+version: 1
+
+formatters:
+  precise:
+   format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
+  journal_fmt:
+   format: '%(name)s: [%(request)s] %(message)s'
+
+filters:
+  context:
+    (): synapse.util.logcontext.LoggingContextFilter
+    request: ""
+
+handlers:
+  file:
+    class: logging.handlers.WatchedFileHandler
+    formatter: precise
+    filename: $LOG_DIR/homeserver.log
+    filters: [context]
+    level: DEBUG
+    encoding: utf8
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+    level: WARN
+  journal:
+    class: systemd.journal.JournalHandler
+    formatter: journal_fmt
+    filters: [context]
+    SYSLOG_IDENTIFIER: synapse
+
+loggers:
+    twisted:
+        level: WARN
+
+    synapse:
+        level: INFO
+
+    # the following levels are more verbose than most users want
+    # set them to INFO if you need more logging
+    synapse.metrics:
+        level: WARN
+
+    synapse.http.federation.well_known_resolver:
+        level: WARN
+
+    synapse.storage.TIME:
+        level: WARN
+
+    synapse.http.matrixfederationclient:
+        level: WARN
+
+root:
+    level: INFO
+    handlers: [file, journal]
+EOF
diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
new file mode 100644
index 0000000..3fb096b
--- /dev/null
+++ b/type/__matrix_synapse/man.rst
@@ -0,0 +1,180 @@
+cdist-type__matrix_synapse(7)
+======================
+
+NAME
+----
+cdist-type__matrix_synapse - Install and configure Synapse, a Matrix homeserver
+
+
+DESCRIPTION
+-----------
+This type install and configure the Synapse Matrix homeserver. This is a
+signleton type.
+
+
+REQUIRED PARAMETERS
+-------------------
+server_name
+  Name of your homeserver (e.g. ungleich.ch) used as part of your MXIDs. This
+  value cannot be changed without meddling with the database once the server is
+  being used.
+
+base_url
+  Public URL of your homeserver (e.g. http://matrix.ungleich.ch).
+
+database_engine
+  'sqlite3' or 'postgresql'
+
+database_name
+  Path to the database if SQLite3 is used or database name if PostgresSQL is
+  used.
+
+OPTIONAL PARAMETERS
+-------------------
+database_host
+  Database node address, only used with PostgresSQL.
+
+database_user
+  Database user, only used with PostgresSQL.
+
+database_password
+  Database password, only used with PostgresSQL.
+
+ldap_uri
+  Address of your LDAP server.
+
+ldap_base_dn
+  Base DN of your LDAP tree.
+
+ldap_uid_attribute
+  LDAP attriute mapping to Synapse's uid field, default to uid.
+
+ldap_mail_attribute
+  LDAP attriute mapping to Synapse's mail field, default to mail.
+
+ldap_name_attribute
+  LDAP attriute mapping to Synapse's name field, default to givenName.
+
+ldap_bind_dn
+  User used to authenticate against your LDAP server in 'search' mode.
+
+ldap_bind_password
+  Password used to authenticate against your LDAP server in 'search' mode.
+
+ldap_filter
+  LDAP user filter, defaulting to `(objectClass=posixAccount)`.
+
+turn_uri
+  URI to TURN server, can be provided multiple times if there is more than one
+  server.
+
+turn_shared_secret
+  Shared secret used to access the TURN REST API.
+
+turn_user_lifetime
+  Lifetime of TURN credentials. Defaults to 1h.
+
+max_upload_size
+  Maximum size for user-uploaded files. Defaults to 10M.
+
+rc_message_per_second
+  Message rate-limiting (per second). Defaults to 0.17.
+
+rc_message_burst
+  Message rate-limiting (burst). Defaults to 3.
+
+rc_login_per_second
+  Login rate-limiting (per-second). Defaults to 0.17.
+
+rc_login_burst
+  Login rate-limiting (burst). Defaults to 3.
+
+branding_auth_header_logo_url
+  A logo that is shown in the header during authentication flows.
+
+branding_auth_footer_links
+  A list of links to show in the authentication page footer: `[{"text": "Link text", "url": "https://link.target"}, {"text": "Other link", ...}]`
+
+registration_allows_email_pattern
+    Only allow email addresses matching specified filter. Can be specified multiple times. A pattern must look like `.*@vector\.im`.
+
+auto_join_room
+  Room where newly-registered users are automatically added. Can be specified multiple times.
+
+app_service_config_file
+  Path (on remote) of an application service configuration file to load. Can be specified multiple times.
+
+extra_setting
+  Arbitrary string to be added to the configuration file. Can be specified multiple times.
+
+BOOLEAN PARAMETERS
+------------------
+allow_registration
+  Enables user registration on the homeserver.
+
+enable_ldap_auth
+  Enables ldap-backed authentication.
+
+ldap_search_mode
+  Enables 'search' mode for LDAP auth backend.
+
+report_stats
+  Whether or not to report anonymized homeserver usage statistics.
+
+expose_metrics
+  Expose metrics endpoint for Prometheus.
+
+disable_federation
+  Disable federation to the broader matrix network.
+
+registration_require_email
+  Make email a required field on registration.
+
+allow_public_rooms_over_federation
+  Allow other homeservers to fetch this server's public room directory.
+
+allow_public_rooms_without_auth
+  If set to 'false', requires authentication to access the server's public rooms directory through the client API.
+
+enable_server_notices
+  Enable the server notices room.
+
+global_cache_factor
+  Controls the global cache factor, which is the default cache factor
+  for all caches if a specific factor for that cache is not otherwise
+  set. Defaults to 0.5.
+
+event_cache_size
+  Number of events to cache in memory. Defaults to 10K.
+
+allow_guest_access
+  Allows users to register as guests without a password/email/etc, and
+  participate in rooms hosted on this server which have been made accessible to
+  anonymous users.
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    __matrix_synapse --server_name ungleich.ch \
+      --base_url https://matrix.ungleich.ch \
+      --database_engine sqlite3 \
+      --database_name /var/lib/matrix-syanpse/homeserver.db
+
+SEE ALSO
+--------
+- `cdist-type__matrix_riot(7) <cdist-type__matrix_riot.html>`_
+
+
+AUTHORS
+-------
+Timothée Floure <timothee.floure@ungleich.ch>
+
+
+COPYING
+-------
+Copyright \(C) 2019 Timothée Floure. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
new file mode 100755
index 0000000..12893d1
--- /dev/null
+++ b/type/__matrix_synapse/manifest
@@ -0,0 +1,287 @@
+#!/bin/sh -e
+#
+# 2019 Timothée Floure (timothee.floure@ungleich.ch)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+# OS-specific configuration.
+os=$(cat "$__global/explorer/os")
+distribution=$(cat "$__global/explorer/lsb_codename")
+
+case "$os" in
+   debian)
+     synapse_user=matrix-synapse
+     synapse_pkg=matrix-synapse
+     synapse_service=matrix-synapse
+     ldap_auth_provider_pkg=matrix-synapse-ldap3
+     psycopg2_pkg=python3-psycopg2
+     synapse_conf_dir='/etc/matrix-synapse'
+     synapse_data_dir='/var/lib/matrix-synapse'
+
+     if [ ! -f "$__global/explorer/lsb_codename" ]; then
+       ls "$__global/explorer" >&2
+       echo "Could not determine Debian release, ensure that lsb-release is installed on the target." >&2
+       exit 1
+     fi
+     ;;
+   fedora)
+     synapse_user=synapse
+     synapse_pkg=matrix-synapse
+     synapse_service=synapse
+     ldap_auth_provider_pkg=python-matrix-synapse-ldap3
+     synapse_conf_dir='/etc/synapse'
+     synapse_data_dir='/var/lib/synapse'
+     ;;
+   freebsd)
+     synapse_user=synapse
+     synapse_pkg=py36-matrix-synapse
+     synapse_service=synapse
+     ldap_auth_provider_pkg=py36-matrix-synapse-ldap3
+     synapse_conf_dir='/usr/local/etc/matrix-synapse'
+     synapse_data_dir='/var/matrix-synapse'
+     ;;
+   alpine)
+     echo "As of 2019-12-19  matrix-synapse is not in alpine stable. Exiting."
+     exit 1
+     ;;
+   *)
+      printf "Your operating system (%s) is currently not supported by this type (%s)\n" "$os" "${__type##*/}" >&2
+      printf "Please contribute an implementation for it if you can.\n" >&2
+      exit 1
+   ;;
+esac
+
+# Required parameters:
+export SERVER_NAME=$(cat "$__object/parameter/server_name")
+export BASE_URL=$(cat "$__object/parameter/base_url")
+
+export DATA_DIR=$synapse_data_dir
+export LOG_DIR='/var/log/matrix-synapse'
+export PIDFILE='/var/run/matrix/homeserver.pid'
+export LOG_CONFIG_PATH="$synapse_conf_dir/log.yaml"
+export SIGNING_KEY_PATH="$synapse_conf_dir/signin.key"
+
+export DATABASE_ENGINE=$(cat "$__object/parameter/database_engine")
+export DATABASE_NAME=$(cat "$__object/parameter/database_name")
+
+# Optional parameters:
+export DATABASE_HOST=$(cat "$__object/parameter/database_host")
+export DATABASE_USER=$(cat "$__object/parameter/database_user")
+export DATABASE_PASSWORD=$(cat "$__object/parameter/database_password")
+
+export GLOBAL_CACHE_FACTOR=$(cat "$__object/parameter/global_cache_factor")
+export EVENT_CACHE_SIZE=$(cat "$__object/parameter/event_cache_size")
+
+export LDAP_FILTER=$(cat "$__object/parameter/ldap_filter")
+export LDAP_UID_ATTRIBUTE=$(cat "$__object/parameter/ldap_uid_attribute")
+export LDAP_MAIL_ATTRIBUTE=$(cat "$__object/parameter/ldap_mail_attribute")
+export LDAP_NAME_ATTRIBUTE=$(cat "$__object/parameter/ldap_name_attribute")
+export LDAP_URI=$(cat "$__object/parameter/ldap_uri")
+export LDAP_BASE_DN=$(cat "$__object/parameter/ldap_base_dn")
+export LDAP_BIND_DN=$(cat "$__object/parameter/ldap_bind_dn")
+export LDAP_BIND_PASSWORD=$(cat "$__object/parameter/ldap_bind_password")
+
+export TURN_USER_LIFETIME=$(cat "$__object/parameter/turn_user_lifetime")
+if [ -f "$__object/parameter/turn_shared_secret" ]; then
+    export TURN_SHARED_SECRET=$(cat "$__object/parameter/turn_shared_secret")
+fi
+if [ -f "$__object/parameter/turn_uri" ]; then
+    uris=$(cat "$__object/parameter/turn_uri" | tr "\n" "," | sed 's/,$//')
+    export TURN_URIS="[$uris]"
+fi
+
+if [ -f "$__object/parameter/registration_allows_email_pattern" ]; then
+    export RESGISTRATION_ALLOWS_EMAIL_PATTERN=$(cat "$__object/parameter/registration_allows_email_pattern")
+fi
+
+if [ -f "$__object/parameter/auto_join_room" ]; then
+    export AUTO_JOIN_ROOMS="$(cat "$__object/parameter/auto_join_room")"
+fi
+
+if [ -f "$__object/parameter/app_service_config_file" ]; then
+    export APP_SERVICE_CONFIG_FILES=$(cat "$__object/parameter/app_service_config_file")
+fi
+
+export MAX_UPLOAD_SIZE=$(cat "$__object/parameter/max_upload_size")
+export RIOT_BASE_URL=$(cat "$__object/parameter/riot_base_url")
+
+export SMTP_HOST=$(cat "$__object/parameter/smtp_host")
+export SMTP_PORT=$(cat "$__object/parameter/smtp_port")
+export SMTP_USER=$(cat "$__object/parameter/smtp_user")
+export SMTP_PASS=$(cat "$__object/parameter/smtp_pass")
+
+export RC_MESSAGE_PER_SECOND=$(cat "$__object/parameter/rc_message_per_second")
+export RC_MESSAGE_BURST=$(cat "$__object/parameter/rc_message_burst")
+export RC_LOGIN_PER_SECOND=$(cat "$__object/parameter/rc_login_per_second")
+export RC_LOGIN_BURST=$(cat "$__object/parameter/rc_login_burst")
+
+if [ -f "$__object/parameter/extra_setting" ]; then
+    export EXTRA_SETTINGS=$(cat "$__object/parameter/extra_setting")
+fi
+
+# Boolean parameters:
+if [ -f "$__object/parameter/report_stats" ]; then
+    export REPORT_STATS='true'
+else
+    export REPORT_STATS='false'
+fi
+if [ -f "$__object/parameter/allow_registration" ]; then
+    export ALLOW_REGISTRATION='true'
+else
+    export ALLOW_REGISTRATION='false'
+fi
+if [ -f "$__object/parameter/enable_ldap_auth" ]; then
+    export ENABLE_LDAP_AUTH='true'
+else
+    export ENABLE_LDAP_AUTH='false'
+fi
+if [ -f "$__object/parameter/ldap_search_mode" ]; then
+    export LDAP_SEARCH_MODE=1
+fi
+if [ -f "$__object/parameter/expose_metrics" ]; then
+    export EXPOSE_METRICS='true'
+else
+    export EXPOSE_METRICS='false'
+fi
+if [ -f "$__object/parameter/enable_notifications" ]; then
+    export ENABLE_NOTIFICATIONS='true'
+else
+    export ENABLE_NOTIFICATIONS='false'
+fi
+if [ -f "$__object/parameter/enable_notifications_by_default" ]; then
+    export ENABLE_NOTIFICATIONS_BY_DEFAULT='true'
+else
+    export ENABLE_NOTIFICATIONS_BY_DEFAULT='false'
+fi
+if [ -f "$__object/parameter/smtp_requires_tls" ]; then
+    export SMTP_TLS='true'
+else
+    export SMTP_TLS='false'
+fi
+if [ -f "$__object/parameter/disable_federation" ]; then
+    export DISABLE_FEDERATION='true'
+else
+    export DISABLE_FEDERATION='false'
+fi
+if [ -f "$__object/parameter/allow_guest_access" ]; then
+    export ALLOW_GUEST_ACCESS='true'
+else
+    export ALLOW_GUEST_ACCESS='false'
+fi
+if [ -f "$__object/parameter/registration_requires_email" ]; then
+    export REGISTRATION_REQUIRES_EMAIL=1
+fi
+if [ -f "$__object/parameter/allow_public_rooms_over_federation" ]; then
+    export ALLOW_PUBLIC_ROOMS_OVER_FEDERATION='true'
+else
+    export ALLOW_PUBLIC_ROOMS_OVER_FEDERATION='false'
+fi
+if [ -f "$__object/parameter/allow_public_rooms_without_auth" ]; then
+    export ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH='true'
+else
+    export ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH='false'
+fi
+if [ -f "$__object/parameter/enable_server_notices" ]; then
+    export ENABLE_SERVER_NOTICES=1
+fi
+
+# Specific case for debian-buster, boilerplate but there's not much I can do
+# about it.
+
+installation_reqs=""
+if [ "$os" == "debian" ] && [ "$distribution" == "buster" ]; then
+  # Enable debian-backports for debian Buster, as the 'stable'
+  # matrix-synapse package is ways too old (< 1.0).
+  __apt_source debian-backports \
+    --uri http://deb.debian.org/debian/ \
+    --distribution "$distribution-backports" \
+    --component main
+   require="__apt_source/debian-backports" __apt_update_index
+
+  # Install base matrix-synapse package.
+  require="__apt_update_index" __package_apt $synapse_pkg \
+    --state present \
+    --target-release "$distribution-backports"
+
+  # Install LdapAuthProvider module if LDAP auth is enabled.
+  if [ "$ENABLE_LDAP_AUTH" == "true" ]; then
+    require="__package_apt/$synapse_pkg" __package_apt $ldap_auth_provider_pkg \
+      --state present \
+      --target-release "$distribution-backports"
+    installation_reqs="$installation_reqs __package_apt/$ldap_auth_provider_pkg"
+  fi
+
+  # For some reason, psycopg2 is not considered a dependency of
+  # matrix-synapse in matrix.org's APT repository.
+  if [ "$DATABASE_ENGINE" == "psycopg2" ]; then
+    require="__package_apt/$synapse_pkg" __package_apt $psycopg2_pkg \
+      --state present
+      installation_reqs="$installation_reqs __package_apt/$psycopg2_pkg"
+  fi
+
+  # Used for dependency order resolution.
+  installation_reqs="$installation_reqs __package_apt/$synapse_pkg"
+else
+  # Install base matrix-synapse package.
+  __package $synapse_pkg --state present
+
+  # Install LdapAuthProvider module if LDAP auth is enabled.
+  if [ "$ENABLE_LDAP_AUTH" == "true" ]; then
+    require="__package/$synapse_pkg" __package $ldap_auth_provider_pkg \
+      --state present
+  fi
+
+  # Used for dependency order resolution.
+  installation_reqs="__package/$synapse_pkg"
+fi
+
+# Generate and deploy configuration files.
+mkdir -p "$__object/files"
+"$__type/files/homeserver.yaml.sh" > "$__object/files/homeserver.yaml"
+"$__type/files/log.config.sh" > "$__object/files/log.config"
+
+require="$installation_reqs" __file "$synapse_conf_dir/homeserver.yaml" \
+  --state present \
+  --owner $synapse_user \
+  --mode 600 \
+  --source "$__object/files/homeserver.yaml"
+require="$installation_reqs" __file "$LOG_CONFIG_PATH" \
+  --state present \
+  --owner $synapse_user \
+  --mode 600 \
+  --source "$__object/files/log.config"
+require="$installation_reqs" __directory $DATA_DIR --state present --owner $synapse_user
+require="$installation_reqs" __directory $LOG_DIR --state present --owner $synapse_user
+
+# Work around dpkg-reconfigure for Debian package.
+RESTART_REQUIRES="__file/$synapse_conf_dir/homeserver.yaml"
+if [ "$os" == "debian" ]; then
+  require="$installation_reqs" __file "$synapse_conf_dir/conf.d/server_name.yaml" \
+    --state present --owner $synapse_user --source - << EOF
+server_name: "$SERVER_NAME"
+EOF
+  require="$installation_reqs" __file "$synapse_conf_dir/conf.d/report_stats.yaml" \
+    --state present --owner $synapse_user --source - << EOF
+report_stats: $REPORT_STATS
+EOF
+
+  RESTART_REQUIRES="$RESTART_REQUIRES __file/$synapse_conf_dir/conf.d/server_name.yaml \
+      __file/$synapse_conf_dir/conf.d/report_stats.yaml"
+fi
+
+# Restart synapse homeserver to reload configuration.
+require="$RESTART_REQUIRES" __service $synapse_service --action restart
diff --git a/type/__matrix_synapse/parameter/boolean b/type/__matrix_synapse/parameter/boolean
new file mode 100644
index 0000000..8c8df26
--- /dev/null
+++ b/type/__matrix_synapse/parameter/boolean
@@ -0,0 +1,14 @@
+allow_registration
+enable_ldap_auth
+ldap_search_mode
+report_stats
+expose_metrics
+enable_notifications
+enable_notifications_by_default
+smtp_requires_tls
+disable_federation
+registration_requires_email
+allow_public_rooms_over_federation
+enable_server_notices
+allow_guest_access
+allow_public_rooms_without_auth
diff --git a/type/__matrix_synapse/parameter/default/database_host b/type/__matrix_synapse/parameter/default/database_host
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/database_password b/type/__matrix_synapse/parameter/default/database_password
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/database_user b/type/__matrix_synapse/parameter/default/database_user
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/event_cache_size b/type/__matrix_synapse/parameter/default/event_cache_size
new file mode 100644
index 0000000..c19807c
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/event_cache_size
@@ -0,0 +1 @@
+10K
diff --git a/type/__matrix_synapse/parameter/default/global_cache_factor b/type/__matrix_synapse/parameter/default/global_cache_factor
new file mode 100644
index 0000000..2eb3c4f
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/global_cache_factor
@@ -0,0 +1 @@
+0.5
diff --git a/type/__matrix_synapse/parameter/default/ldap_base_dn b/type/__matrix_synapse/parameter/default/ldap_base_dn
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/ldap_bind_dn b/type/__matrix_synapse/parameter/default/ldap_bind_dn
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/ldap_bind_password b/type/__matrix_synapse/parameter/default/ldap_bind_password
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/ldap_filter b/type/__matrix_synapse/parameter/default/ldap_filter
new file mode 100644
index 0000000..f760ae9
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/ldap_filter
@@ -0,0 +1 @@
+(objectClass=posixAccount)
diff --git a/type/__matrix_synapse/parameter/default/ldap_mail_attribute b/type/__matrix_synapse/parameter/default/ldap_mail_attribute
new file mode 100644
index 0000000..fa7963c
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/ldap_mail_attribute
@@ -0,0 +1 @@
+mail
diff --git a/type/__matrix_synapse/parameter/default/ldap_name_attribute b/type/__matrix_synapse/parameter/default/ldap_name_attribute
new file mode 100644
index 0000000..4368fce
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/ldap_name_attribute
@@ -0,0 +1 @@
+givenName
diff --git a/type/__matrix_synapse/parameter/default/ldap_uid_attribute b/type/__matrix_synapse/parameter/default/ldap_uid_attribute
new file mode 100644
index 0000000..8cd2301
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/ldap_uid_attribute
@@ -0,0 +1 @@
+uid
diff --git a/type/__matrix_synapse/parameter/default/ldap_uri b/type/__matrix_synapse/parameter/default/ldap_uri
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/max_upload_size b/type/__matrix_synapse/parameter/default/max_upload_size
new file mode 100644
index 0000000..a1f4d0d
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/max_upload_size
@@ -0,0 +1 @@
+10M
diff --git a/type/__matrix_synapse/parameter/default/rc_login_burst b/type/__matrix_synapse/parameter/default/rc_login_burst
new file mode 100644
index 0000000..00750ed
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/rc_login_burst
@@ -0,0 +1 @@
+3
diff --git a/type/__matrix_synapse/parameter/default/rc_login_per_second b/type/__matrix_synapse/parameter/default/rc_login_per_second
new file mode 100644
index 0000000..50653ad
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/rc_login_per_second
@@ -0,0 +1 @@
+0.17
diff --git a/type/__matrix_synapse/parameter/default/rc_message_burst b/type/__matrix_synapse/parameter/default/rc_message_burst
new file mode 100644
index 0000000..00750ed
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/rc_message_burst
@@ -0,0 +1 @@
+3
diff --git a/type/__matrix_synapse/parameter/default/rc_message_per_second b/type/__matrix_synapse/parameter/default/rc_message_per_second
new file mode 100644
index 0000000..50653ad
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/rc_message_per_second
@@ -0,0 +1 @@
+0.17
diff --git a/type/__matrix_synapse/parameter/default/smtp_host b/type/__matrix_synapse/parameter/default/smtp_host
new file mode 100644
index 0000000..2fbb50c
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/smtp_host
@@ -0,0 +1 @@
+localhost
diff --git a/type/__matrix_synapse/parameter/default/smtp_pass b/type/__matrix_synapse/parameter/default/smtp_pass
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/smtp_port b/type/__matrix_synapse/parameter/default/smtp_port
new file mode 100644
index 0000000..7273c0f
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/smtp_port
@@ -0,0 +1 @@
+25
diff --git a/type/__matrix_synapse/parameter/default/smtp_user b/type/__matrix_synapse/parameter/default/smtp_user
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/turn_user_lifetime b/type/__matrix_synapse/parameter/default/turn_user_lifetime
new file mode 100644
index 0000000..6f96dba
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/turn_user_lifetime
@@ -0,0 +1 @@
+1h
diff --git a/type/__matrix_synapse/parameter/optional b/type/__matrix_synapse/parameter/optional
new file mode 100644
index 0000000..a7a2aee
--- /dev/null
+++ b/type/__matrix_synapse/parameter/optional
@@ -0,0 +1,25 @@
+database_host
+database_user
+database_password
+ldap_uri
+ldap_base_dn
+ldap_uid_attribute
+ldap_mail_attribute
+ldap_name_attribute
+ldap_bind_dn
+ldap_bind_password
+ldap_filter
+turn_shared_secret
+turn_user_lifetime
+max_upload_size
+smtp_host
+smtp_port
+smtp_user
+smtp_pass
+riot_base_url
+rc_message_per_second
+rc_message_burst
+rc_login_per_second
+rc_login_burst
+global_cache_factor
+event_cache_size
diff --git a/type/__matrix_synapse/parameter/optional_multiple b/type/__matrix_synapse/parameter/optional_multiple
new file mode 100644
index 0000000..e758bd1
--- /dev/null
+++ b/type/__matrix_synapse/parameter/optional_multiple
@@ -0,0 +1,5 @@
+turn_uri
+registration_allows_email_pattern
+auto_join_room
+app_service_config_file
+extra_setting
diff --git a/type/__matrix_synapse/parameter/required b/type/__matrix_synapse/parameter/required
new file mode 100644
index 0000000..de3e9a2
--- /dev/null
+++ b/type/__matrix_synapse/parameter/required
@@ -0,0 +1,4 @@
+server_name
+base_url
+database_engine
+database_name
diff --git a/type/__matrix_synapse/singleton b/type/__matrix_synapse/singleton
new file mode 100644
index 0000000..e69de29

From ce09c402b183d42e8b2d9c59b9e947355c2deb1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Tue, 28 Jul 2020 14:44:37 +0200
Subject: [PATCH 02/23] __matrix_synapse: make shellcheck happy!

---
 .../__matrix_synapse/files/homeserver.yaml.sh |  10 +-
 type/__matrix_synapse/manifest                | 111 ++++++++++++------
 2 files changed, 77 insertions(+), 44 deletions(-)

diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index 77be438..4d47ed3 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -51,7 +51,7 @@ password_providers:
            name: "$LDAP_NAME_ATTRIBUTE"
         filter: "$LDAP_FILTER"
 EOF
-    if [ $LDAP_SEARCH_MODE ]; then
+    if [ "$LDAP_SEARCH_MODE" ]; then
         cat <<EOF
         mode: "search"
         bind_dn: "$LDAP_BIND_DN"
@@ -652,9 +652,9 @@ acme:
 # responses have passed before deploying it.
 #
 # You can calculate a fingerprint from a given TLS listener via:
-# openssl s_client -connect $host:$port < /dev/null 2> /dev/null |
+# openssl s_client -connect \$host:\$port < /dev/null 2> /dev/null |
 #   openssl x509 -outform DER | openssl sha256 -binary | base64 | tr -d '='
-# or by checking matrix.org/federationtester/api/report?server_name=$host
+# or by checking matrix.org/federationtester/api/report?server_name=\$host
 #
 #tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
 
@@ -693,8 +693,8 @@ caches:
    # Some caches have '*' and other characters that are not
    # alphanumeric or underscores. These caches can be named with or
    # without the special characters stripped. For example, to specify
-   # the cache factor for `*stateGroupCache*` via an environment
-   # variable would be `SYNAPSE_CACHE_FACTOR_STATEGROUPCACHE=2.0`.
+   # the cache factor for \`*stateGroupCache*\` via an environment
+   # variable would be \`SYNAPSE_CACHE_FACTOR_STATEGROUPCACHE=2.0\`.
    #
    per_cache_factors:
      #get_users_who_share_room_with_user: 2.0
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 12893d1..17084bd 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -66,8 +66,10 @@ case "$os" in
 esac
 
 # Required parameters:
-export SERVER_NAME=$(cat "$__object/parameter/server_name")
-export BASE_URL=$(cat "$__object/parameter/base_url")
+SERVER_NAME=$(cat "$__object/parameter/server_name")
+export SERVER_NAME
+BASE_URL=$(cat "$__object/parameter/base_url")
+export BASE_URL
 
 export DATA_DIR=$synapse_data_dir
 export LOG_DIR='/var/log/matrix-synapse'
@@ -75,62 +77,93 @@ export PIDFILE='/var/run/matrix/homeserver.pid'
 export LOG_CONFIG_PATH="$synapse_conf_dir/log.yaml"
 export SIGNING_KEY_PATH="$synapse_conf_dir/signin.key"
 
-export DATABASE_ENGINE=$(cat "$__object/parameter/database_engine")
-export DATABASE_NAME=$(cat "$__object/parameter/database_name")
+DATABASE_ENGINE=$(cat "$__object/parameter/database_engine")
+export DATABASE_ENGINE
+DATABASE_NAME=$(cat "$__object/parameter/database_name")
+export DATABASE_NAME
 
 # Optional parameters:
-export DATABASE_HOST=$(cat "$__object/parameter/database_host")
-export DATABASE_USER=$(cat "$__object/parameter/database_user")
-export DATABASE_PASSWORD=$(cat "$__object/parameter/database_password")
+DATABASE_HOST=$(cat "$__object/parameter/database_host")
+export DATABASE_HOST
+DATABASE_USER=$(cat "$__object/parameter/database_user")
+export DATABASE_USER
+DATABASE_PASSWORD=$(cat "$__object/parameter/database_password")
+export DATABASE_PASSWORD
 
-export GLOBAL_CACHE_FACTOR=$(cat "$__object/parameter/global_cache_factor")
-export EVENT_CACHE_SIZE=$(cat "$__object/parameter/event_cache_size")
+GLOBAL_CACHE_FACTOR=$(cat "$__object/parameter/global_cache_factor")
+export GLOBAL_CACHE_FACTOR
+EVENT_CACHE_SIZE=$(cat "$__object/parameter/event_cache_size")
+export EVENT_CACHE_SIZE
 
-export LDAP_FILTER=$(cat "$__object/parameter/ldap_filter")
-export LDAP_UID_ATTRIBUTE=$(cat "$__object/parameter/ldap_uid_attribute")
-export LDAP_MAIL_ATTRIBUTE=$(cat "$__object/parameter/ldap_mail_attribute")
-export LDAP_NAME_ATTRIBUTE=$(cat "$__object/parameter/ldap_name_attribute")
-export LDAP_URI=$(cat "$__object/parameter/ldap_uri")
-export LDAP_BASE_DN=$(cat "$__object/parameter/ldap_base_dn")
-export LDAP_BIND_DN=$(cat "$__object/parameter/ldap_bind_dn")
-export LDAP_BIND_PASSWORD=$(cat "$__object/parameter/ldap_bind_password")
+LDAP_FILTER=$(cat "$__object/parameter/ldap_filter")
+export LDAP_FILTER
+LDAP_UID_ATTRIBUTE=$(cat "$__object/parameter/ldap_uid_attribute")
+export LDAP_UID_ATTRIBUTE
+LDAP_MAIL_ATTRIBUTE=$(cat "$__object/parameter/ldap_mail_attribute")
+export LDAP_MAIL_ATTRIBUTE
+LDAP_NAME_ATTRIBUTE=$(cat "$__object/parameter/ldap_name_attribute")
+export LDAP_NAME_ATTRIBUTE
+LDAP_URI=$(cat "$__object/parameter/ldap_uri")
+export LDAP_URI
+LDAP_BASE_DN=$(cat "$__object/parameter/ldap_base_dn")
+export LDAP_BASE_DN
+LDAP_BIND_DN=$(cat "$__object/parameter/ldap_bind_dn")
+export LDAP_BIND_DN
+LDAP_BIND_PASSWORD=$(cat "$__object/parameter/ldap_bind_password")
+export LDAP_BIND_PASSWORD
 
-export TURN_USER_LIFETIME=$(cat "$__object/parameter/turn_user_lifetime")
+TURN_USER_LIFETIME=$(cat "$__object/parameter/turn_user_lifetime")
+export TURN_USER_LIFETIME
 if [ -f "$__object/parameter/turn_shared_secret" ]; then
-    export TURN_SHARED_SECRET=$(cat "$__object/parameter/turn_shared_secret")
+    TURN_SHARED_SECRET=$(cat "$__object/parameter/turn_shared_secret")
+    export TURN_SHARED_SECRET
 fi
 if [ -f "$__object/parameter/turn_uri" ]; then
-    uris=$(cat "$__object/parameter/turn_uri" | tr "\n" "," | sed 's/,$//')
+    uris=$(tr "\n" "," < "$__object/parameter/turn_uri" | sed 's/,$//')
     export TURN_URIS="[$uris]"
 fi
 
 if [ -f "$__object/parameter/registration_allows_email_pattern" ]; then
-    export RESGISTRATION_ALLOWS_EMAIL_PATTERN=$(cat "$__object/parameter/registration_allows_email_pattern")
+    RESGISTRATION_ALLOWS_EMAIL_PATTERN=$(cat "$__object/parameter/registration_allows_email_pattern")
+    export RESGISTRATION_ALLOWS_EMAIL_PATTERN
 fi
 
 if [ -f "$__object/parameter/auto_join_room" ]; then
-    export AUTO_JOIN_ROOMS="$(cat "$__object/parameter/auto_join_room")"
+    AUTO_JOIN_ROOMS="$(cat "$__object/parameter/auto_join_room")"
+    export AUTO_JOIN_ROOMS
 fi
 
 if [ -f "$__object/parameter/app_service_config_file" ]; then
-    export APP_SERVICE_CONFIG_FILES=$(cat "$__object/parameter/app_service_config_file")
+    APP_SERVICE_CONFIG_FILES=$(cat "$__object/parameter/app_service_config_file")
+    export APP_SERVICE_CONFIG_FILES
 fi
 
-export MAX_UPLOAD_SIZE=$(cat "$__object/parameter/max_upload_size")
-export RIOT_BASE_URL=$(cat "$__object/parameter/riot_base_url")
+MAX_UPLOAD_SIZE=$(cat "$__object/parameter/max_upload_size")
+export MAX_UPLOAD_SIZE
+RIOT_BASE_URL=$(cat "$__object/parameter/riot_base_url")
+export RIOT_BASE_URL
 
-export SMTP_HOST=$(cat "$__object/parameter/smtp_host")
-export SMTP_PORT=$(cat "$__object/parameter/smtp_port")
-export SMTP_USER=$(cat "$__object/parameter/smtp_user")
-export SMTP_PASS=$(cat "$__object/parameter/smtp_pass")
+SMTP_HOST=$(cat "$__object/parameter/smtp_host")
+export SMTP_HOST
+SMTP_PORT=$(cat "$__object/parameter/smtp_port")
+export SMTP_PORT
+SMTP_USER=$(cat "$__object/parameter/smtp_user")
+export SMTP_USER
+SMTP_PASS=$(cat "$__object/parameter/smtp_pass")
+export SMTP_PASS
 
-export RC_MESSAGE_PER_SECOND=$(cat "$__object/parameter/rc_message_per_second")
-export RC_MESSAGE_BURST=$(cat "$__object/parameter/rc_message_burst")
-export RC_LOGIN_PER_SECOND=$(cat "$__object/parameter/rc_login_per_second")
-export RC_LOGIN_BURST=$(cat "$__object/parameter/rc_login_burst")
+RC_MESSAGE_PER_SECOND=$(cat "$__object/parameter/rc_message_per_second")
+export RC_MESSAGE_PER_SECOND
+RC_MESSAGE_BURST=$(cat "$__object/parameter/rc_message_burst")
+export RC_MESSAGE_BURST
+RC_LOGIN_PER_SECOND=$(cat "$__object/parameter/rc_login_per_second")
+export RC_LOGIN_PER_SECOND
+RC_LOGIN_BURST=$(cat "$__object/parameter/rc_login_burst")
+export RC_LOGIN_BURST
 
 if [ -f "$__object/parameter/extra_setting" ]; then
-    export EXTRA_SETTINGS=$(cat "$__object/parameter/extra_setting")
+    EXTRA_SETTINGS=$(cat "$__object/parameter/extra_setting")
+    export EXTRA_SETTINGS
 fi
 
 # Boolean parameters:
@@ -203,7 +236,7 @@ fi
 # about it.
 
 installation_reqs=""
-if [ "$os" == "debian" ] && [ "$distribution" == "buster" ]; then
+if [ "$os" = "debian" ] && [ "$distribution" = "buster" ]; then
   # Enable debian-backports for debian Buster, as the 'stable'
   # matrix-synapse package is ways too old (< 1.0).
   __apt_source debian-backports \
@@ -218,7 +251,7 @@ if [ "$os" == "debian" ] && [ "$distribution" == "buster" ]; then
     --target-release "$distribution-backports"
 
   # Install LdapAuthProvider module if LDAP auth is enabled.
-  if [ "$ENABLE_LDAP_AUTH" == "true" ]; then
+  if [ "$ENABLE_LDAP_AUTH" = "true" ]; then
     require="__package_apt/$synapse_pkg" __package_apt $ldap_auth_provider_pkg \
       --state present \
       --target-release "$distribution-backports"
@@ -227,7 +260,7 @@ if [ "$os" == "debian" ] && [ "$distribution" == "buster" ]; then
 
   # For some reason, psycopg2 is not considered a dependency of
   # matrix-synapse in matrix.org's APT repository.
-  if [ "$DATABASE_ENGINE" == "psycopg2" ]; then
+  if [ "$DATABASE_ENGINE" = "psycopg2" ]; then
     require="__package_apt/$synapse_pkg" __package_apt $psycopg2_pkg \
       --state present
       installation_reqs="$installation_reqs __package_apt/$psycopg2_pkg"
@@ -240,7 +273,7 @@ else
   __package $synapse_pkg --state present
 
   # Install LdapAuthProvider module if LDAP auth is enabled.
-  if [ "$ENABLE_LDAP_AUTH" == "true" ]; then
+  if [ "$ENABLE_LDAP_AUTH" = "true" ]; then
     require="__package/$synapse_pkg" __package $ldap_auth_provider_pkg \
       --state present
   fi
@@ -269,7 +302,7 @@ require="$installation_reqs" __directory $LOG_DIR --state present --owner $synap
 
 # Work around dpkg-reconfigure for Debian package.
 RESTART_REQUIRES="__file/$synapse_conf_dir/homeserver.yaml"
-if [ "$os" == "debian" ]; then
+if [ "$os" = "debian" ]; then
   require="$installation_reqs" __file "$synapse_conf_dir/conf.d/server_name.yaml" \
     --state present --owner $synapse_user --source - << EOF
 server_name: "$SERVER_NAME"

From 25849bbda17dfc912ff5ae96f1203367e0d4784c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Fri, 12 Feb 2021 09:58:10 +0100
Subject: [PATCH 03/23] __matrix_synapse: use dash instead of underscore in
 parameter names

---
 type/__matrix_synapse/man.rst                 |  94 ++++++++--------
 type/__matrix_synapse/manifest                | 106 +++++++++---------
 type/__matrix_synapse/parameter/boolean       |  28 ++---
 .../default/{database_host => database-host}  |   0
 .../{database_password => database-password}  |   0
 .../default/{database_user => database-user}  |   0
 .../{event_cache_size => event-cache-size}    |   0
 ...lobal_cache_factor => global-cache-factor} |   0
 .../default/{ldap_base_dn => ldap-base-dn}    |   0
 .../default/{ldap_bind_dn => ldap-bind-dn}    |   0
 ...{ldap_bind_password => ldap-bind-password} |   0
 .../default/{ldap_filter => ldap-filter}      |   0
 ...dap_mail_attribute => ldap-mail-attribute} |   0
 ...dap_name_attribute => ldap-name-attribute} |   0
 ...{ldap_uid_attribute => ldap-uid-attribute} |   0
 .../parameter/default/{ldap_uri => ldap-uri}  |   0
 .../{max_upload_size => max-upload-size}      |   0
 .../{rc_login_burst => rc-login-burst}        |   0
 ...c_login_per_second => rc-login-per-second} |   0
 .../{rc_message_burst => rc-message-burst}    |   0
 ...ssage_per_second => rc-message-per-second} |   0
 .../default/{smtp_host => smtp-host}          |   0
 .../default/{smtp_pass => smtp-pass}          |   0
 .../default/{smtp_port => smtp-port}          |   0
 .../default/{smtp_user => smtp-user}          |   0
 ...{turn_user_lifetime => turn-user-lifetime} |   0
 type/__matrix_synapse/parameter/optional      |  50 ++++-----
 .../parameter/optional_multiple               |  10 +-
 type/__matrix_synapse/parameter/required      |   8 +-
 29 files changed, 148 insertions(+), 148 deletions(-)
 rename type/__matrix_synapse/parameter/default/{database_host => database-host} (100%)
 rename type/__matrix_synapse/parameter/default/{database_password => database-password} (100%)
 rename type/__matrix_synapse/parameter/default/{database_user => database-user} (100%)
 rename type/__matrix_synapse/parameter/default/{event_cache_size => event-cache-size} (100%)
 rename type/__matrix_synapse/parameter/default/{global_cache_factor => global-cache-factor} (100%)
 rename type/__matrix_synapse/parameter/default/{ldap_base_dn => ldap-base-dn} (100%)
 rename type/__matrix_synapse/parameter/default/{ldap_bind_dn => ldap-bind-dn} (100%)
 rename type/__matrix_synapse/parameter/default/{ldap_bind_password => ldap-bind-password} (100%)
 rename type/__matrix_synapse/parameter/default/{ldap_filter => ldap-filter} (100%)
 rename type/__matrix_synapse/parameter/default/{ldap_mail_attribute => ldap-mail-attribute} (100%)
 rename type/__matrix_synapse/parameter/default/{ldap_name_attribute => ldap-name-attribute} (100%)
 rename type/__matrix_synapse/parameter/default/{ldap_uid_attribute => ldap-uid-attribute} (100%)
 rename type/__matrix_synapse/parameter/default/{ldap_uri => ldap-uri} (100%)
 rename type/__matrix_synapse/parameter/default/{max_upload_size => max-upload-size} (100%)
 rename type/__matrix_synapse/parameter/default/{rc_login_burst => rc-login-burst} (100%)
 rename type/__matrix_synapse/parameter/default/{rc_login_per_second => rc-login-per-second} (100%)
 rename type/__matrix_synapse/parameter/default/{rc_message_burst => rc-message-burst} (100%)
 rename type/__matrix_synapse/parameter/default/{rc_message_per_second => rc-message-per-second} (100%)
 rename type/__matrix_synapse/parameter/default/{smtp_host => smtp-host} (100%)
 rename type/__matrix_synapse/parameter/default/{smtp_pass => smtp-pass} (100%)
 rename type/__matrix_synapse/parameter/default/{smtp_port => smtp-port} (100%)
 rename type/__matrix_synapse/parameter/default/{smtp_user => smtp-user} (100%)
 rename type/__matrix_synapse/parameter/default/{turn_user_lifetime => turn-user-lifetime} (100%)

diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index 3fb096b..f0e8c10 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -14,140 +14,140 @@ signleton type.
 
 REQUIRED PARAMETERS
 -------------------
-server_name
+server-name
   Name of your homeserver (e.g. ungleich.ch) used as part of your MXIDs. This
   value cannot be changed without meddling with the database once the server is
   being used.
 
-base_url
+base-url
   Public URL of your homeserver (e.g. http://matrix.ungleich.ch).
 
-database_engine
+database-engine
   'sqlite3' or 'postgresql'
 
-database_name
+database-name
   Path to the database if SQLite3 is used or database name if PostgresSQL is
   used.
 
 OPTIONAL PARAMETERS
 -------------------
-database_host
+database-host
   Database node address, only used with PostgresSQL.
 
-database_user
+database-user
   Database user, only used with PostgresSQL.
 
-database_password
+database-password
   Database password, only used with PostgresSQL.
 
-ldap_uri
+ldap-uri
   Address of your LDAP server.
 
-ldap_base_dn
+ldap-base-dn
   Base DN of your LDAP tree.
 
-ldap_uid_attribute
+ldap-uid-attribute
   LDAP attriute mapping to Synapse's uid field, default to uid.
 
-ldap_mail_attribute
+ldap-mail-attribute
   LDAP attriute mapping to Synapse's mail field, default to mail.
 
-ldap_name_attribute
+ldap-name-attribute
   LDAP attriute mapping to Synapse's name field, default to givenName.
 
-ldap_bind_dn
+ldap-bind-dn
   User used to authenticate against your LDAP server in 'search' mode.
 
-ldap_bind_password
+ldap-bind-password
   Password used to authenticate against your LDAP server in 'search' mode.
 
-ldap_filter
+ldap-filter
   LDAP user filter, defaulting to `(objectClass=posixAccount)`.
 
-turn_uri
+turn-uri
   URI to TURN server, can be provided multiple times if there is more than one
   server.
 
-turn_shared_secret
+turn-shared-secret
   Shared secret used to access the TURN REST API.
 
-turn_user_lifetime
+turn-user-lifetime
   Lifetime of TURN credentials. Defaults to 1h.
 
-max_upload_size
+max-upload-size
   Maximum size for user-uploaded files. Defaults to 10M.
 
-rc_message_per_second
+rc-message-per-second
   Message rate-limiting (per second). Defaults to 0.17.
 
-rc_message_burst
+rc-message-burst
   Message rate-limiting (burst). Defaults to 3.
 
-rc_login_per_second
+rc-login-per-second
   Login rate-limiting (per-second). Defaults to 0.17.
 
-rc_login_burst
+rc-login-burst
   Login rate-limiting (burst). Defaults to 3.
 
-branding_auth_header_logo_url
+branding-auth-header-logo-url
   A logo that is shown in the header during authentication flows.
 
-branding_auth_footer_links
+branding-auth-footer-links
   A list of links to show in the authentication page footer: `[{"text": "Link text", "url": "https://link.target"}, {"text": "Other link", ...}]`
 
-registration_allows_email_pattern
+registration-allows-email-pattern
     Only allow email addresses matching specified filter. Can be specified multiple times. A pattern must look like `.*@vector\.im`.
 
-auto_join_room
+auto-join-room
   Room where newly-registered users are automatically added. Can be specified multiple times.
 
-app_service_config_file
+app-service-config-file
   Path (on remote) of an application service configuration file to load. Can be specified multiple times.
 
-extra_setting
+extra-setting
   Arbitrary string to be added to the configuration file. Can be specified multiple times.
 
 BOOLEAN PARAMETERS
 ------------------
-allow_registration
+allow-registration
   Enables user registration on the homeserver.
 
-enable_ldap_auth
+enable-ldap-auth
   Enables ldap-backed authentication.
 
-ldap_search_mode
+ldap-search-mode
   Enables 'search' mode for LDAP auth backend.
 
-report_stats
+report-stats
   Whether or not to report anonymized homeserver usage statistics.
 
-expose_metrics
+expose-metrics
   Expose metrics endpoint for Prometheus.
 
-disable_federation
+disable-federation
   Disable federation to the broader matrix network.
 
-registration_require_email
+registration-require-email
   Make email a required field on registration.
 
-allow_public_rooms_over_federation
+allow-public-rooms-over-federation
   Allow other homeservers to fetch this server's public room directory.
 
-allow_public_rooms_without_auth
+allow-public-rooms-without-auth
   If set to 'false', requires authentication to access the server's public rooms directory through the client API.
 
-enable_server_notices
+enable-server-notices
   Enable the server notices room.
 
-global_cache_factor
+global-cache-factor
   Controls the global cache factor, which is the default cache factor
   for all caches if a specific factor for that cache is not otherwise
   set. Defaults to 0.5.
 
-event_cache_size
+event-cache-size
   Number of events to cache in memory. Defaults to 10K.
 
-allow_guest_access
+allow-guest-access
   Allows users to register as guests without a password/email/etc, and
   participate in rooms hosted on this server which have been made accessible to
   anonymous users.
@@ -157,14 +157,14 @@ EXAMPLES
 
 .. code-block:: sh
 
-    __matrix_synapse --server_name ungleich.ch \
-      --base_url https://matrix.ungleich.ch \
-      --database_engine sqlite3 \
-      --database_name /var/lib/matrix-syanpse/homeserver.db
+    __matrix_synapse --server-name ungleich.ch \
+      --base-url https://matrix.ungleich.ch \
+      --database-engine sqlite3 \
+      --database-name /var/lib/matrix-syanpse/homeserver.db
 
 SEE ALSO
 --------
-- `cdist-type__matrix_riot(7) <cdist-type__matrix_riot.html>`_
+- `cdist-type__matrix_element(7) <cdist-type__matrix_element.html>`_
 
 
 AUTHORS
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 17084bd..96795e7 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -66,9 +66,9 @@ case "$os" in
 esac
 
 # Required parameters:
-SERVER_NAME=$(cat "$__object/parameter/server_name")
+SERVER_NAME=$(cat "$__object/parameter/server-name")
 export SERVER_NAME
-BASE_URL=$(cat "$__object/parameter/base_url")
+BASE_URL=$(cat "$__object/parameter/base-url")
 export BASE_URL
 
 export DATA_DIR=$synapse_data_dir
@@ -77,158 +77,158 @@ export PIDFILE='/var/run/matrix/homeserver.pid'
 export LOG_CONFIG_PATH="$synapse_conf_dir/log.yaml"
 export SIGNING_KEY_PATH="$synapse_conf_dir/signin.key"
 
-DATABASE_ENGINE=$(cat "$__object/parameter/database_engine")
+DATABASE_ENGINE=$(cat "$__object/parameter/database-engine")
 export DATABASE_ENGINE
-DATABASE_NAME=$(cat "$__object/parameter/database_name")
+DATABASE_NAME=$(cat "$__object/parameter/database-name")
 export DATABASE_NAME
 
 # Optional parameters:
-DATABASE_HOST=$(cat "$__object/parameter/database_host")
+DATABASE_HOST=$(cat "$__object/parameter/database-host")
 export DATABASE_HOST
-DATABASE_USER=$(cat "$__object/parameter/database_user")
+DATABASE_USER=$(cat "$__object/parameter/database-user")
 export DATABASE_USER
-DATABASE_PASSWORD=$(cat "$__object/parameter/database_password")
+DATABASE_PASSWORD=$(cat "$__object/parameter/database-password")
 export DATABASE_PASSWORD
 
-GLOBAL_CACHE_FACTOR=$(cat "$__object/parameter/global_cache_factor")
+GLOBAL_CACHE_FACTOR=$(cat "$__object/parameter/global-cache-factor")
 export GLOBAL_CACHE_FACTOR
-EVENT_CACHE_SIZE=$(cat "$__object/parameter/event_cache_size")
+EVENT_CACHE_SIZE=$(cat "$__object/parameter/event-cache-size")
 export EVENT_CACHE_SIZE
 
-LDAP_FILTER=$(cat "$__object/parameter/ldap_filter")
+LDAP_FILTER=$(cat "$__object/parameter/ldap-filter")
 export LDAP_FILTER
-LDAP_UID_ATTRIBUTE=$(cat "$__object/parameter/ldap_uid_attribute")
+LDAP_UID_ATTRIBUTE=$(cat "$__object/parameter/ldap-uid-attribute")
 export LDAP_UID_ATTRIBUTE
-LDAP_MAIL_ATTRIBUTE=$(cat "$__object/parameter/ldap_mail_attribute")
+LDAP_MAIL_ATTRIBUTE=$(cat "$__object/parameter/ldap-mail-attribute")
 export LDAP_MAIL_ATTRIBUTE
-LDAP_NAME_ATTRIBUTE=$(cat "$__object/parameter/ldap_name_attribute")
+LDAP_NAME_ATTRIBUTE=$(cat "$__object/parameter/ldap-name-attribute")
 export LDAP_NAME_ATTRIBUTE
-LDAP_URI=$(cat "$__object/parameter/ldap_uri")
+LDAP_URI=$(cat "$__object/parameter/ldap-uri")
 export LDAP_URI
-LDAP_BASE_DN=$(cat "$__object/parameter/ldap_base_dn")
+LDAP_BASE_DN=$(cat "$__object/parameter/ldap-base-dn")
 export LDAP_BASE_DN
-LDAP_BIND_DN=$(cat "$__object/parameter/ldap_bind_dn")
+LDAP_BIND_DN=$(cat "$__object/parameter/ldap-bind-dn")
 export LDAP_BIND_DN
-LDAP_BIND_PASSWORD=$(cat "$__object/parameter/ldap_bind_password")
+LDAP_BIND_PASSWORD=$(cat "$__object/parameter/ldap-bind-password")
 export LDAP_BIND_PASSWORD
 
-TURN_USER_LIFETIME=$(cat "$__object/parameter/turn_user_lifetime")
+TURN_USER_LIFETIME=$(cat "$__object/parameter/turn-user-lifetime")
 export TURN_USER_LIFETIME
-if [ -f "$__object/parameter/turn_shared_secret" ]; then
-    TURN_SHARED_SECRET=$(cat "$__object/parameter/turn_shared_secret")
+if [ -f "$__object/parameter/turn-shared-secret" ]; then
+    TURN_SHARED_SECRET=$(cat "$__object/parameter/turn-shared-secret")
     export TURN_SHARED_SECRET
 fi
-if [ -f "$__object/parameter/turn_uri" ]; then
-    uris=$(tr "\n" "," < "$__object/parameter/turn_uri" | sed 's/,$//')
+if [ -f "$__object/parameter/turn-uri" ]; then
+    uris=$(tr "\n" "," < "$__object/parameter/turn-uri" | sed 's/,$//')
     export TURN_URIS="[$uris]"
 fi
 
-if [ -f "$__object/parameter/registration_allows_email_pattern" ]; then
-    RESGISTRATION_ALLOWS_EMAIL_PATTERN=$(cat "$__object/parameter/registration_allows_email_pattern")
+if [ -f "$__object/parameter/registration-allows-email-pattern" ]; then
+    RESGISTRATION_ALLOWS_EMAIL_PATTERN=$(cat "$__object/parameter/registration-allows-email-pattern")
     export RESGISTRATION_ALLOWS_EMAIL_PATTERN
 fi
 
-if [ -f "$__object/parameter/auto_join_room" ]; then
-    AUTO_JOIN_ROOMS="$(cat "$__object/parameter/auto_join_room")"
+if [ -f "$__object/parameter/auto-join-room" ]; then
+    AUTO_JOIN_ROOMS="$(cat "$__object/parameter/auto-join-room")"
     export AUTO_JOIN_ROOMS
 fi
 
-if [ -f "$__object/parameter/app_service_config_file" ]; then
-    APP_SERVICE_CONFIG_FILES=$(cat "$__object/parameter/app_service_config_file")
+if [ -f "$__object/parameter/app-service-config-file" ]; then
+    APP_SERVICE_CONFIG_FILES=$(cat "$__object/parameter/app-service-config-file")
     export APP_SERVICE_CONFIG_FILES
 fi
 
-MAX_UPLOAD_SIZE=$(cat "$__object/parameter/max_upload_size")
+MAX_UPLOAD_SIZE=$(cat "$__object/parameter/max-upload-size")
 export MAX_UPLOAD_SIZE
-RIOT_BASE_URL=$(cat "$__object/parameter/riot_base_url")
+RIOT_BASE_URL=$(cat "$__object/parameter/riot-base-url")
 export RIOT_BASE_URL
 
-SMTP_HOST=$(cat "$__object/parameter/smtp_host")
+SMTP_HOST=$(cat "$__object/parameter/smtp-host")
 export SMTP_HOST
-SMTP_PORT=$(cat "$__object/parameter/smtp_port")
+SMTP_PORT=$(cat "$__object/parameter/smtp-port")
 export SMTP_PORT
-SMTP_USER=$(cat "$__object/parameter/smtp_user")
+SMTP_USER=$(cat "$__object/parameter/smtp-user")
 export SMTP_USER
-SMTP_PASS=$(cat "$__object/parameter/smtp_pass")
+SMTP_PASS=$(cat "$__object/parameter/smtp-pass")
 export SMTP_PASS
 
-RC_MESSAGE_PER_SECOND=$(cat "$__object/parameter/rc_message_per_second")
+RC_MESSAGE_PER_SECOND=$(cat "$__object/parameter/rc-message-per-second")
 export RC_MESSAGE_PER_SECOND
 RC_MESSAGE_BURST=$(cat "$__object/parameter/rc_message_burst")
 export RC_MESSAGE_BURST
-RC_LOGIN_PER_SECOND=$(cat "$__object/parameter/rc_login_per_second")
+RC_LOGIN_PER_SECOND=$(cat "$__object/parameter/rc-login-per-second")
 export RC_LOGIN_PER_SECOND
-RC_LOGIN_BURST=$(cat "$__object/parameter/rc_login_burst")
+RC_LOGIN_BURST=$(cat "$__object/parameter/rc-login-burst")
 export RC_LOGIN_BURST
 
-if [ -f "$__object/parameter/extra_setting" ]; then
-    EXTRA_SETTINGS=$(cat "$__object/parameter/extra_setting")
+if [ -f "$__object/parameter/extra-setting" ]; then
+    EXTRA_SETTINGS=$(cat "$__object/parameter/extra-setting")
     export EXTRA_SETTINGS
 fi
 
 # Boolean parameters:
-if [ -f "$__object/parameter/report_stats" ]; then
+if [ -f "$__object/parameter/report-stats" ]; then
     export REPORT_STATS='true'
 else
     export REPORT_STATS='false'
 fi
-if [ -f "$__object/parameter/allow_registration" ]; then
+if [ -f "$__object/parameter/allow-registration" ]; then
     export ALLOW_REGISTRATION='true'
 else
     export ALLOW_REGISTRATION='false'
 fi
-if [ -f "$__object/parameter/enable_ldap_auth" ]; then
+if [ -f "$__object/parameter/enable-ldap-auth" ]; then
     export ENABLE_LDAP_AUTH='true'
 else
     export ENABLE_LDAP_AUTH='false'
 fi
-if [ -f "$__object/parameter/ldap_search_mode" ]; then
+if [ -f "$__object/parameter/ldap-search-mode" ]; then
     export LDAP_SEARCH_MODE=1
 fi
-if [ -f "$__object/parameter/expose_metrics" ]; then
+if [ -f "$__object/parameter/expose-metrics" ]; then
     export EXPOSE_METRICS='true'
 else
     export EXPOSE_METRICS='false'
 fi
-if [ -f "$__object/parameter/enable_notifications" ]; then
+if [ -f "$__object/parameter/enable-notifications" ]; then
     export ENABLE_NOTIFICATIONS='true'
 else
     export ENABLE_NOTIFICATIONS='false'
 fi
-if [ -f "$__object/parameter/enable_notifications_by_default" ]; then
+if [ -f "$__object/parameter/enable_notifications-by-default" ]; then
     export ENABLE_NOTIFICATIONS_BY_DEFAULT='true'
 else
     export ENABLE_NOTIFICATIONS_BY_DEFAULT='false'
 fi
-if [ -f "$__object/parameter/smtp_requires_tls" ]; then
+if [ -f "$__object/parameter/smtp-requires-tls" ]; then
     export SMTP_TLS='true'
 else
     export SMTP_TLS='false'
 fi
-if [ -f "$__object/parameter/disable_federation" ]; then
+if [ -f "$__object/parameter/disable-federation" ]; then
     export DISABLE_FEDERATION='true'
 else
     export DISABLE_FEDERATION='false'
 fi
-if [ -f "$__object/parameter/allow_guest_access" ]; then
+if [ -f "$__object/parameter/allow-guest-access" ]; then
     export ALLOW_GUEST_ACCESS='true'
 else
     export ALLOW_GUEST_ACCESS='false'
 fi
-if [ -f "$__object/parameter/registration_requires_email" ]; then
+if [ -f "$__object/parameter/registration-requires-email" ]; then
     export REGISTRATION_REQUIRES_EMAIL=1
 fi
-if [ -f "$__object/parameter/allow_public_rooms_over_federation" ]; then
+if [ -f "$__object/parameter/allow-public-rooms-over-federation" ]; then
     export ALLOW_PUBLIC_ROOMS_OVER_FEDERATION='true'
 else
     export ALLOW_PUBLIC_ROOMS_OVER_FEDERATION='false'
 fi
-if [ -f "$__object/parameter/allow_public_rooms_without_auth" ]; then
+if [ -f "$__object/parameter/allow-public-rooms-without-auth" ]; then
     export ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH='true'
 else
     export ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH='false'
 fi
-if [ -f "$__object/parameter/enable_server_notices" ]; then
+if [ -f "$__object/parameter/enable-server-notices" ]; then
     export ENABLE_SERVER_NOTICES=1
 fi
 
diff --git a/type/__matrix_synapse/parameter/boolean b/type/__matrix_synapse/parameter/boolean
index 8c8df26..62905a5 100644
--- a/type/__matrix_synapse/parameter/boolean
+++ b/type/__matrix_synapse/parameter/boolean
@@ -1,14 +1,14 @@
-allow_registration
-enable_ldap_auth
-ldap_search_mode
-report_stats
-expose_metrics
-enable_notifications
-enable_notifications_by_default
-smtp_requires_tls
-disable_federation
-registration_requires_email
-allow_public_rooms_over_federation
-enable_server_notices
-allow_guest_access
-allow_public_rooms_without_auth
+allow-registration
+enable-ldap-auth
+ldap-search-mode
+report-stats
+expose-metrics
+enable-notifications
+enable-notifications-by-default
+smtp-requires-tls
+disable-federation
+registration-requires-email
+allow-public-rooms-over-federation
+enable-server-notices
+allow-guest-access
+allow-public-rooms-without-auth
diff --git a/type/__matrix_synapse/parameter/default/database_host b/type/__matrix_synapse/parameter/default/database-host
similarity index 100%
rename from type/__matrix_synapse/parameter/default/database_host
rename to type/__matrix_synapse/parameter/default/database-host
diff --git a/type/__matrix_synapse/parameter/default/database_password b/type/__matrix_synapse/parameter/default/database-password
similarity index 100%
rename from type/__matrix_synapse/parameter/default/database_password
rename to type/__matrix_synapse/parameter/default/database-password
diff --git a/type/__matrix_synapse/parameter/default/database_user b/type/__matrix_synapse/parameter/default/database-user
similarity index 100%
rename from type/__matrix_synapse/parameter/default/database_user
rename to type/__matrix_synapse/parameter/default/database-user
diff --git a/type/__matrix_synapse/parameter/default/event_cache_size b/type/__matrix_synapse/parameter/default/event-cache-size
similarity index 100%
rename from type/__matrix_synapse/parameter/default/event_cache_size
rename to type/__matrix_synapse/parameter/default/event-cache-size
diff --git a/type/__matrix_synapse/parameter/default/global_cache_factor b/type/__matrix_synapse/parameter/default/global-cache-factor
similarity index 100%
rename from type/__matrix_synapse/parameter/default/global_cache_factor
rename to type/__matrix_synapse/parameter/default/global-cache-factor
diff --git a/type/__matrix_synapse/parameter/default/ldap_base_dn b/type/__matrix_synapse/parameter/default/ldap-base-dn
similarity index 100%
rename from type/__matrix_synapse/parameter/default/ldap_base_dn
rename to type/__matrix_synapse/parameter/default/ldap-base-dn
diff --git a/type/__matrix_synapse/parameter/default/ldap_bind_dn b/type/__matrix_synapse/parameter/default/ldap-bind-dn
similarity index 100%
rename from type/__matrix_synapse/parameter/default/ldap_bind_dn
rename to type/__matrix_synapse/parameter/default/ldap-bind-dn
diff --git a/type/__matrix_synapse/parameter/default/ldap_bind_password b/type/__matrix_synapse/parameter/default/ldap-bind-password
similarity index 100%
rename from type/__matrix_synapse/parameter/default/ldap_bind_password
rename to type/__matrix_synapse/parameter/default/ldap-bind-password
diff --git a/type/__matrix_synapse/parameter/default/ldap_filter b/type/__matrix_synapse/parameter/default/ldap-filter
similarity index 100%
rename from type/__matrix_synapse/parameter/default/ldap_filter
rename to type/__matrix_synapse/parameter/default/ldap-filter
diff --git a/type/__matrix_synapse/parameter/default/ldap_mail_attribute b/type/__matrix_synapse/parameter/default/ldap-mail-attribute
similarity index 100%
rename from type/__matrix_synapse/parameter/default/ldap_mail_attribute
rename to type/__matrix_synapse/parameter/default/ldap-mail-attribute
diff --git a/type/__matrix_synapse/parameter/default/ldap_name_attribute b/type/__matrix_synapse/parameter/default/ldap-name-attribute
similarity index 100%
rename from type/__matrix_synapse/parameter/default/ldap_name_attribute
rename to type/__matrix_synapse/parameter/default/ldap-name-attribute
diff --git a/type/__matrix_synapse/parameter/default/ldap_uid_attribute b/type/__matrix_synapse/parameter/default/ldap-uid-attribute
similarity index 100%
rename from type/__matrix_synapse/parameter/default/ldap_uid_attribute
rename to type/__matrix_synapse/parameter/default/ldap-uid-attribute
diff --git a/type/__matrix_synapse/parameter/default/ldap_uri b/type/__matrix_synapse/parameter/default/ldap-uri
similarity index 100%
rename from type/__matrix_synapse/parameter/default/ldap_uri
rename to type/__matrix_synapse/parameter/default/ldap-uri
diff --git a/type/__matrix_synapse/parameter/default/max_upload_size b/type/__matrix_synapse/parameter/default/max-upload-size
similarity index 100%
rename from type/__matrix_synapse/parameter/default/max_upload_size
rename to type/__matrix_synapse/parameter/default/max-upload-size
diff --git a/type/__matrix_synapse/parameter/default/rc_login_burst b/type/__matrix_synapse/parameter/default/rc-login-burst
similarity index 100%
rename from type/__matrix_synapse/parameter/default/rc_login_burst
rename to type/__matrix_synapse/parameter/default/rc-login-burst
diff --git a/type/__matrix_synapse/parameter/default/rc_login_per_second b/type/__matrix_synapse/parameter/default/rc-login-per-second
similarity index 100%
rename from type/__matrix_synapse/parameter/default/rc_login_per_second
rename to type/__matrix_synapse/parameter/default/rc-login-per-second
diff --git a/type/__matrix_synapse/parameter/default/rc_message_burst b/type/__matrix_synapse/parameter/default/rc-message-burst
similarity index 100%
rename from type/__matrix_synapse/parameter/default/rc_message_burst
rename to type/__matrix_synapse/parameter/default/rc-message-burst
diff --git a/type/__matrix_synapse/parameter/default/rc_message_per_second b/type/__matrix_synapse/parameter/default/rc-message-per-second
similarity index 100%
rename from type/__matrix_synapse/parameter/default/rc_message_per_second
rename to type/__matrix_synapse/parameter/default/rc-message-per-second
diff --git a/type/__matrix_synapse/parameter/default/smtp_host b/type/__matrix_synapse/parameter/default/smtp-host
similarity index 100%
rename from type/__matrix_synapse/parameter/default/smtp_host
rename to type/__matrix_synapse/parameter/default/smtp-host
diff --git a/type/__matrix_synapse/parameter/default/smtp_pass b/type/__matrix_synapse/parameter/default/smtp-pass
similarity index 100%
rename from type/__matrix_synapse/parameter/default/smtp_pass
rename to type/__matrix_synapse/parameter/default/smtp-pass
diff --git a/type/__matrix_synapse/parameter/default/smtp_port b/type/__matrix_synapse/parameter/default/smtp-port
similarity index 100%
rename from type/__matrix_synapse/parameter/default/smtp_port
rename to type/__matrix_synapse/parameter/default/smtp-port
diff --git a/type/__matrix_synapse/parameter/default/smtp_user b/type/__matrix_synapse/parameter/default/smtp-user
similarity index 100%
rename from type/__matrix_synapse/parameter/default/smtp_user
rename to type/__matrix_synapse/parameter/default/smtp-user
diff --git a/type/__matrix_synapse/parameter/default/turn_user_lifetime b/type/__matrix_synapse/parameter/default/turn-user-lifetime
similarity index 100%
rename from type/__matrix_synapse/parameter/default/turn_user_lifetime
rename to type/__matrix_synapse/parameter/default/turn-user-lifetime
diff --git a/type/__matrix_synapse/parameter/optional b/type/__matrix_synapse/parameter/optional
index a7a2aee..529c06a 100644
--- a/type/__matrix_synapse/parameter/optional
+++ b/type/__matrix_synapse/parameter/optional
@@ -1,25 +1,25 @@
-database_host
-database_user
-database_password
-ldap_uri
-ldap_base_dn
-ldap_uid_attribute
-ldap_mail_attribute
-ldap_name_attribute
-ldap_bind_dn
-ldap_bind_password
-ldap_filter
-turn_shared_secret
-turn_user_lifetime
-max_upload_size
-smtp_host
-smtp_port
-smtp_user
-smtp_pass
-riot_base_url
-rc_message_per_second
-rc_message_burst
-rc_login_per_second
-rc_login_burst
-global_cache_factor
-event_cache_size
+database-host
+database-user
+database-password
+ldap-uri
+ldap-base-dn
+ldap-uid-attribute
+ldap-mail-attribute
+ldap-name-attribute
+ldap-bind-dn
+ldap-bind-password
+ldap-filter
+turn-shared-secret
+turn-user-lifetime
+max-upload-size
+smtp-host
+smtp-port
+smtp-user
+smtp-pass
+riot-base-url
+rc-message-per-second
+rc-message-burst
+rc-login-per-second
+rc-login-burst
+global-cache-factor
+event-cache-size
diff --git a/type/__matrix_synapse/parameter/optional_multiple b/type/__matrix_synapse/parameter/optional_multiple
index e758bd1..c292cd7 100644
--- a/type/__matrix_synapse/parameter/optional_multiple
+++ b/type/__matrix_synapse/parameter/optional_multiple
@@ -1,5 +1,5 @@
-turn_uri
-registration_allows_email_pattern
-auto_join_room
-app_service_config_file
-extra_setting
+turn-uri
+registration-allows-email-pattern
+auto-join-room
+app-service-config-file
+extra-setting
diff --git a/type/__matrix_synapse/parameter/required b/type/__matrix_synapse/parameter/required
index de3e9a2..f9ebcb3 100644
--- a/type/__matrix_synapse/parameter/required
+++ b/type/__matrix_synapse/parameter/required
@@ -1,4 +1,4 @@
-server_name
-base_url
-database_engine
-database_name
+server-name
+base-url
+database-engine
+database-name

From 5b70dbd3e9db761fab9338af5d81400cfa49b19b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Mon, 15 Feb 2021 18:50:12 +0100
Subject: [PATCH 04/23] __matrix_synapse: refresh configuration template and
 type parameters

---
 type/__matrix_synapse/files/environment.sh    |    6 -
 .../__matrix_synapse/files/homeserver.yaml.sh | 2160 ++++++++++++-----
 type/__matrix_synapse/files/log.config.sh     |  105 +-
 type/__matrix_synapse/gencode-remote          |   35 +
 type/__matrix_synapse/manifest                |  459 ++--
 type/__matrix_synapse/parameter/boolean       |    8 +-
 .../parameter/default/message-max-lifetime    |    1 +
 .../default/remote-room-complexity-treshold   |    1 +
 .../parameter/default/room-encryption-policy  |    1 +
 .../default/{smtp-pass => smtp-password}      |    0
 .../parameter/default/web-client-url          |    1 +
 type/__matrix_synapse/parameter/optional      |    8 +-
 12 files changed, 1961 insertions(+), 824 deletions(-)
 delete mode 100644 type/__matrix_synapse/files/environment.sh
 create mode 100755 type/__matrix_synapse/gencode-remote
 create mode 100644 type/__matrix_synapse/parameter/default/message-max-lifetime
 create mode 100644 type/__matrix_synapse/parameter/default/remote-room-complexity-treshold
 create mode 100644 type/__matrix_synapse/parameter/default/room-encryption-policy
 rename type/__matrix_synapse/parameter/default/{smtp-pass => smtp-password} (100%)
 create mode 100644 type/__matrix_synapse/parameter/default/web-client-url

diff --git a/type/__matrix_synapse/files/environment.sh b/type/__matrix_synapse/files/environment.sh
deleted file mode 100644
index 99179be..0000000
--- a/type/__matrix_synapse/files/environment.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/sh
-
-cat << EOF
-# Specify environment variables used when running Synapse
-SYNAPSE_CACHE_FACTOR=$CACHE_FACTOR
-EOF
diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index 4d47ed3..e164342 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -1,208 +1,68 @@
 #!/bin/sh
 
-# NOTE: this template has been generated using the
-# matrix-synapse-1.5.1-1.fc31.noarch Fedora package for use with CDIST.
+# Note: template originally generated from synapse's 1.26.0 sample config.
 
-generate_extra_settings () {
-    for line in $EXTRA_SETTINGS; do
-        echo "$line"
-    done
-}
-
-generate_database () {
-  if [ "$DATABASE_ENGINE" = "sqlite3" ]; then
-    cat << EOF
-database:
-  # The database engine name
-  name: "$DATABASE_ENGINE"
-  # Arguments to pass to the engine
-  args:
-    # Path to the database
-    database: "$DATABASE_NAME"
-EOF
-  else
 cat << EOF
-database:
-  # The database engine name
-  name: "$DATABASE_ENGINE"
-  # Arguments to pass to the engine
-  args:
-    database: "$DATABASE_NAME"
-    host: "$DATABASE_HOST"
-    user: "$DATABASE_USER"
-    password: "$DATABASE_PASSWORD"
-EOF
-  fi
-}
+###############################################################
+# THIS FILE HAS BEEN GENERATED BY CDIST. DO NOT EDIT BY HAND. #
+###############################################################
 
-generate_password_providers () {
-  if [ "$ENABLE_LDAP_AUTH" = "true" ]; then
-    cat <<EOF
-password_providers:
-    - module: "ldap_auth_provider.LdapAuthProvider"
-      config:
-        enabled: $ENABLE_LDAP_AUTH
-        uri: "$LDAP_URI"
-        start_tls: true
-        base: "$LDAP_BASE_DN"
-        attributes:
-           uid: "$LDAP_UID_ATTRIBUTE"
-           mail: "$LDAP_MAIL_ATTRIBUTE"
-           name: "$LDAP_NAME_ATTRIBUTE"
-        filter: "$LDAP_FILTER"
-EOF
-    if [ "$LDAP_SEARCH_MODE" ]; then
-        cat <<EOF
-        mode: "search"
-        bind_dn: "$LDAP_BIND_DN"
-        bind_password: "$LDAP_BIND_PASSWORD"
-EOF
-    fi
-  else # LDAP auth is disabled.
-    echo "password_providers: []"
-  fi
-}
-
-generate_resources () {
-    if [ "$EXPOSE_METRICS" = "true" ]; then
-      echo "[client, federation, metrics]"
-    else
-      echo "[client, federation]"
-    fi
-}
-
-generate_federation_whitelist () {
-    if [ "$DISABLE_FEDERATION" = "true" ]; then
-        # Empty federation whitelist.
-        cat << EOF
-federation_domain_whitelist: []
-EOF
-    fi
-
-}
-
-generate_registration_requirements () {
-    if [ "$REGISTRATION_REQUIRES_EMAIL" = "1" ]; then
-        cat << EOF
-# The user must provide all of the below types of 3PID when registering.
-
-registrations_require_3pid:
-  - email
-#  - msisdn
-EOF
-    fi
-}
-
-generate_allowed_3pid_patterns () {
-    if [ "$RESGISTRATION_ALLOWS_EMAIL_PATTERN" != "" ]; then
-        cat << EOF
-# Mandate that users are only allowed to associate certain formats of
-# 3PIDs with accounts on this server.
+# Configuration file for Synapse.
 #
-allowed_local_3pids:
-EOF
-
-        for pattern in $RESGISTRATION_ALLOWS_EMAIL_PATTERN; do
-        cat << EOF
-  - medium: email
-    pattern: $pattern
-EOF
-        done
-
-        cat << EOF
-#  - medium: email
-#    pattern: '.*@vector\.im'
-#  - medium: msisdn
-#    pattern: '\+44'
-EOF
-
-    fi
-}
-
-generate_auto_join_rooms () {
-    if [ "$AUTO_JOIN_ROOMS" != "" ]; then
-        cat << EOF
-# Users who register on this homeserver will automatically be joined
-# to these rooms
-auto_join_rooms:
-EOF
-        for room in $AUTO_JOIN_ROOMS; do
-            cat << EOF
-    - "$room"
-EOF
-        done
-    fi
-}
-
-generate_app_service_config_files () {
-    if [ "$APP_SERVICE_CONFIG_FILES" != "" ]; then
-    cat << EOF
-app_service_config_files:
-EOF
-
-    for file in $APP_SERVICE_CONFIG_FILES; do
-        cat << EOF
-  - $file
-EOF
-done
-
-    fi
-}
-
-generate_server_notices () {
-    if [ "$ENABLE_SERVER_NOTICES" = "1" ]; then
-    cat << EOF
-server_notices:
-  system_mxid_localpart: notices
-  system_mxid_display_name: "Server Notices"
-#  system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
-  room_name: "Server Notices"
-EOF
-    else
-    cat << EOF
-#server_notices:
-# system_mxid_localpart: notices
-# system_mxid_display_name: "Server Notices"
-# system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
-# room_name: "Server Notices"
-EOF
-    fi
-}
-
-cat << EOF
-######################################################
-# THIS FILE IS CDIST-GENERATED. DO NOT EDIT BY HAND. #
-######################################################
-
-## Extra settings, if any ##
-
-$(generate_extra_settings)
+# This is a YAML file: see [1] for a quick introduction. Note in particular
+# that *indentation is important*: all the elements of a list or dictionary
+# should have the same indentation.
+#
+# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
 
 ## Server ##
 
-# The domain name of the server, with optional explicit port.
-# This is used by remote servers to connect to this server,
-# e.g. matrix.org, localhost:8080, etc.
-# This is also the last part of your UserI1
+# The public-facing domain of the server
 #
-server_name: "$SERVER_NAME"
+# The server_name name will appear at the end of usernames and room addresses
+# created on this server. For example if the server_name was example.com,
+# usernames on this server would be in the format @user:example.com
+#
+# In most cases you should avoid using a matrix specific subdomain such as
+# matrix.example.com or synapse.example.com as the server_name for the same
+# reasons you wouldn't use user@email.example.com as your email address.
+# See https://github.com/matrix-org/synapse/blob/master/docs/delegate.md
+# for information on how to host Synapse on a subdomain while preserving
+# a clean server_name.
+#
+# The server_name cannot be changed later so it is important to
+# configure this correctly before you start Synapse. It should be all
+# lowercase and may contain an explicit port.
+# Examples: matrix.org, localhost:8080
+#
+server_name: "${SERVER_NAME:?}"
 
 # When running as a daemon, the file to store the pid in
 #
-pid_file: "$PIDFILE"
+pid_file: "${PIDFILE:?}"
 
-# The path to the web client which will be served at /_matrix/client/
-# if 'webclient' is configured under the 'listeners' configuration.
+# The absolute URL to the web client which /_matrix/client will redirect
+# to if 'webclient' is configured under the 'listeners' configuration.
 #
-#web_client_location: "/path/to/web/root"
+# This option can be also set to the filesystem path to the web client
+# which will be served at /_matrix/client/ if 'webclient' is configured
+# under the 'listeners' configuration, however this is a security risk:
+# https://github.com/matrix-org/synapse#security-note
+#
+web_client_location: "${WEB_CLIENT_URL:?}"
 
-# The public-facing base URL that clients use to access this HS
-# (not including _matrix/...). This is the same URL a user would
-# enter into the 'custom HS URL' field on their client. If you
-# use synapse with a reverse proxy, this should be the URL to reach
-# synapse via the proxy.
+# The public-facing base URL that clients use to access this Homeserver (not
+# including _matrix/...). This is the same URL a user might enter into the
+# 'Custom Homeserver URL' field on their client. If you use Synapse with a
+# reverse proxy, this should be the URL to reach Synapse via the proxy.
+# Otherwise, it should be the URL to reach Synapse's client HTTP listener (see
+# 'listeners' below).
 #
-public_baseurl: "$BASE_URL"
+# If this is left unset, it defaults to 'https://<server_name>/'. (Note that
+# that will not work unless you configure Synapse or a reverse-proxy to listen
+# on port 443.)
+#
+public_baseurl: "${BASE_URL:?}"
 
 # Set the soft limit on the number of file descriptors synapse can use
 # Zero is used to indicate synapse should set the soft limit to the
@@ -212,7 +72,7 @@ public_baseurl: "$BASE_URL"
 
 # Set to false to disable presence tracking on this homeserver.
 #
-#use_presence: false
+use_presence: ${USE_PRESENCE:?}
 
 # Whether to require authentication to retrieve profile data (avatars,
 # display names) of other users through the client API. Defaults to
@@ -222,15 +82,23 @@ public_baseurl: "$BASE_URL"
 #
 #require_auth_for_profile_requests: true
 
-# If set to 'false', requires authentication to access the server's public rooms
-# directory through the client API. Defaults to 'true'.
+# Uncomment to require a user to share a room with another user in order
+# to retrieve their profile information. Only checked on Client-Server
+# requests. Profile requests from other servers should be checked by the
+# requesting server. Defaults to 'false'.
 #
-allow_public_rooms_without_auth: $ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH
+#limit_profile_requests_to_users_who_share_rooms: true
 
-# If set to 'false', forbids any other homeserver to fetch the server's public
-# rooms directory via federation. Defaults to 'true'.
+# If set to 'true', removes the need for authentication to access the server's
+# public rooms directory through the client API, meaning that anyone can
+# query the room directory. Defaults to 'false'.
 #
-allow_public_rooms_over_federation: $ALLOW_PUBLIC_ROOMS_OVER_FEDERATION
+allow_public_rooms_without_auth: ${ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH}
+
+# If set to 'true', allows any other homeserver to fetch the server's public
+# rooms directory via federation. Defaults to 'false'.
+#
+allow_public_rooms_over_federation: ${ALLOW_PUBLIC_ROOMS_OVER_FEDERATION:?}
 
 # The default room version for newly created rooms.
 #
@@ -240,14 +108,16 @@ allow_public_rooms_over_federation: $ALLOW_PUBLIC_ROOMS_OVER_FEDERATION
 # For example, for room version 1, default_room_version should be set
 # to "1".
 #
-#default_room_version: "4"
+#default_room_version: "6"
 
 # The GC threshold parameters to pass to \`gc.set_threshold\`, if defined
 #
 #gc_thresholds: [700, 10, 10]
 
 # Set the limit on the returned events in the timeline in the get
-# and sync operations. The default value is -1, means no upper limit.
+# and sync operations. The default value is 100. -1 means no upper limit.
+#
+# Uncomment the following to increase the limit to 5000.
 #
 #filter_timeline_limit: 5000
 
@@ -263,39 +133,46 @@ allow_public_rooms_over_federation: $ALLOW_PUBLIC_ROOMS_OVER_FEDERATION
 #
 #enable_search: false
 
-# Restrict federation to the following whitelist of domains.
-# N.B. we recommend also firewalling your federation listener to limit
-# inbound federation traffic as early as possible, rather than relying
-# purely on this application-layer restriction.  If not specified, the
-# default is to whitelist everything.
-
-$(generate_federation_whitelist)
-
-#federation_domain_whitelist:
-#  - lon.example.com
-#  - nyc.example.com
-#  - syd.example.com
-
-# Prevent federation requests from being sent to the following
-# blacklist IP address CIDR ranges. If this option is not specified, or
-# specified with an empty list, no ip range blacklist will be enforced.
+# Prevent outgoing requests from being sent to the following blacklisted IP address
+# CIDR ranges. If this option is not specified then it defaults to private IP
+# address ranges (see the example below).
 #
-# As of Synapse v1.4.0 this option also affects any outbound requests to identity
-# servers provided by user input.
+# The blacklist applies to the outbound requests for federation, identity servers,
+# push servers, and for checking key validity for third-party invite events.
 #
 # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
 # listed here, since they correspond to unroutable addresses.)
 #
-federation_ip_range_blacklist:
-  - '127.0.0.0/8'
-  - '10.0.0.0/8'
-  - '172.16.0.0/12'
-  - '192.168.0.0/16'
-  - '100.64.0.0/10'
-  - '169.254.0.0/16'
-  - '::1/128'
-  - 'fe80::/64'
-  - 'fc00::/7'
+# This option replaces federation_ip_range_blacklist in Synapse v1.25.0.
+#
+#ip_range_blacklist:
+#  - '127.0.0.0/8'
+#  - '10.0.0.0/8'
+#  - '172.16.0.0/12'
+#  - '192.168.0.0/16'
+#  - '100.64.0.0/10'
+#  - '192.0.0.0/24'
+#  - '169.254.0.0/16'
+#  - '198.18.0.0/15'
+#  - '192.0.2.0/24'
+#  - '198.51.100.0/24'
+#  - '203.0.113.0/24'
+#  - '224.0.0.0/4'
+#  - '::1/128'
+#  - 'fe80::/10'
+#  - 'fc00::/7'
+
+# List of IP address CIDR ranges that should be allowed for federation,
+# identity servers, push servers, and for checking key validity for
+# third-party invite events. This is useful for specifying exceptions to
+# wide-ranging blacklisted target IP ranges - e.g. for communication with
+# a push server only visible in your network.
+#
+# This whitelist overrides ip_range_blacklist and defaults to an empty
+# list.
+#
+#ip_range_whitelist:
+#   - '192.168.1.1'
 
 # List of ports that Synapse should listen on, their purpose and their
 # configuration.
@@ -325,7 +202,7 @@ federation_ip_range_blacklist:
 #       names: a list of names of HTTP resources. See below for a list of
 #           valid resource names.
 #
-#       compress: set to true to enable HTTP comression for this resource.
+#       compress: set to true to enable HTTP compression for this resource.
 #
 #   additional_resources: Only valid for an 'http' listener. A map of
 #        additional endpoints which should be loaded via dynamic modules.
@@ -376,16 +253,28 @@ listeners:
   # If you plan to use a reverse proxy, please see
   # https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md.
   #
-  - port: 8008
+  - port: ${MAIN_LISTENER_PORT:?}
     tls: false
     type: http
     x_forwarded: true
     bind_addresses: ['::1', '127.0.0.1']
 
     resources:
-      - names: $(generate_resources)
+      - names: ${MAIN_LISTENER_RESOURCES:?}
         compress: false
+EOF
 
+if [ -n "$ENABLE_REPLICATION" ]; then
+	cat << EOF
+  - port: 9093
+    bind_addresses: ['::1', '127.0.0.1']
+    type: http
+    resources:
+      - names: [replication]
+EOF
+fi
+
+cat << EOF
     # example additional_resources:
     #
     #additional_resources:
@@ -400,6 +289,18 @@ listeners:
   #  bind_addresses: ['::1', '127.0.0.1']
   #  type: manhole
 
+# Forward extremities can build up in a room due to networking delays between
+# homeservers. Once this happens in a large room, calculation of the state of
+# that room can become quite expensive. To mitigate this, once the number of
+# forward extremities reaches a given threshold, Synapse will send an
+# org.matrix.dummy_event event, which will reduce the forward extremities
+# in the room.
+#
+# This setting defines the threshold (i.e. number of forward extremities in the
+# room) at which dummy events are sent. The default value is 10.
+#
+#dummy_events_threshold: 5
+
 
 ## Homeserver blocking ##
 
@@ -418,7 +319,7 @@ listeners:
 # number of monthly active users.
 #
 # 'limit_usage_by_mau' disables/enables monthly active user blocking. When
-# anabled and a limit is reached the server returns a 'ResourceLimitError'
+# enabled and a limit is reached the server returns a 'ResourceLimitError'
 # with error type Codes.RESOURCE_LIMIT_EXCEEDED
 #
 # 'max_mau_value' is the hard limit of monthly active users above which
@@ -457,22 +358,31 @@ listeners:
 # Used by phonehome stats to group together related servers.
 #server_context: context
 
-# Resource-constrained Homeserver Settings
+# Resource-constrained homeserver settings
 #
-# If limit_remote_rooms.enabled is True, the room complexity will be
-# checked before a user joins a new remote room. If it is above
-# limit_remote_rooms.complexity, it will disallow joining or
-# instantly leave.
+# When this is enabled, the room "complexity" will be checked before a user
+# joins a new remote room. If it is above the complexity limit, the server will
+# disallow joining, or will instantly leave.
 #
-# limit_remote_rooms.complexity_error can be set to customise the text
-# displayed to the user when a room above the complexity threshold has
-# its join cancelled.
+# Room complexity is an arbitrary measure based on factors such as the number of
+# users in the room.
 #
-# Uncomment the below lines to enable:
-#limit_remote_rooms:
-#  enabled: true
-#  complexity: 1.0
-#  complexity_error: "This room is too complex."
+limit_remote_rooms:
+  # Uncomment to enable room complexity checking.
+  #
+  enabled: ${LIMIT_REMOTE_ROOM_COMPLEXITY:?}
+
+  # the limit above which rooms cannot be joined. The default is 1.0.
+  #
+  complexity: ${REMOTE_ROOM_COMPLEXITY_TRESHOLD:?}
+
+  # override the error which is returned when the room is too complex.
+  #
+  complexity_error: "This room is too complex."
+
+  # allow server admins to join complex rooms. Default is false.
+  #
+  #admins_can_join: true
 
 # Whether to require a user to be in the room to add an alias to it.
 # Defaults to 'true'.
@@ -498,6 +408,103 @@ listeners:
 #
 #user_ips_max_age: 14d
 
+# Message retention policy at the server level.
+#
+# Room admins and mods can define a retention period for their rooms using the
+# 'm.room.retention' state event, and server admins can cap this period by setting
+# the 'allowed_lifetime_min' and 'allowed_lifetime_max' config options.
+#
+# If this feature is enabled, Synapse will regularly look for and purge events
+# which are older than the room's maximum retention period. Synapse will also
+# filter events received over federation so that events that should have been
+# purged are ignored and not stored again.
+#
+retention:
+  # The message retention policies feature is disabled by default. Uncomment the
+  # following line to enable it.
+  #
+  enabled: ${ENABLE_MESSAGE_RETENTION_POLICY:?}
+
+  # Default retention policy. If set, Synapse will apply it to rooms that lack the
+  # 'm.room.retention' state event. Currently, the value of 'min_lifetime' doesn't
+  # matter much because Synapse doesn't take it into account yet.
+  #
+  default_policy:
+    min_lifetime: 1d
+    max_lifetime: ${MESSAGE_RETENTION_POLICY_MAX_LIFETIME:?}
+
+  # Retention policy limits. If set, and the state of a room contains a
+  # 'm.room.retention' event in its state which contains a 'min_lifetime' or a
+  # 'max_lifetime' that's out of these bounds, Synapse will cap the room's policy
+  # to these limits when running purge jobs.
+  #
+  #allowed_lifetime_min: 1d
+  #allowed_lifetime_max: 1y
+
+  # Server admins can define the settings of the background jobs purging the
+  # events which lifetime has expired under the 'purge_jobs' section.
+  #
+  # If no configuration is provided, a single job will be set up to delete expired
+  # events in every room daily.
+  #
+  # Each job's configuration defines which range of message lifetimes the job
+  # takes care of. For example, if 'shortest_max_lifetime' is '2d' and
+  # 'longest_max_lifetime' is '3d', the job will handle purging expired events in
+  # rooms whose state defines a 'max_lifetime' that's both higher than 2 days, and
+  # lower than or equal to 3 days. Both the minimum and the maximum value of a
+  # range are optional, e.g. a job with no 'shortest_max_lifetime' and a
+  # 'longest_max_lifetime' of '3d' will handle every room with a retention policy
+  # which 'max_lifetime' is lower than or equal to three days.
+  #
+  # The rationale for this per-job configuration is that some rooms might have a
+  # retention policy with a low 'max_lifetime', where history needs to be purged
+  # of outdated messages on a more frequent basis than for the rest of the rooms
+  # (e.g. every 12h), but not want that purge to be performed by a job that's
+  # iterating over every room it knows, which could be heavy on the server.
+  #
+  # If any purge job is configured, it is strongly recommended to have at least
+  # a single job with neither 'shortest_max_lifetime' nor 'longest_max_lifetime'
+  # set, or one job without 'shortest_max_lifetime' and one job without
+  # 'longest_max_lifetime' set. Otherwise some rooms might be ignored, even if
+  # 'allowed_lifetime_min' and 'allowed_lifetime_max' are set, because capping a
+  # room's policy to these values is done after the policies are retrieved from
+  # Synapse's database (which is done using the range specified in a purge job's
+  # configuration).
+  #
+  #purge_jobs:
+  #  - longest_max_lifetime: 3d
+  #    interval: 12h
+  #  - shortest_max_lifetime: 3d
+  #    interval: 1d
+
+# Inhibits the /requestToken endpoints from returning an error that might leak
+# information about whether an e-mail address is in use or not on this
+# homeserver.
+# Note that for some endpoints the error situation is the e-mail already being
+# used, and for others the error is entering the e-mail being unused.
+# If this option is enabled, instead of returning an error, these endpoints will
+# act as if no error happened and return a fake session ID ('sid') to clients.
+#
+#request_token_inhibit_3pid_errors: true
+
+# A list of domains that the domain portion of 'next_link' parameters
+# must match.
+#
+# This parameter is optionally provided by clients while requesting
+# validation of an email or phone number, and maps to a link that
+# users will be automatically redirected to after validation
+# succeeds. Clients can make use this parameter to aid the validation
+# process.
+#
+# The whitelist is applied whether the homeserver or an
+# identity server is handling validation.
+#
+# The default value is no whitelist functionality; all domains are
+# allowed. Setting this value to an empty list will instead disallow
+# all domains.
+#
+#next_link_domain_whitelist: ["matrix.org"]
+
 
 ## TLS ##
 
@@ -513,11 +520,11 @@ listeners:
 # instance, if using certbot, use \`fullchain.pem\` as your certificate,
 # not \`cert.pem\`).
 #
-#tls_certificate_path: "CONFDIR/SERVERNAME.tls.crt"
+tls_certificate_path: "${TLS_CERTIFICATE_PATH:?}"
 
 # PEM-encoded private key for TLS
 #
-#tls_private_key_path: "CONFDIR/SERVERNAME.tls.key"
+tls_private_key_path: "${TLS_PRIVATE_KEY_PATH:?}"
 
 # Whether to verify TLS server certificates for outbound federation requests.
 #
@@ -565,6 +572,11 @@ listeners:
 # ACME support: This will configure Synapse to request a valid TLS certificate
 # for your configured \`server_name\` via Let's Encrypt.
 #
+# Note that ACME v1 is now deprecated, and Synapse currently doesn't support
+# ACME v2. This means that this feature currently won't work with installs set
+# up after November 2019. For more info, and alternative solutions, see
+# https://github.com/matrix-org/synapse/blob/master/docs/ACME.md#deprecation-of-acme-v1
+#
 # Note that provisioning a certificate in this way requires port 80 to be
 # routed to Synapse so that it can complete the http-01 ACME challenge.
 # By default, if you enable ACME support, Synapse will attempt to listen on
@@ -629,7 +641,7 @@ acme:
     #
     # If unspecified, we will use CONFDIR/client.key.
     #
-    account_key_file: "$DATA_DIR/acme_account.key"
+    account_key_file: /etc/synapse/acme_account.key
 
 # List of allowed TLS fingerprints for this server to publish along
 # with the signing keys for this server. Other matrix servers that
@@ -659,14 +671,49 @@ acme:
 #tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
 
 
+## Federation ##
 
-## Database ##
-
-$(generate_database)
-
-# Number of events to cache in memory.
+# Restrict federation to the following whitelist of domains.
+# N.B. we recommend also firewalling your federation listener to limit
+# inbound federation traffic as early as possible, rather than relying
+# purely on this application-layer restriction.  If not specified, the
+# default is to whitelist everything.
 #
-event_cache_size: $EVENT_CACHE_SIZE
+#federation_domain_whitelist:
+#  - lon.example.com
+#  - nyc.example.com
+#  - syd.example.com
+EOF
+
+if [ -n "$DISABLE_FEDERATION" ]; then
+	echo "federation_domain_whitelist: []"
+fi
+
+cat << EOF
+# Report prometheus metrics on the age of PDUs being sent to and received from
+# the following domains. This can be used to give an idea of "delay" on inbound
+# and outbound federation, though be aware that any delay can be due to problems
+# at either end or with the intermediate network.
+#
+# By default, no domains are monitored in this way.
+#
+#federation_metrics_domains:
+#  - matrix.org
+#  - example.com
+
+
+## Caching ##
+
+# Caching can be configured through the following options.
+#
+# A cache 'factor' is a multiplier that can be applied to each of
+# Synapse's caches in order to increase or decrease the maximum
+# number of entries that can be stored.
+
+# The number of events to cache in memory. Not affected by
+# caches.global_factor.
+#
+event_cache_size: ${EVENT_CACHE_SIZE:?}
 
 caches:
    # Controls the global cache factor, which is the default cache factor
@@ -679,7 +726,7 @@ caches:
    #
    # Defaults to 0.5, which will half the size of all caches.
    #
-   global_factor: $GLOBAL_CACHE_FACTOR
+   global_factor: ${GLOBAL_CACHE_FACTOR:?}
 
    # A dictionary of cache name to cache factor for that individual
    # cache. Overrides the global cache factor for a given cache.
@@ -699,12 +746,85 @@ caches:
    per_cache_factors:
      #get_users_who_share_room_with_user: 2.0
 
+
+## Database ##
+
+# The 'database' setting defines the database that synapse uses to store all of
+# its data.
+#
+# 'name' gives the database engine to use: either 'sqlite3' (for SQLite) or
+# 'psycopg2' (for PostgreSQL).
+#
+# 'args' gives options which are passed through to the database engine,
+# except for options starting 'cp_', which are used to configure the Twisted
+# connection pool. For a reference to valid arguments, see:
+#   * for sqlite: https://docs.python.org/3/library/sqlite3.html#sqlite3.connect
+#   * for postgres: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
+#   * for the connection pool: https://twistedmatrix.com/documents/current/api/twisted.enterprise.adbapi.ConnectionPool.html#__init__
+#
+#
+# Example SQLite configuration:
+#
+#database:
+#  name: sqlite3
+#  args:
+#    database: /path/to/homeserver.db
+#
+#
+# Example Postgres configuration:
+#
+#database:
+#  name: psycopg2
+#  args:
+#    user: synapse_user
+#    password: secretpassword
+#    database: synapse
+#    host: localhost
+#    cp_min: 5
+#    cp_max: 10
+#
+# For more information on using Synapse with Postgres, see \`docs/postgres.md\`.
+#
+EOF
+
+case "${DATABASE_ENGINE:?}" in
+	sqlite3)
+		cat << EOF
+database:
+  # The database engine name
+  name: "sqlite3"
+  # Arguments to pass to the engine
+  args:
+    # Path to the database
+    database: "${DATABASE_NAME:?}"
+EOF
+	;;
+	psycopg2)
+		cat << EOF
+database:
+  # The database engine name
+  name: "psycopg2"
+  # Arguments to pass to the engine
+  args:
+    database: "${DATABASE_NAME:?}"
+    host: "${DATABASE_HOST:?}"
+    user: "${DATABASE_USER:?}"
+    password: "$DATABASE_PASSWORD"
+EOF
+	;;
+	*)
+		echo "Invalid database engine $DATABASE_ENGINE." >&2
+		exit 1
+	;;
+esac
+
+cat << EOF
 ## Logging ##
 
 # A yaml python logging config file as described by
 # https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
 #
-log_config: "$LOG_CONFIG_PATH"
+log_config: "${LOG_CONFIG_PATH:?}"
 
 
 ## Ratelimiting ##
@@ -730,13 +850,20 @@ log_config: "$LOG_CONFIG_PATH"
 #   - one for ratelimiting redactions by room admins. If this is not explicitly
 #     set then it uses the same ratelimiting as per rc_message. This is useful
 #     to allow room admins to deal with abuse quickly.
+#   - two for ratelimiting number of rooms a user can join, "local" for when
+#     users are joining rooms the server is already in (this is cheap) vs
+#     "remote" for when users are trying to join rooms not on the server (which
+#     can be more expensive)
 #
 # The defaults are as shown below.
 #
 #rc_message:
 #  per_second: 0.2
 #  burst_count: 10
-#
+rc_message:
+  per_second: ${RC_MESSAGE_PER_SECOND:?}
+  burst_count: ${RC_MESSAGE_BURST:?}
+
 #rc_registration:
 #  per_second: 0.17
 #  burst_count: 3
@@ -751,25 +878,29 @@ log_config: "$LOG_CONFIG_PATH"
 #  failed_attempts:
 #    per_second: 0.17
 #    burst_count: 3
+rc_login:
+  address:
+    per_second: ${RC_LOGIN_PER_SECOND:?}
+    burst_count: ${RC_LOGIN_BURST:?}
+  account:
+    per_second: ${RC_LOGIN_PER_SECOND:?}
+    burst_count: ${RC_LOGIN_BURST:?}
+  failed_attempts:
+    per_second: ${RC_LOGIN_PER_SECOND:?}
+    burst_count: ${RC_LOGIN_BURST:?}
 #
 #rc_admin_redaction:
 #  per_second: 1
 #  burst_count: 50
+#
+#rc_joins:
+#  local:
+#    per_second: 0.1
+#    burst_count: 3
+#  remote:
+#    per_second: 0.01
+#    burst_count: 3
 
-rc_message:
-  per_second: $RC_MESSAGE_PER_SECOND
-  burst_count: $RC_MESSAGE_BURST
-
-rc_login:
-  address:
-    per_second: $RC_LOGIN_PER_SECOND
-    burst_count: $RC_LOGIN_BURST
-  account:
-    per_second: $RC_LOGIN_PER_SECOND
-    burst_count: $RC_LOGIN_BURST
-  failed_attempts:
-    per_second: $RC_LOGIN_PER_SECOND
-    burst_count: $RC_LOGIN_BURST
 
 # Ratelimiting settings for incoming federation
 #
@@ -808,34 +939,29 @@ rc_login:
 # Enable the media store service in the Synapse master. Uncomment the
 # following if you are using a separate media store worker.
 #
-#enable_media_repo: false
+enable_media_repo: ${ENABLE_MEDIA_REPO:?}
 
 # Directory where uploaded images and attachments are stored.
 #
-media_store_path: "$DATA_DIR/media_store"
+media_store_path: "${DATA_DIR:?}/media_store"
 
 # Media storage providers allow media to be stored in different
 # locations.
 #
 #media_storage_providers:
 #  - module: file_system
-#    # Whether to write new local files.
+#    # Whether to store newly uploaded local files
 #    store_local: false
-#    # Whether to write new remote media
+#    # Whether to store newly downloaded remote files
 #    store_remote: false
-#    # Whether to block upload requests waiting for write to this
-#    # provider to complete
+#    # Whether to wait for successful storage for local uploads
 #    store_synchronous: false
 #    config:
 #       directory: /mnt/some/other/directory
 
-# Directory where in-progress uploads are stored.
-#
-uploads_path: "$DATA_DIR/uploads"
-
 # The largest allowed upload size in bytes
 #
-max_upload_size: "$MAX_UPLOAD_SIZE"
+max_upload_size: "${MAX_UPLOAD_SIZE:?}"
 
 # Maximum number of pixels that will be thumbnailed
 #
@@ -873,7 +999,7 @@ max_upload_size: "$MAX_UPLOAD_SIZE"
 # 'false' by default: uncomment the following to enable it (and specify a
 # url_preview_ip_range_blacklist blacklist).
 #
-#url_preview_enabled: true
+url_preview_enabled: ${ENABLE_URL_PREVIEW:?}
 
 # List of IP address CIDR ranges that the URL preview spider is denied
 # from accessing.  There are no defaults: you must explicitly
@@ -895,9 +1021,15 @@ max_upload_size: "$MAX_UPLOAD_SIZE"
 #  - '172.16.0.0/12'
 #  - '192.168.0.0/16'
 #  - '100.64.0.0/10'
+#  - '192.0.0.0/24'
 #  - '169.254.0.0/16'
+#  - '198.18.0.0/15'
+#  - '192.0.2.0/24'
+#  - '198.51.100.0/24'
+#  - '203.0.113.0/24'
+#  - '224.0.0.0/4'
 #  - '::1/128'
-#  - 'fe80::/64'
+#  - 'fe80::/10'
 #  - 'fc00::/7'
 
 # List of IP address CIDR ranges that the URL preview spider is allowed
@@ -947,39 +1079,73 @@ max_upload_size: "$MAX_UPLOAD_SIZE"
 #
 #max_spider_size: 10M
 
+# A list of values for the Accept-Language HTTP header used when
+# downloading webpages during URL preview generation. This allows
+# Synapse to specify the preferred languages that URL previews should
+# be in when communicating with remote servers.
+#
+# Each value is a IETF language tag; a 2-3 letter identifier for a
+# language, optionally followed by subtags separated by '-', specifying
+# a country or region variant.
+#
+# Multiple values can be provided, and a weight can be added to each by
+# using quality value syntax (;q=). '*' translates to any language.
+#
+# Defaults to "en".
+#
+# Example:
+#
+# url_preview_accept_language:
+#   - en-UK
+#   - en-US;q=0.9
+#   - fr;q=0.8
+#   - *;q=0.7
+#
+url_preview_accept_language:
+#   - en
+
 
 ## Captcha ##
-# See docs/CAPTCHA_SETUP for full details of configuring this.
+# See docs/CAPTCHA_SETUP.md for full details of configuring this.
 
-# This Home Server's ReCAPTCHA public key.
+# This homeserver's ReCAPTCHA public key. Must be specified if
+# enable_registration_captcha is enabled.
 #
 #recaptcha_public_key: "YOUR_PUBLIC_KEY"
 
-# This Home Server's ReCAPTCHA private key.
+# This homeserver's ReCAPTCHA private key. Must be specified if
+# enable_registration_captcha is enabled.
 #
 #recaptcha_private_key: "YOUR_PRIVATE_KEY"
 
-# Enables ReCaptcha checks when registering, preventing signup
+# Uncomment to enable ReCaptcha checks when registering, preventing signup
 # unless a captcha is answered. Requires a valid ReCaptcha
-# public/private key.
+# public/private key. Defaults to 'false'.
 #
-#enable_registration_captcha: false
-
-# A secret key used to bypass the captcha test entirely.
-#
-#captcha_bypass_secret: "YOUR_SECRET_HERE"
+#enable_registration_captcha: true
 
 # The API endpoint to use for verifying m.login.recaptcha responses.
+# Defaults to "https://www.recaptcha.net/recaptcha/api/siteverify".
 #
-#recaptcha_siteverify_api: "https://www.recaptcha.net/recaptcha/api/siteverify"
+#recaptcha_siteverify_api: "https://my.recaptcha.site"
 
 
 ## TURN ##
 
 # The public URIs of the TURN server to give to clients
-#
-turn_uris: $TURN_URIS
 
+EOF
+
+if [ -n "$TURN_URIS" ]; then
+	echo "turn_uris:"
+	for uri in $TURN_URIS; do
+		echo "  - '$uri'"
+	done
+else
+	echo "# turn_uris: []"
+fi
+
+cat << EOF
 # The shared secret used to compute passwords for the TURN server
 #
 turn_shared_secret: "$TURN_SHARED_SECRET"
@@ -992,7 +1158,7 @@ turn_shared_secret: "$TURN_SHARED_SECRET"
 
 # How long generated TURN credentials last
 #
-turn_user_lifetime: "$TURN_USER_LIFETIME"
+turn_user_lifetime: ${TURN_USER_LIFETIME:?}
 
 # Whether guests should be allowed to use the TURN server.
 # This defaults to True, otherwise VoIP will be unreliable for guests.
@@ -1002,6 +1168,7 @@ turn_user_lifetime: "$TURN_USER_LIFETIME"
 #
 #turn_allow_guests: true
 
+
 ## Registration ##
 #
 # Registration can be rate-limited using the parameters in the "Ratelimiting"
@@ -1009,28 +1176,11 @@ turn_user_lifetime: "$TURN_USER_LIFETIME"
 
 # Enable registration for new users.
 #
-enable_registration: $ALLOW_REGISTRATION
+enable_registration: ${ENABLE_REGISTRATIONS:?}
 
 # Optional account validity configuration. This allows for accounts to be denied
 # any request after a given period.
 #
-# \`\`enabled\`\` defines whether the account validity feature is enabled. Defaults
-# to False.
-#
-# \`\`period\`\` allows setting the period after which an account is valid
-# after its registration. When renewing the account, its validity period
-# will be extended by this amount of time. This parameter is required when using
-# the account validity feature.
-#
-# \`\`renew_at\`\` is the amount of time before an account's expiry date at which
-# Synapse will send an email to the account's email address with a renewal link.
-# This needs the \`\`email\`\` and \`\`public_baseurl\`\` configuration sections to be
-# filled.
-#
-# \`\`renew_email_subject\`\` is the subject of the email sent out with the renewal
-# link. \`\`%(app)s\`\` can be used as a placeholder for the \`\`app_name\`\` parameter
-# from the \`\`email\`\` section.
-#
 # Once this feature is enabled, Synapse will look for registered users without an
 # expiration date at startup and will add one to every account it found using the
 # current settings at that time.
@@ -1041,21 +1191,56 @@ enable_registration: $ALLOW_REGISTRATION
 # date will be randomly selected within a range [now + period - d ; now + period],
 # where d is equal to 10% of the validity period.
 #
-#account_validity:
-#  enabled: true
-#  period: 6w
-#  renew_at: 1w
-#  renew_email_subject: "Renew your %(app)s account"
-#  # Directory in which Synapse will try to find the HTML files to serve to the
-#  # user when trying to renew an account. Optional, defaults to
-#  # synapse/res/templates.
-#  template_dir: "res/templates"
-#  # HTML to be displayed to the user after they successfully renewed their
-#  # account. Optional.
-#  account_renewed_html_path: "account_renewed.html"
-#  # HTML to be displayed when the user tries to renew an account with an invalid
-#  # renewal token. Optional.
-#  invalid_token_html_path: "invalid_token.html"
+account_validity:
+  # The account validity feature is disabled by default. Uncomment the
+  # following line to enable it.
+  #
+  #enabled: true
+
+  # The period after which an account is valid after its registration. When
+  # renewing the account, its validity period will be extended by this amount
+  # of time. This parameter is required when using the account validity
+  # feature.
+  #
+  #period: 6w
+
+  # The amount of time before an account's expiry date at which Synapse will
+  # send an email to the account's email address with a renewal link. By
+  # default, no such emails are sent.
+  #
+  # If you enable this setting, you will also need to fill out the 'email'
+  # configuration section. You should also check that 'public_baseurl' is set
+  # correctly.
+  #
+  #renew_at: 1w
+
+  # The subject of the email sent out with the renewal link. '%(app)s' can be
+  # used as a placeholder for the 'app_name' parameter from the 'email'
+  # section.
+  #
+  # Note that the placeholder must be written '%(app)s', including the
+  # trailing 's'.
+  #
+  # If this is not set, a default value is used.
+  #
+  #renew_email_subject: "Renew your %(app)s account"
+
+  # Directory in which Synapse will try to find templates for the HTML files to
+  # serve to the user when trying to renew an account. If not set, default
+  # templates from within the Synapse package will be used.
+  #
+  #template_dir: "res/templates"
+
+  # File within 'template_dir' giving the HTML to be displayed to the user after
+  # they successfully renewed their account. If not set, default text is used.
+  #
+  #account_renewed_html_path: "account_renewed.html"
+
+  # File within 'template_dir' giving the HTML to be displayed when the user
+  # tries to renew an account with an invalid renewal token. If not set,
+  # default text is used.
+  #
+  #invalid_token_html_path: "invalid_token.html"
 
 # Time that a user's session remains valid for, after they log in.
 #
@@ -1068,24 +1253,59 @@ enable_registration: $ALLOW_REGISTRATION
 #
 #session_lifetime: 24h
 
-$(generate_registration_requirements)
+# The user must provide all of the below types of 3PID when registering.
+#
+#registrations_require_3pid:
+#  - email
+#  - msisdn
+EOF
 
+if [ -n "$REGISTRATION_REQUIRES_EMAIL" ]; then
+	echo "registrations_require_3pid: [email]"
+fi
+
+cat << EOF
 # Explicitly disable asking for MSISDNs from the registration
 # flow (overrides registrations_require_3pid if MSISDNs are set as required)
 #
 #disable_msisdn_registration: true
 
-$(generate_allowed_3pid_patterns)
+# Mandate that users are only allowed to associate certain formats of
+# 3PIDs with accounts on this server.
+#
+#allowed_local_3pids:
+#  - medium: email
+#    pattern: '.*@matrix\.org'
+#  - medium: email
+#    pattern: '.*@vector\.im'
+#  - medium: msisdn
+#    pattern: '\+44'
+EOF
 
+if [ -n "$RESGISTRATION_ALLOWS_EMAIL_PATTERN" ]; then
+	echo "allowed_local_3pids:"
+	for pattern in $RESGISTRATION_ALLOWS_EMAIL_PATTERN; do
+		cat << EOF
+  - medium: email
+    pattern: $pattern
+EOF
+	done
+fi
+
+cat << EOF
 # Enable 3PIDs lookup requests to identity servers from this server.
 #
 #enable_3pid_lookup: true
 
 # If set, allows registration of standard or admin accounts by anyone who
 # has the shared secret, even if registration is otherwise disabled.
-#
-# registration_shared_secret: <PRIVATE STRING>
+EOF
 
+if [ -n "$REGISTRATION_SHARED_SECRET" ]; then
+	echo "registration_shared_secret: '$REGISTRATION_SHARED_SECRET'"
+fi
+
+cat << EOF
 # Set the number of bcrypt rounds used to generate password hash.
 # Larger numbers increase the work factor needed to generate the hash.
 # The default number is 12 (which equates to 2^12 rounds).
@@ -1097,35 +1317,16 @@ $(generate_allowed_3pid_patterns)
 # Allows users to register as guests without a password/email/etc, and
 # participate in rooms hosted on this server which have been made
 # accessible to anonymous users.
-#
-allow_guest_access: $ALLOW_GUEST_ACCESS
+
+allow_guest_access: ${ALLOW_GUEST_ACCESS:?}
 
 # The identity server which we suggest that clients should use when users log
 # in on this server.
 #
-# (By default, no suggestion is made, so it is left up to the client.
-# This setting is ignored unless public_baseurl is also set.)
+# (By default, no suggestion is made, so it is left up to the client.)
 #
 #default_identity_server: https://matrix.org
 
-# The list of identity servers trusted to verify third party
-# identifiers by this server.
-#
-# Also defines the ID server which will be called when an account is
-# deactivated (one will be picked arbitrarily).
-#
-# Note: This option is deprecated. Since v0.99.4, Synapse has tracked which identity
-# server a 3PID has been bound to. For 3PIDs bound before then, Synapse runs a
-# background migration script, informing itself that the identity server all of its
-# 3PIDs have been bound to is likely one of the below.
-#
-# As of Synapse v1.4.0, all other functionality of this option has been deprecated, and
-# it is now solely used for the purposes of the background migration script, and can be
-# removed once it has run.
-#trusted_third_party_id_servers:
-#  - matrix.org
-#  - vector.im
-
 # Handle threepid (email/phone etc) registration and password resets through a set of
 # *trusted* identity servers. Note that this allows the configured identity server to
 # reset passwords for accounts!
@@ -1135,8 +1336,9 @@ allow_guest_access: $ALLOW_GUEST_ACCESS
 # email will be globally disabled.
 #
 # Additionally, if \`msisdn\` is not set, registration and password resets via msisdn
-# will be disabled regardless. This is due to Synapse currently not supporting any
-# method of sending SMS messages on its own.
+# will be disabled regardless, and users will not be able to associate an msisdn
+# identifier to their account. This is due to Synapse currently not supporting
+# any method of sending SMS messages on its own.
 #
 # To enable using an identity server for operations regarding a particular third-party
 # identifier type, set the value to the URL of that identity server as shown in the
@@ -1146,29 +1348,127 @@ allow_guest_access: $ALLOW_GUEST_ACCESS
 # by the Matrix Identity Service API specification:
 # https://matrix.org/docs/spec/identity_service/latest
 #
-# If a delegate is specified, the config option public_baseurl must also be filled out.
-#
 account_threepid_delegates:
-    #email: https://example.com     # Delegate email sending to example.org
+    #email: https://example.com     # Delegate email sending to example.com
     #msisdn: http://localhost:8090  # Delegate SMS sending to this local process
 
+# Whether users are allowed to change their displayname after it has
+# been initially set. Useful when provisioning users based on the
+# contents of a third-party directory.
+#
+# Does not apply to server administrators. Defaults to 'true'
+#
+#enable_set_displayname: false
 
-$(generate_auto_join_rooms)
+# Whether users are allowed to change their avatar after it has been
+# initially set. Useful when provisioning users based on the contents
+# of a third-party directory.
+#
+# Does not apply to server administrators. Defaults to 'true'
+#
+#enable_set_avatar_url: false
 
+# Whether users can change the 3PIDs associated with their accounts
+# (email address and msisdn).
+#
+# Defaults to 'true'
+#
+#enable_3pid_changes: false
+
+# Users who register on this homeserver will automatically be joined
+# to these rooms.
+#
+# By default, any room aliases included in this list will be created
+# as a publicly joinable room when the first user registers for the
+# homeserver. This behaviour can be customised with the settings below.
+#
+#auto_join_rooms:
+#  - "#example:example.com"
+EOF
+
+if [ -n "$AUTO_JOIN_ROOMS" ]; then
+	echo "auto_join_rooms:"
+	for room in $AUTO_JOIN_ROOMS; do
+		cat << EOF
+  - "$room"
+EOF
+	done
+fi
+
+cat << EOF
 # Where auto_join_rooms are specified, setting this flag ensures that the
 # the rooms exist by creating them when the first user on the
 # homeserver registers.
+#
+# By default the auto-created rooms are publicly joinable from any federated
+# server. Use the autocreate_auto_join_rooms_federated and
+# autocreate_auto_join_room_preset settings below to customise this behaviour.
+#
 # Setting to false means that if the rooms are not manually created,
 # users cannot be auto-joined since they do not exist.
 #
-#autocreate_auto_join_rooms: true
+# Defaults to true. Uncomment the following line to disable automatically
+# creating auto-join rooms.
+#
+#autocreate_auto_join_rooms: false
+
+# Whether the auto_join_rooms that are auto-created are available via
+# federation. Only has an effect if autocreate_auto_join_rooms is true.
+#
+# Note that whether a room is federated cannot be modified after
+# creation.
+#
+# Defaults to true: the room will be joinable from other servers.
+# Uncomment the following to prevent users from other homeservers from
+# joining these rooms.
+#
+#autocreate_auto_join_rooms_federated: false
+
+# The room preset to use when auto-creating one of auto_join_rooms. Only has an
+# effect if autocreate_auto_join_rooms is true.
+#
+# This can be one of "public_chat", "private_chat", or "trusted_private_chat".
+# If a value of "private_chat" or "trusted_private_chat" is used then
+# auto_join_mxid_localpart must also be configured.
+#
+# Defaults to "public_chat", meaning that the room is joinable by anyone, including
+# federated servers if autocreate_auto_join_rooms_federated is true (the default).
+# Uncomment the following to require an invitation to join these rooms.
+#
+#autocreate_auto_join_room_preset: private_chat
+
+# The local part of the user id which is used to create auto_join_rooms if
+# autocreate_auto_join_rooms is true. If this is not provided then the
+# initial user account that registers will be used to create the rooms.
+#
+# The user id is also used to invite new users to any auto-join rooms which
+# are set to invite-only.
+#
+# It *must* be configured if autocreate_auto_join_room_preset is set to
+# "private_chat" or "trusted_private_chat".
+#
+# Note that this must be specified in order for new users to be correctly
+# invited to any auto-join rooms which have been set to invite-only (either
+# at the time of creation or subsequently).
+#
+# Note that, if the room already exists, this user must be joined and
+# have the appropriate permissions to invite new members.
+#
+#auto_join_mxid_localpart: system
+
+# When auto_join_rooms is specified, setting this flag to false prevents
+# guest accounts from being automatically joined to the rooms.
+#
+# Defaults to true.
+#
+#auto_join_rooms_for_guests: false
 
 
 ## Metrics ###
 
 # Enable collection and rendering of performance metrics
 #
-enable_metrics: $EXPOSE_METRICS
+enable_metrics: ${EXPOSE_METRICS:?}
 
 # Enable sentry integration
 # NOTE: While attempts are made to ensure that the logs don't contain
@@ -1184,14 +1484,15 @@ enable_metrics: $EXPOSE_METRICS
 # enabled by default, either for performance reasons or limited use.
 #
 metrics_flags:
-    # Publish synapse_federation_known_servers, a g auge of the number of
+    # Publish synapse_federation_known_servers, a gauge of the number of
     # servers this homeserver knows about, including itself. May cause
     # performance problems on large homeservers.
     #
     #known_servers: true
 
 # Whether or not to report anonymized homeserver usage statistics.
-report_stats: $REPORT_STATS
+#
+report_stats: ${REPORT_STATS:?}
 
 # The endpoint to report the anonymized homeserver usage statistics to.
 # Defaults to https://matrix.org/report-usage-stats/push
@@ -1210,10 +1511,22 @@ report_stats: $REPORT_STATS
 #  - "m.room.encryption"
 #  - "m.room.name"
 
+
 # A list of application service config files to use
 #
-$(generate_app_service_config_files)
+#app_service_config_files:
+#  - app_service_1.yaml
+#  - app_service_2.yaml
+EOF
 
+if [ -n "$APP_SERVICE_CONFIG_FILES" ]; then
+	echo "app_service_config_files:"
+	for file in $APP_SERVICE_CONFIG_FILES; do
+		echo "  - $file"
+	done
+fi
+
+cat << EOF
 # Uncomment to enable tracking of application service IP addresses. Implicitly
 # enables MAU tracking for application service users.
 #
@@ -1224,29 +1537,34 @@ $(generate_app_service_config_files)
 # the registration_shared_secret is used, if one is given; otherwise,
 # a secret key is derived from the signing key.
 #
-# macaroon_secret_key: <PRIVATE STRING>
+# macaroon_secret_key: "JCMj1A@Me_tSnQwS@,LeInKrEPr@..w4Q6reqqeYWLC:k4tFLn"
 
 # a secret which is used to calculate HMACs for form values, to stop
 # falsification of values. Must be specified for the User Consent
 # forms to work.
 #
-# form_secret: <PRIVATE STRING>
+# form_secret: "Hfc:voJY1;,L==VSuq^^@D8Dpa8,Lm13YVnLwLA&2wmfnPloy8"
 
 ## Signing Keys ##
 
 # Path to the signing key to sign messages with
 #
-signing_key_path: "$SIGNING_KEY_PATH"
+signing_key_path: "${SIGNING_KEY_PATH:?}"
 
 # The keys that the server used to sign messages with but won't use
-# to sign new messages. E.g. it has lost its private key
+# to sign new messages.
 #
-#old_signing_keys:
-#  "ed25519:auto":
-#    # Base64 encoded public key
-#    key: "The public part of your old signing key."
-#    # Millisecond POSIX timestamp when the key expired.
-#    expired_ts: 123456789123
+old_signing_keys:
+  # For each key, \`key\` should be the base64-encoded public key, and
+  # \`expired_ts\` should be the time (in milliseconds since the unix epoch) that
+  # it was last used.
+  #
+  # It is possible to build an entry from an old signing.key file using the
+  # \`export_signing_key\` script which is provided with synapse.
+  #
+  # For example:
+  #
+  #"ed25519:id": { key: "base64string", expired_ts: 123456789123 }
 
 # How long key response published by this server is valid for.
 # Used to set the valid_until_ts in /key/v2 APIs.
@@ -1260,7 +1578,7 @@ signing_key_path: "$SIGNING_KEY_PATH"
 # When we need to fetch a signing key, each server is tried in parallel.
 #
 # Normally, the connection to the key server is validated via TLS certificates.
-# Additional security can be provided by configuring a \`verify key\`, which
+# Additional security can be provided by configuring a  \`verify key\`, which
 # will make synapse check that the response is signed by that key.
 #
 # This setting supercedes an older setting named \`perspectives\`. The old format
@@ -1310,16 +1628,24 @@ trusted_key_servers:
 #key_server_signing_keys_path: "key_server_signing_keys.key"
 
 
+## Single sign-on integration ##
+
+# The following settings can be used to make Synapse use a single sign-on
+# provider for authentication, instead of its internal password database.
+#
+# You will probably also want to set the following options to \`false\` to
+# disable the regular login/registration flows:
+#   * enable_registration
+#   * password_config.enabled
+#
+# You will also want to investigate the settings under the "sso" configuration
+# section below.
+
 # Enable SAML2 for registration and login. Uses pysaml2.
 #
 # At least one of \`sp_config\` or \`config_path\` must be set in this section to
 # enable SAML login.
 #
-# (You will probably also want to set the following options to \`false\` to
-# disable the regular login/registration flows:
-#   * enable_registration
-#   * password_config.enabled
-#
 # Once SAML support is enabled, a metadata file will be exposed at
 # https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
 # use to configure your SAML IdP with. Alternatively, you can manually configure
@@ -1334,97 +1660,510 @@ saml2_config:
   # so it is not normally necessary to specify them unless you need to
   # override them.
   #
-  #sp_config:
-  #  # point this to the IdP's metadata. You can use either a local file or
-  #  # (preferably) a URL.
-  #  metadata:
-  #    #local: ["saml2/idp.xml"]
-  #    remote:
-  #      - url: https://our_idp/metadata.xml
-  #
-  #    # By default, the user has to go to our login page first. If you'd like
-  #    # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
-  #    # 'service.sp' section:
-  #    #
-  #    #service:
-  #    #  sp:
-  #    #    allow_unsolicited: true
-  #
-  #    # The examples below are just used to generate our metadata xml, and you
-  #    # may well not need them, depending on your setup. Alternatively you
-  #    # may need a whole lot more detail - see the pysaml2 docs!
-  #
-  #    description: ["My awesome SP", "en"]
-  #    name: ["Test SP", "en"]
-  #
-  #    organization:
-  #      name: Example com
-  #      display_name:
-  #        - ["Example co", "en"]
-  #      url: "http://example.com"
-  #
-  #    contact_person:
-  #      - given_name: Bob
-  #        sur_name: "the Sysadmin"
-  #        email_address": ["admin@example.com"]
-  #        contact_type": technical
+  sp_config:
+    # Point this to the IdP's metadata. You must provide either a local
+    # file via the \`local\` attribute or (preferably) a URL via the
+    # \`remote\` attribute.
+    #
+    #metadata:
+    #  local: ["saml2/idp.xml"]
+    #  remote:
+    #    - url: https://our_idp/metadata.xml
+
+    # Allowed clock difference in seconds between the homeserver and IdP.
+    #
+    # Uncomment the below to increase the accepted time difference from 0 to 3 seconds.
+    #
+    #accepted_time_diff: 3
+
+    # By default, the user has to go to our login page first. If you'd like
+    # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
+    # 'service.sp' section:
+    #
+    #service:
+    #  sp:
+    #    allow_unsolicited: true
+
+    # The examples below are just used to generate our metadata xml, and you
+    # may well not need them, depending on your setup. Alternatively you
+    # may need a whole lot more detail - see the pysaml2 docs!
+
+    #description: ["My awesome SP", "en"]
+    #name: ["Test SP", "en"]
+
+    #ui_info:
+    #  display_name:
+    #    - lang: en
+    #      text: "Display Name is the descriptive name of your service."
+    #  description:
+    #    - lang: en
+    #      text: "Description should be a short paragraph explaining the purpose of the service."
+    #  information_url:
+    #    - lang: en
+    #      text: "https://example.com/terms-of-service"
+    #  privacy_statement_url:
+    #    - lang: en
+    #      text: "https://example.com/privacy-policy"
+    #  keywords:
+    #    - lang: en
+    #      text: ["Matrix", "Element"]
+    #  logo:
+    #    - lang: en
+    #      text: "https://example.com/logo.svg"
+    #      width: "200"
+    #      height: "80"
+
+    #organization:
+    #  name: Example com
+    #  display_name:
+    #    - ["Example co", "en"]
+    #  url: "http://example.com"
+
+    #contact_person:
+    #  - given_name: Bob
+    #    sur_name: "the Sysadmin"
+    #    email_address": ["admin@example.com"]
+    #    contact_type": technical
 
   # Instead of putting the config inline as above, you can specify a
   # separate pysaml2 configuration file:
   #
-  #config_path: "CONFDIR/sp_conf.py"
+  #config_path: "/etc/synapse/sp_conf.py"
 
-  # the lifetime of a SAML session. This defines how long a user has to
+  # The lifetime of a SAML session. This defines how long a user has to
   # complete the authentication process, if allow_unsolicited is unset.
-  # The default is 5 minutes.
+  # The default is 15 minutes.
   #
   #saml_session_lifetime: 5m
 
-  # The SAML attribute (after mapping via the attribute maps) to use to derive
-  # the Matrix ID from. 'uid' by default.
+  # An external module can be provided here as a custom solution to
+  # mapping attributes returned from a saml provider onto a matrix user.
   #
-  #mxid_source_attribute: displayName
+  user_mapping_provider:
+    # The custom module's class. Uncomment to use a custom module.
+    #
+    #module: mapping_provider.SamlMappingProvider
 
-  # The mapping system to use for mapping the saml attribute onto a matrix ID.
-  # Options include:
-  #  * 'hexencode' (which maps unpermitted characters to '=xx')
-  #  * 'dotreplace' (which replaces unpermitted characters with '.').
-  # The default is 'hexencode'.
-  #
-  #mxid_mapping: dotreplace
+    # Custom configuration values for the module. Below options are
+    # intended for the built-in provider, they should be changed if
+    # using a custom module. This section will be passed as a Python
+    # dictionary to the module's \`parse_config\` method.
+    #
+    config:
+      # The SAML attribute (after mapping via the attribute maps) to use
+      # to derive the Matrix ID from. 'uid' by default.
+      #
+      # Note: This used to be configured by the
+      # saml2_config.mxid_source_attribute option. If that is still
+      # defined, its value will be used instead.
+      #
+      #mxid_source_attribute: displayName
 
-  # In previous versions of synapse, the mapping from SAML attribute to MXID was
-  # always calculated dynamically rather than stored in a table. For backwards-
-  # compatibility, we will look for user_ids matching such a pattern before
-  # creating a new account.
+      # The mapping system to use for mapping the saml attribute onto a
+      # matrix ID.
+      #
+      # Options include:
+      #  * 'hexencode' (which maps unpermitted characters to '=xx')
+      #  * 'dotreplace' (which replaces unpermitted characters with
+      #     '.').
+      # The default is 'hexencode'.
+      #
+      # Note: This used to be configured by the
+      # saml2_config.mxid_mapping option. If that is still defined, its
+      # value will be used instead.
+      #
+      #mxid_mapping: dotreplace
+
+  # In previous versions of synapse, the mapping from SAML attribute to
+  # MXID was always calculated dynamically rather than stored in a
+  # table. For backwards- compatibility, we will look for user_ids
+  # matching such a pattern before creating a new account.
   #
   # This setting controls the SAML attribute which will be used for this
-  # backwards-compatibility lookup. Typically it should be 'uid', but if the
-  # attribute maps are changed, it may be necessary to change it.
+  # backwards-compatibility lookup. Typically it should be 'uid', but if
+  # the attribute maps are changed, it may be necessary to change it.
   #
   # The default is 'uid'.
   #
   #grandfathered_mxid_source_attribute: upn
 
+  # It is possible to configure Synapse to only allow logins if SAML attributes
+  # match particular values. The requirements can be listed under
+  # \`attribute_requirements\` as shown below. All of the listed attributes must
+  # match for the login to be permitted.
+  #
+  #attribute_requirements:
+  #  - attribute: userGroup
+  #    value: "staff"
+  #  - attribute: department
+  #    value: "sales"
+
+  # If the metadata XML contains multiple IdP entities then the \`idp_entityid\`
+  # option must be set to the entity to redirect users to.
+  #
+  # Most deployments only have a single IdP entity and so should omit this
+  # option.
+  #
+  #idp_entityid: 'https://our_idp/entityid'
 
 
-# Enable CAS for registration and login.
+# List of OpenID Connect (OIDC) / OAuth 2.0 identity providers, for registration
+# and login.
 #
-#cas_config:
-#   enabled: true
-#   server_url: "https://cas-server.com"
-#   service_url: "https://homeserver.domain.com:8448"
-#   #displayname_attribute: name
-#   #required_attributes:
-#   #    name: value
+# Options for each entry include:
+#
+#   idp_id: a unique identifier for this identity provider. Used internally
+#       by Synapse; should be a single word such as 'github'.
+#
+#       Note that, if this is changed, users authenticating via that provider
+#       will no longer be recognised as the same user!
+#
+#   idp_name: A user-facing name for this identity provider, which is used to
+#       offer the user a choice of login mechanisms.
+#
+#   idp_icon: An optional icon for this identity provider, which is presented
+#       by identity picker pages. If given, must be an MXC URI of the format
+#       mxc://<server-name>/<media-id>. (An easy way to obtain such an MXC URI
+#       is to upload an image to an (unencrypted) room and then copy the "url"
+#       from the source of the event.)
+#
+#   discover: set to 'false' to disable the use of the OIDC discovery mechanism
+#       to discover endpoints. Defaults to true.
+#
+#   issuer: Required. The OIDC issuer. Used to validate tokens and (if discovery
+#       is enabled) to discover the provider's endpoints.
+#
+#   client_id: Required. oauth2 client id to use.
+#
+#   client_secret: Required. oauth2 client secret to use.
+#
+#   client_auth_method: auth method to use when exchanging the token. Valid
+#       values are 'client_secret_basic' (default), 'client_secret_post' and
+#       'none'.
+#
+#   scopes: list of scopes to request. This should normally include the "openid"
+#       scope. Defaults to ["openid"].
+#
+#   authorization_endpoint: the oauth2 authorization endpoint. Required if
+#       provider discovery is disabled.
+#
+#   token_endpoint: the oauth2 token endpoint. Required if provider discovery is
+#       disabled.
+#
+#   userinfo_endpoint: the OIDC userinfo endpoint. Required if discovery is
+#       disabled and the 'openid' scope is not requested.
+#
+#   jwks_uri: URI where to fetch the JWKS. Required if discovery is disabled and
+#       the 'openid' scope is used.
+#
+#   skip_verification: set to 'true' to skip metadata verification. Use this if
+#       you are connecting to a provider that is not OpenID Connect compliant.
+#       Defaults to false. Avoid this in production.
+#
+#   user_profile_method: Whether to fetch the user profile from the userinfo
+#       endpoint. Valid values are: 'auto' or 'userinfo_endpoint'.
+#
+#       Defaults to 'auto', which fetches the userinfo endpoint if 'openid' is
+#       included in 'scopes'. Set to 'userinfo_endpoint' to always fetch the
+#       userinfo endpoint.
+#
+#   allow_existing_users: set to 'true' to allow a user logging in via OIDC to
+#       match a pre-existing account instead of failing. This could be used if
+#       switching from password logins to OIDC. Defaults to false.
+#
+#   user_mapping_provider: Configuration for how attributes returned from a OIDC
+#       provider are mapped onto a matrix user. This setting has the following
+#       sub-properties:
+#
+#       module: The class name of a custom mapping module. Default is
+#           'synapse.handlers.oidc_handler.JinjaOidcMappingProvider'.
+#           See https://github.com/matrix-org/synapse/blob/master/docs/sso_mapping_providers.md#openid-mapping-providers
+#           for information on implementing a custom mapping provider.
+#
+#       config: Configuration for the mapping provider module. This section will
+#           be passed as a Python dictionary to the user mapping provider
+#           module's \`parse_config\` method.
+#
+#           For the default provider, the following settings are available:
+#
+#             sub: name of the claim containing a unique identifier for the
+#                 user. Defaults to 'sub', which OpenID Connect compliant
+#                 providers should provide.
+#
+#             localpart_template: Jinja2 template for the localpart of the MXID.
+#                 If this is not set, the user will be prompted to choose their
+#                 own username.
+#
+#             display_name_template: Jinja2 template for the display name to set
+#                 on first login. If unset, no displayname will be set.
+#
+#             extra_attributes: a map of Jinja2 templates for extra attributes
+#                 to send back to the client during login.
+#                 Note that these are non-standard and clients will ignore them
+#                 without modifications.
+#
+#           When rendering, the Jinja2 templates are given a 'user' variable,
+#           which is set to the claims returned by the UserInfo Endpoint and/or
+#           in the ID Token.
+#
+# See https://github.com/matrix-org/synapse/blob/master/docs/openid.md
+# for information on how to configure these options.
+#
+# For backwards compatibility, it is also possible to configure a single OIDC
+# provider via an 'oidc_config' setting. This is now deprecated and admins are
+# advised to migrate to the 'oidc_providers' format. (When doing that migration,
+# use 'oidc' for the idp_id to ensure that existing users continue to be
+# recognised.)
+#
+oidc_providers:
+  # Generic example
+  #
+  #- idp_id: my_idp
+  #  idp_name: "My OpenID provider"
+  #  idp_icon: "mxc://example.com/mediaid"
+  #  discover: false
+  #  issuer: "https://accounts.example.com/"
+  #  client_id: "provided-by-your-issuer"
+  #  client_secret: "provided-by-your-issuer"
+  #  client_auth_method: client_secret_post
+  #  scopes: ["openid", "profile"]
+  #  authorization_endpoint: "https://accounts.example.com/oauth2/auth"
+  #  token_endpoint: "https://accounts.example.com/oauth2/token"
+  #  userinfo_endpoint: "https://accounts.example.com/userinfo"
+  #  jwks_uri: "https://accounts.example.com/.well-known/jwks.json"
+  #  skip_verification: true
+
+  # For use with Keycloak
+  #
+  #- idp_id: keycloak
+  #  idp_name: Keycloak
+  #  issuer: "https://127.0.0.1:8443/auth/realms/my_realm_name"
+  #  client_id: "synapse"
+  #  client_secret: "copy secret generated in Keycloak UI"
+  #  scopes: ["openid", "profile"]
+
+  # For use with Github
+  #
+  #- idp_id: github
+  #  idp_name: Github
+  #  discover: false
+  #  issuer: "https://github.com/"
+  #  client_id: "your-client-id" # TO BE FILLED
+  #  client_secret: "your-client-secret" # TO BE FILLED
+  #  authorization_endpoint: "https://github.com/login/oauth/authorize"
+  #  token_endpoint: "https://github.com/login/oauth/access_token"
+  #  userinfo_endpoint: "https://api.github.com/user"
+  #  scopes: ["read:user"]
+  #  user_mapping_provider:
+  #    config:
+  #      subject_claim: "id"
+  #      localpart_template: "{ user.login }"
+  #      display_name_template: "{ user.name }"
 
 
-# The JWT needs to contain a globally unique "sub" (subject) claim.
+# Enable Central Authentication Service (CAS) for registration and login.
+#
+cas_config:
+  # Uncomment the following to enable authorization against a CAS server.
+  # Defaults to false.
+  #
+  #enabled: true
+
+  # The URL of the CAS authorization endpoint.
+  #
+  #server_url: "https://cas-server.com"
+
+  # The public URL of the homeserver.
+  #
+  #service_url: "https://homeserver.domain.com:8448"
+
+  # The attribute of the CAS response to use as the display name.
+  #
+  # If unset, no displayname will be set.
+  #
+  #displayname_attribute: name
+
+  # It is possible to configure Synapse to only allow logins if CAS attributes
+  # match particular values. All of the keys in the mapping below must exist
+  # and the values must match the given value. Alternately if the given value
+  # is None then any value is allowed (the attribute just must exist).
+  # All of the listed attributes must match for the login to be permitted.
+  #
+  #required_attributes:
+  #  userGroup: "staff"
+  #  department: None
+
+
+# Additional settings to use with single-sign on systems such as OpenID Connect,
+# SAML2 and CAS.
+#
+sso:
+    # A list of client URLs which are whitelisted so that the user does not
+    # have to confirm giving access to their account to the URL. Any client
+    # whose URL starts with an entry in the following list will not be subject
+    # to an additional confirmation step after the SSO login is completed.
+    #
+    # WARNING: An entry such as "https://my.client" is insecure, because it
+    # will also match "https://my.client.evil.site", exposing your users to
+    # phishing attacks from evil.site. To avoid this, include a slash after the
+    # hostname: "https://my.client/".
+    #
+    # The login fallback page (used by clients that don't natively support the
+    # required login flows) is automatically whitelisted in addition to any URLs
+    # in this list.
+    #
+    # By default, this list is empty.
+    #
+    #client_whitelist:
+    #  - https://riot.im/develop
+    #  - https://my.custom.client/
+
+    # Directory in which Synapse will try to find the template files below.
+    # If not set, or the files named below are not found within the template
+    # directory, default templates from within the Synapse package will be used.
+    #
+    # Synapse will look for the following templates in this directory:
+    #
+    # * HTML page to prompt the user to choose an Identity Provider during
+    #   login: 'sso_login_idp_picker.html'.
+    #
+    #   This is only used if multiple SSO Identity Providers are configured.
+    #
+    #   When rendering, this template is given the following variables:
+    #     * redirect_url: the URL that the user will be redirected to after
+    #       login. Needs manual escaping (see
+    #       https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
+    #
+    #     * server_name: the homeserver's name.
+    #
+    #     * providers: a list of available Identity Providers. Each element is
+    #       an object with the following attributes:
+    #         * idp_id: unique identifier for the IdP
+    #         * idp_name: user-facing name for the IdP
+    #
+    #   The rendered HTML page should contain a form which submits its results
+    #   back as a GET request, with the following query parameters:
+    #
+    #     * redirectUrl: the client redirect URI (ie, the \`redirect_url\` passed
+    #       to the template)
+    #
+    #     * idp: the 'idp_id' of the chosen IDP.
+    #
+    # * HTML page for a confirmation step before redirecting back to the client
+    #   with the login token: 'sso_redirect_confirm.html'.
+    #
+    #   When rendering, this template is given three variables:
+    #     * redirect_url: the URL the user is about to be redirected to. Needs
+    #                     manual escaping (see
+    #                     https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
+    #
+    #     * display_url: the same as \`redirect_url\`, but with the query
+    #                    parameters stripped. The intention is to have a
+    #                    human-readable URL to show to users, not to use it as
+    #                    the final address to redirect to. Needs manual escaping
+    #                    (see https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
+    #
+    #     * server_name: the homeserver's name.
+    #
+    # * HTML page which notifies the user that they are authenticating to confirm
+    #   an operation on their account during the user interactive authentication
+    #   process: 'sso_auth_confirm.html'.
+    #
+    #   When rendering, this template is given the following variables:
+    #     * redirect_url: the URL the user is about to be redirected to. Needs
+    #                     manual escaping (see
+    #                     https://jinja.palletsprojects.com/en/2.11.x/templates/#html-escaping).
+    #
+    #     * description: the operation which the user is being asked to confirm
+    #
+    # * HTML page shown after a successful user interactive authentication session:
+    #   'sso_auth_success.html'.
+    #
+    #   Note that this page must include the JavaScript which notifies of a successful authentication
+    #   (see https://matrix.org/docs/spec/client_server/r0.6.0#fallback).
+    #
+    #   This template has no additional variables.
+    #
+    # * HTML page shown after a user-interactive authentication session which
+    #   does not map correctly onto the expected user: 'sso_auth_bad_user.html'.
+    #
+    #   When rendering, this template is given the following variables:
+    #     * server_name: the homeserver's name.
+    #     * user_id_to_verify: the MXID of the user that we are trying to
+    #       validate.
+    #
+    # * HTML page shown during single sign-on if a deactivated user (according to Synapse's database)
+    #   attempts to login: 'sso_account_deactivated.html'.
+    #
+    #   This template has no additional variables.
+    #
+    # * HTML page to display to users if something goes wrong during the
+    #   OpenID Connect authentication process: 'sso_error.html'.
+    #
+    #   When rendering, this template is given two variables:
+    #     * error: the technical name of the error
+    #     * error_description: a human-readable message for the error
+    #
+    # You can see the default templates at:
+    # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
+    #
+    #template_dir: "res/templates"
+
+
+# JSON web token integration. The following settings can be used to make
+# Synapse JSON web tokens for authentication, instead of its internal
+# password database.
+#
+# Each JSON Web Token needs to contain a "sub" (subject) claim, which is
+# used as the localpart of the mxid.
+#
+# Additionally, the expiration time ("exp"), not before time ("nbf"),
+# and issued at ("iat") claims are validated if present.
+#
+# Note that this is a non-standard login type and client support is
+# expected to be non-existent.
+#
+# See https://github.com/matrix-org/synapse/blob/master/docs/jwt.md.
 #
 #jwt_config:
-#   enabled: true
-#   secret: "a secret"
-#   algorithm: "HS256"
+    # Uncomment the following to enable authorization using JSON web
+    # tokens. Defaults to false.
+    #
+    #enabled: true
+
+    # This is either the private shared secret or the public key used to
+    # decode the contents of the JSON web token.
+    #
+    # Required if 'enabled' is true.
+    #
+    #secret: "provided-by-your-issuer"
+
+    # The algorithm used to sign the JSON web token.
+    #
+    # Supported algorithms are listed at
+    # https://pyjwt.readthedocs.io/en/latest/algorithms.html
+    #
+    # Required if 'enabled' is true.
+    #
+    #algorithm: "provided-by-your-issuer"
+
+    # The issuer to validate the "iss" claim against.
+    #
+    # Optional, if provided the "iss" claim will be required and
+    # validated for all JSON web tokens.
+    #
+    #issuer: "provided-by-your-issuer"
+
+    # A list of audiences to validate the "aud" claim against.
+    #
+    # Optional, if provided the "aud" claim will be required and
+    # validated for all JSON web tokens.
+    #
+    # Note that if the "aud" claim is included in a JSON web token then
+    # validation will fail without configuring audiences.
+    #
+    #audiences:
+    #    - "provided-by-your-issuer"
 
 
 password_config:
@@ -1443,116 +2182,352 @@ password_config:
    #
    #pepper: "EVEN_MORE_SECRET"
 
+   # Define and enforce a password policy. Each parameter is optional.
+   # This is an implementation of MSC2000.
+   #
+   policy:
+      # Whether to enforce the password policy.
+      # Defaults to 'false'.
+      #
+      #enabled: true
+
+      # Minimum accepted length for a password.
+      # Defaults to 0.
+      #
+      #minimum_length: 15
+
+      # Whether a password must contain at least one digit.
+      # Defaults to 'false'.
+      #
+      #require_digit: true
+
+      # Whether a password must contain at least one symbol.
+      # A symbol is any character that's not a number or a letter.
+      # Defaults to 'false'.
+      #
+      #require_symbol: true
+
+      # Whether a password must contain at least one lowercase letter.
+      # Defaults to 'false'.
+      #
+      #require_lowercase: true
+
+      # Whether a password must contain at least one lowercase letter.
+      # Defaults to 'false'.
+      #
+      #require_uppercase: true
+
+ui_auth:
+    # The number of milliseconds to allow a user-interactive authentication
+    # session to be active.
+    #
+    # This defaults to 0, meaning the user is queried for their credentials
+    # before every action, but this can be overridden to alow a single
+    # validation to be re-used.  This weakens the protections afforded by
+    # the user-interactive authentication process, by allowing for multiple
+    # (and potentially different) operations to use the same validation session.
+    #
+    # Uncomment below to allow for credential validation to last for 15
+    # seconds.
+    #
+    #session_timeout: 15000
 
 
-# Enable sending emails for password resets, notification events or
-# account expiry notices
-#
-# If your SMTP server requires authentication, the optional smtp_user &
-# smtp_pass variables should be used
+# Configuration for sending emails from Synapse.
 #
 email:
-   enable_notifs: $ENABLE_NOTIFICATIONS
-   smtp_host: "$SMTP_HOST"
-   smtp_port: $SMTP_PORT # SSL: 465, STARTTLS: 587
-   smtp_user: "$SMTP_USER"
-   smtp_pass: $SMTP_PASS
-   require_transport_security: $SMTP_TLS
-   notif_from: "%(app)s <$SMTP_USER>"
-   app_name: Matrix
+  # The hostname of the outgoing SMTP server to use. Defaults to 'localhost'.
+  #
+  smtp_host: "${SMTP_HOST:?}"
 
-   # Enable email notifications by default
-   #
-   notif_for_new_users: $ENABLE_NOTIFICATIONS_BY_DEFAULT
+  # The port on the mail server for outgoing SMTP. Defaults to 25.
+  #
+  smtp_port: ${SMTP_PORT:?}
 
-   # Defining a custom URL for Riot is only needed if email notifications
-   # should contain links to a self-hosted installation of Riot; when set
-   # the "app_name" setting is ignored
-   #
-   riot_base_url: "$RIOT_BASE_URL"
+  # Username/password for authentication to the SMTP server. By default, no
+  # authentication is attempted.
+  #
+  smtp_user: "$SMTP_USER"
+  smtp_pass: "$SMTP_PASS"
 
-   # Configure the time that a validation email or text message code
-   # will expire after sending
-   #
-   # This is currently used for password resets
-   #
-   #validation_token_lifetime: 1h
+  # Uncomment the following to require TLS transport security for SMTP.
+  # By default, Synapse will connect over plain text, and will then switch to
+  # TLS via STARTTLS *if the SMTP server supports it*. If this option is set,
+  # Synapse will refuse to connect unless the server supports STARTTLS.
+  #
+  require_transport_security: ${SMTP_USE_STARTTLS:?}
 
-   # Template directory. All template files should be stored within this
-   # directory. If not set, default templates from within the Synapse
-   # package will be used
-   #
-   # For the list of default templates, please see
-   # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
-   #
-   #template_dir: res/templates
+  # notif_from defines the "From" address to use when sending emails.
+  # It must be set if email sending is enabled.
+  #
+  # The placeholder '%(app)s' will be replaced by the application name,
+  # which is normally 'app_name' (below), but may be overridden by the
+  # Matrix client application.
+  #
+  # Note that the placeholder must be written '%(app)s', including the
+  # trailing 's'.
+  #
+  notif_from: "${NOTIFICATION_FROM:?}"
 
-   # Templates for email notifications
-   #
-   notif_template_html: notif_mail.html
-   notif_template_text: notif_mail.txt
+  # app_name defines the default value for '%(app)s' in notif_from and email
+  # subjects. It defaults to 'Matrix'.
+  #
+  #app_name: my_branded_matrix_server
 
-   # Templates for account expiry notices
-   #
-   expiry_template_html: notice_expiry.html
-   expiry_template_text: notice_expiry.txt
+  # Uncomment the following to enable sending emails for messages that the user
+  # has missed. Disabled by default.
+  #
+  enable_notifs: ${ENABLE_NOTIFICATIONS:?}
 
-   # Templates for password reset emails sent by the homeserver
-   #
-   #password_reset_template_html: password_reset.html
-   #password_reset_template_text: password_reset.txt
+  # Uncomment the following to disable automatic subscription to email
+  # notifications for new users. Enabled by default.
+  #
+  #notif_for_new_users: false
 
-   # Templates for registration emails sent by the homeserver
-   #
-   #registration_template_html: registration.html
-   #registration_template_text: registration.txt
+  # Custom URL for client links within the email notifications. By default
+  # links will be based on "https://matrix.to".
+  #
+  # (This setting used to be called riot_base_url; the old name is still
+  # supported for backwards-compatibility but is now deprecated.)
+  #
+  client_base_url: "${WEB_CLIENT_URL:?}"
 
-   # Templates for validation emails sent by the homeserver when adding an email to
-   # your user account
-   #
-   #add_threepid_template_html: add_threepid.html
-   #add_threepid_template_text: add_threepid.txt
+  # Configure the time that a validation email will expire after sending.
+  # Defaults to 1h.
+  #
+  #validation_token_lifetime: 15m
 
-   # Templates for password reset success and failure pages that a user
-   # will see after attempting to reset their password
-   #
-   #password_reset_template_success_html: password_reset_success.html
-   #password_reset_template_failure_html: password_reset_failure.html
+  # The web client location to direct users to during an invite. This is passed
+  # to the identity server as the org.matrix.web_client_location key. Defaults
+  # to unset, giving no guidance to the identity server.
+  #
+  #invite_client_location: https://app.element.io
 
-   # Templates for registration success and failure pages that a user
-   # will see after attempting to register using an email or phone
-   #
-   #registration_template_success_html: registration_success.html
-   #registration_template_failure_html: registration_failure.html
+  # Directory in which Synapse will try to find the template files below.
+  # If not set, or the files named below are not found within the template
+  # directory, default templates from within the Synapse package will be used.
+  #
+  # Synapse will look for the following templates in this directory:
+  #
+  # * The contents of email notifications of missed events: 'notif_mail.html' and
+  #   'notif_mail.txt'.
+  #
+  # * The contents of account expiry notice emails: 'notice_expiry.html' and
+  #   'notice_expiry.txt'.
+  #
+  # * The contents of password reset emails sent by the homeserver:
+  #   'password_reset.html' and 'password_reset.txt'
+  #
+  # * An HTML page that a user will see when they follow the link in the password
+  #   reset email. The user will be asked to confirm the action before their
+  #   password is reset: 'password_reset_confirmation.html'
+  #
+  # * HTML pages for success and failure that a user will see when they confirm
+  #   the password reset flow using the page above: 'password_reset_success.html'
+  #   and 'password_reset_failure.html'
+  #
+  # * The contents of address verification emails sent during registration:
+  #   'registration.html' and 'registration.txt'
+  #
+  # * HTML pages for success and failure that a user will see when they follow
+  #   the link in an address verification email sent during registration:
+  #   'registration_success.html' and 'registration_failure.html'
+  #
+  # * The contents of address verification emails sent when an address is added
+  #   to a Matrix account: 'add_threepid.html' and 'add_threepid.txt'
+  #
+  # * HTML pages for success and failure that a user will see when they follow
+  #   the link in an address verification email sent when an address is added
+  #   to a Matrix account: 'add_threepid_success.html' and
+  #   'add_threepid_failure.html'
+  #
+  # You can see the default templates at:
+  # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
+  #
+  #template_dir: "res/templates"
 
-   # Templates for success and failure pages that a user will see after attempting
-   # to add an email or phone to their account
-   #
-   #add_threepid_success_html: add_threepid_success.html
-   #add_threepid_failure_html: add_threepid_failure.html
+  # Subjects to use when sending emails from Synapse.
+  #
+  # The placeholder '%(app)s' will be replaced with the value of the 'app_name'
+  # setting above, or by a value dictated by the Matrix client application.
+  #
+  # If a subject isn't overridden in this configuration file, the value used as
+  # its example will be used.
+  #
+  #subjects:
 
-$(generate_password_providers)
+    # Subjects for notification emails.
+    #
+    # On top of the '%(app)s' placeholder, these can use the following
+    # placeholders:
+    #
+    #   * '%(person)s', which will be replaced by the display name of the user(s)
+    #      that sent the message(s), e.g. "Alice and Bob".
+    #   * '%(room)s', which will be replaced by the name of the room the
+    #      message(s) have been sent to, e.g. "My super room".
+    #
+    # See the example provided for each setting to see which placeholder can be
+    # used and how to use them.
+    #
+    # Subject to use to notify about one message from one or more user(s) in a
+    # room which has a name.
+    #message_from_person_in_room: "[%(app)s] You have a message on %(app)s from %(person)s in the %(room)s room..."
+    #
+    # Subject to use to notify about one message from one or more user(s) in a
+    # room which doesn't have a name.
+    #message_from_person: "[%(app)s] You have a message on %(app)s from %(person)s..."
+    #
+    # Subject to use to notify about multiple messages from one or more users in
+    # a room which doesn't have a name.
+    #messages_from_person: "[%(app)s] You have messages on %(app)s from %(person)s..."
+    #
+    # Subject to use to notify about multiple messages in a room which has a
+    # name.
+    #messages_in_room: "[%(app)s] You have messages on %(app)s in the %(room)s room..."
+    #
+    # Subject to use to notify about multiple messages in multiple rooms.
+    #messages_in_room_and_others: "[%(app)s] You have messages on %(app)s in the %(room)s room and others..."
+    #
+    # Subject to use to notify about multiple messages from multiple persons in
+    # multiple rooms. This is similar to the setting above except it's used when
+    # the room in which the notification was triggered has no name.
+    #messages_from_person_and_others: "[%(app)s] You have messages on %(app)s from %(person)s and others..."
+    #
+    # Subject to use to notify about an invite to a room which has a name.
+    #invite_from_person_to_room: "[%(app)s] %(person)s has invited you to join the %(room)s room on %(app)s..."
+    #
+    # Subject to use to notify about an invite to a room which doesn't have a
+    # name.
+    #invite_from_person: "[%(app)s] %(person)s has invited you to chat on %(app)s..."
 
-# Clients requesting push notifications can either have the body of
-# the message sent in the notification poke along with other details
-# like the sender, or just the event ID and room ID (\`event_id_only\`).
-# If clients choose the former, this option controls whether the
-# notification request includes the content of the event (other details
-# like the sender are still included). For \`event_id_only\` push, it
-# has no effect.
+    # Subject for emails related to account administration.
+    #
+    # On top of the '%(app)s' placeholder, these one can use the
+    # '%(server_name)s' placeholder, which will be replaced by the value of the
+    # 'server_name' setting in your Synapse configuration.
+    #
+    # Subject to use when sending a password reset email.
+    #password_reset: "[%(server_name)s] Password reset"
+    #
+    # Subject to use when sending a verification email to assert an address's
+    # ownership.
+    #email_validation: "[%(server_name)s] Validate your email"
+
+
+# Password providers allow homeserver administrators to integrate
+# their Synapse installation with existing authentication methods
+# ex. LDAP, external tokens, etc.
 #
-# For modern android devices the notification content will still appear
-# because it is loaded by the app. iPhone, however will send a
-# notification saying only that a message arrived and who it came from.
+# For more information and known implementations, please see
+# https://github.com/matrix-org/synapse/blob/master/docs/password_auth_providers.md
 #
-#push:
-#  include_content: true
+# Note: instances wishing to use SAML or CAS authentication should
+# instead use the \`saml2_config\` or \`cas_config\` options,
+# respectively.
+#
+password_providers:
+#    # Example config for an LDAP auth provider
+#    - module: "ldap_auth_provider.LdapAuthProvider"
+#      config:
+#        enabled: true
+#        uri: "ldap://ldap.example.com:389"
+#        start_tls: true
+#        base: "ou=users,dc=example,dc=com"
+#        attributes:
+#           uid: "cn"
+#           mail: "email"
+#           name: "givenName"
+#        #bind_dn:
+#        #bind_password:
+#        #filter: "(objectClass=posixAccount)"
+EOF
+
+if [ -n "$ENABLE_LDAP_AUTH" ]; then
+	cat <<EOF
+  - module: "ldap_auth_provider.LdapAuthProvider"
+    config:
+      enabled: true
+      uri: "${LDAP_URI:?}"
+      start_tls: ${LDAP_USE_STARTTLS:?}
+      base: "${LDAP_BASE_DN:?}"
+      attributes:
+         uid: "${LDAP_UID_ATTRIBUTE:?}"
+         mail: "${LDAP_MAIL_ATTRIBUTE:?}"
+         name: "${LDAP_NAME_ATTRIBUTE:?}"
+      filter: "${LDAP_FILTER:?}"
+EOF
+	if [ -n "$LDAP_BIND_DN" ] && [ -n "$LDAP_BIND_PASSWORD" ]; then
+			cat <<EOF
+      mode: "search"
+      bind_dn: "${LDAP_BIND_DN:?}"
+      bind_password: "${LDAP_BIND_PASSWORD:?}"
+EOF
+	fi
+fi
+
+cat << EOF
+## Push ##
+
+push:
+  # Clients requesting push notifications can either have the body of
+  # the message sent in the notification poke along with other details
+  # like the sender, or just the event ID and room ID (\`event_id_only\`).
+  # If clients choose the former, this option controls whether the
+  # notification request includes the content of the event (other details
+  # like the sender are still included). For \`event_id_only\` push, it
+  # has no effect.
+  #
+  # For modern android devices the notification content will still appear
+  # because it is loaded by the app. iPhone, however will send a
+  # notification saying only that a message arrived and who it came from.
+  #
+  # The default value is "true" to include message details. Uncomment to only
+  # include the event ID and room ID in push notification payloads.
+  #
+  #include_content: false
+
+  # When a push notification is received, an unread count is also sent.
+  # This number can either be calculated as the number of unread messages
+  # for the user, or the number of *rooms* the user has unread messages in.
+  #
+  # The default value is "true", meaning push clients will see the number of
+  # rooms with unread messages in them. Uncomment to instead send the number
+  # of unread messages.
+  #
+  #group_unread_count_by_room: false
 
 
-#spam_checker:
-#  module: "my_custom_project.SuperSpamChecker"
-#  config:
-#    example_option: 'things'
+# Spam checkers are third-party modules that can block specific actions
+# of local users, such as creating rooms and registering undesirable
+# usernames, as well as remote users by redacting incoming events.
+#
+spam_checker:
+   #- module: "my_custom_project.SuperSpamChecker"
+   #  config:
+   #    example_option: 'things'
+   #- module: "some_other_project.BadEventStopper"
+   #  config:
+   #    example_stop_events_from: ['@bad:example.com']
+
+
+## Rooms ##
+
+# Controls whether locally-created rooms should be end-to-end encrypted by
+# default.
+#
+# Possible options are "all", "invite", and "off". They are defined as:
+#
+# * "all": any locally-created room
+# * "invite": any room created with the "private_chat" or "trusted_private_chat"
+#             room creation presets
+# * "off": this option will take no effect
+#
+# The default value is "off".
+#
+# Note that this option will only affect rooms created after it is set. It
+# will also not affect rooms created by other servers.
+#
+encryption_enabled_by_default_for_room_type: "${ROOM_ENCRYPTION_POLICY:?}"j
 
 
 # Uncomment to allow non-server-admin users to create groups on this server
@@ -1562,7 +2537,7 @@ $(generate_password_providers)
 # If enabled, non server admins can only create groups with local parts
 # starting with this prefix
 #
-#group_creation_prefix: "unofficial/"
+#group_creation_prefix: "unofficial_"
 
 
 
@@ -1578,9 +2553,9 @@ $(generate_password_providers)
 # rebuild the user_directory search indexes, see
 # https://github.com/matrix-org/synapse/blob/master/docs/user_directory.md
 #
-#user_directory:
-#  enabled: true
-#  search_all_users: false
+user_directory:
+  enabled: true
+  search_all_users: ${USER_DIRECTORY_SEARCH_ALL_USERS:?}
 
 
 # User Consent configuration
@@ -1662,10 +2637,25 @@ $(generate_password_providers)
 #
 # It's also possible to override the room name, the display name of the
 # "notices" user, and the avatar for the user.
+#
+#server_notices:
+#  system_mxid_localpart: notices
+#  system_mxid_display_name: "Server Notices"
+#  system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
+#  room_name: "Server Notices"
+EOF
 
-$(generate_server_notices)
-
+if [ -n "$ENABLE_SERVER_NOTICES" ]; then
+	cat << EOF
+server_notices:
+  system_mxid_localpart: notices
+  system_mxid_display_name: "Server Notices"
+  #system_mxid_avatar_url: "mxc://server.com/oumMVlgDnLYFaPVkExemNVVZ"
+  room_name: "Server Notices"
+EOF
+fi
 
+cat << EOF
 # Uncomment to disable searching the public room list. When disabled
 # blocks searching local and remote room lists for local and remote
 # users by always returning an empty list for all queries.
@@ -1715,7 +2705,7 @@ $(generate_server_notices)
 #
 # Options for the rules include:
 #
-#   user_id: Matches agaisnt the creator of the alias
+#   user_id: Matches against the creator of the alias
 #   room_id: Matches against the room ID being published
 #   alias: Matches against any current local or canonical aliases
 #            associated with the room
@@ -1752,16 +2742,16 @@ $(generate_server_notices)
 # (specifically those implemented with Jaeger).
 #
 opentracing:
-# tracing is disabled by default. Uncomment the following line to enable it.
-#
-#enabled: true
+    # tracing is disabled by default. Uncomment the following line to enable it.
+    #
+    #enabled: true
 
     # The list of homeservers we wish to send and receive span contexts and span baggage.
     # See docs/opentracing.rst
     # This is a list of regexes which are matched against the server_name of the
     # homeserver.
     #
-    # By defult, it is empty, so no servers are matched.
+    # By default, it is empty, so no servers are matched.
     #
     #homeserver_whitelist:
     #  - ".*"
@@ -1781,5 +2771,83 @@ opentracing:
     #
     #  logging:
     #    false
-    #
+
+
+## Workers ##
+
+# Disables sending of outbound federation transactions on the main process.
+# Uncomment if using a federation sender worker.
+#
+send_federation: ${SEND_FEDERATION_FROM_MAIN_PROCESS:?}
+
+# It is possible to run multiple federation sender workers, in which case the
+# work is balanced across them.
+#
+# This configuration must be shared between all federation sender workers, and if
+# changed all federation sender workers must be stopped at the same time and then
+# started, to ensure that all instances are running with the same config (otherwise
+# events may be dropped).
+#
+#federation_sender_instances:
+#  - federation_sender1
+EOF
+
+if [ -n "$FEDERATION_SENDER_INSTANCES" ]; then
+	echo "federation_sender_instances:"
+	for instance in $FEDERATION_SENDER_INSTANCES; do
+		echo "  - $instance"
+	done
+fi
+
+cat << EOF
+# When using workers this should be a map from \`worker_name\` to the
+# HTTP replication listener of the worker, if configured.
+#
+#instance_map:
+#  worker1:
+#    host: localhost
+#    port: 8034
+
+# Experimental: When using workers you can define which workers should
+# handle event persistence and typing notifications. Any worker
+# specified here must also be in the \`instance_map\`.
+#
+#stream_writers:
+#  events: worker1
+#  typing: worker1
+
+# The worker that is used to run background tasks (e.g. cleaning up expired
+# data). If not provided this defaults to the main process.
+#
+EOF
+
+if [ -n "$RUN_BACKGROUND_TASKS_ON" ]; then
+	echo "run_background_tasks_on: ${RUN_BACKGROUND_TASKS_ON:?}"
+fi
+
+cat << EOF
+# A shared secret used by the replication APIs to authenticate HTTP requests
+# from workers.
+#
+# By default this is unused and traffic is not authenticated.
+#
+worker_replication_secret: "$WORKER_REPLICATION_SECRET"
+
+
+# Configuration for Redis when using workers. This *must* be enabled when
+# using workers (unless using old style direct TCP configuration).
+#
+redis:
+  # Uncomment the below to enable Redis support.
+  #
+  enabled: ${ENABLE_REDIS_SUPPORT:?}
+
+  # Optional host and port to use to connect to redis. Defaults to
+  # localhost and 6379
+  #
+  #host: localhost
+  #port: 6379
+
+  # Optional password if configured on the Redis instance
+  #
 EOF
diff --git a/type/__matrix_synapse/files/log.config.sh b/type/__matrix_synapse/files/log.config.sh
index 2a9a9dd..5eaf594 100755
--- a/type/__matrix_synapse/files/log.config.sh
+++ b/type/__matrix_synapse/files/log.config.sh
@@ -1,60 +1,79 @@
 #!/bin/sh
 
 cat << EOF
+###############################################################
+# THIS FILE HAS BEEN GENERATED BY CDIST. DO NOT EDIT BY HAND. #
+###############################################################
+
+# Log configuration for Synapse.
+#
+# This is a YAML file containing a standard Python logging configuration
+# dictionary. See [1] for details on the valid settings.
+#
+# Synapse also supports structured logging for machine readable logs which can
+# be ingested by ELK stacks. See [2] for details.
+#
+# [1]: https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+# [2]: https://github.com/matrix-org/synapse/blob/master/docs/structured_logging.md
 
 version: 1
 
 formatters:
-  precise:
-   format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
-  journal_fmt:
-   format: '%(name)s: [%(request)s] %(message)s'
-
-filters:
-  context:
-    (): synapse.util.logcontext.LoggingContextFilter
-    request: ""
+    precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
 
 handlers:
-  file:
-    class: logging.handlers.WatchedFileHandler
-    formatter: precise
-    filename: $LOG_DIR/homeserver.log
-    filters: [context]
-    level: DEBUG
-    encoding: utf8
-  console:
-    class: logging.StreamHandler
-    formatter: precise
-    level: WARN
-  journal:
-    class: systemd.journal.JournalHandler
-    formatter: journal_fmt
-    filters: [context]
-    SYSLOG_IDENTIFIER: synapse
+    file:
+        class: logging.handlers.TimedRotatingFileHandler
+        formatter: precise
+        filename: ${LOG_DIR:?}/homeserver.log
+        when: midnight
+        backupCount: 3  # Does not include the current log file.
+        encoding: utf8
+
+    # Default to buffering writes to log file for efficiency. This means that
+    # will be a delay for INFO/DEBUG logs to get written, but WARNING/ERROR
+    # logs will still be flushed immediately.
+    buffer:
+        class: logging.handlers.MemoryHandler
+        target: file
+        # The capacity is the number of log lines that are buffered before
+        # being written to disk. Increasing this will lead to better
+        # performance, at the expensive of it taking longer for log lines to
+        # be written to disk.
+        capacity: 10
+        flushLevel: 30  # Flush for WARNING logs as well
+
+    # A handler that writes logs to stderr. Unused by default, but can be used
+    # instead of "buffer" and "file" in the logger handlers.
+    console:
+        class: logging.StreamHandler
+        formatter: precise
 
 loggers:
-    twisted:
-        level: WARN
-
-    synapse:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
         level: INFO
 
-    # the following levels are more verbose than most users want
-    # set them to INFO if you need more logging
-    synapse.metrics:
-        level: WARN
-
-    synapse.http.federation.well_known_resolver:
-        level: WARN
-
-    synapse.storage.TIME:
-        level: WARN
-
-    synapse.http.matrixfederationclient:
-        level: WARN
+    twisted:
+        # We send the twisted logging directly to the file handler,
+        # to work around https://github.com/matrix-org/synapse/issues/3471
+        # when using "buffer" logger. Use "console" to log to stderr instead.
+        handlers: [file]
+        propagate: false
 
 root:
     level: INFO
-    handlers: [file, journal]
+
+    # Write logs to the \`buffer\` handler, which will buffer them together in memory,
+    # then write them to a file.
+    #
+    # Replace "buffer" with "console" to log to stderr instead. (Note that you'll
+    # also need to update the configuration for the \`twisted\` logger above, in
+    # this case.)
+    #
+    handlers: [buffer]
+
+disable_existing_loggers: false
 EOF
diff --git a/type/__matrix_synapse/gencode-remote b/type/__matrix_synapse/gencode-remote
new file mode 100755
index 0000000..65ff56c
--- /dev/null
+++ b/type/__matrix_synapse/gencode-remote
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+os=$(cat "$__global/explorer/os")
+init=$(cat "$__global/explorer/init")
+
+case "$os" in
+	alpine)
+		synapse_conf_dir=/etc/synapse
+		synapse_service=matrix-synapse
+		;;
+	debian)
+		synapse_conf_dir=/etc/matrix-synapse
+		synapse_service=synapse
+		;;
+	*)
+		echo "Unknown OS $os." >&2
+		exit 1
+	;;
+esac
+
+if grep -qE "^__file/$synapse_conf_dir" "${__messages_in}"; then
+	case "$init" in
+		systemd)
+			echo "systemctl try-reload-or-restart $synapse_service"
+			;;
+		initd)
+			echo "service --ifstopped $synapse_service start"
+			echo "service --ifstarted $synapse_service restart"
+			;;
+		*)
+			echo "Unknown init $init." >&2
+			exit 1
+			;;
+	esac
+fi
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 96795e7..1f01ca9 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -23,109 +23,161 @@ os=$(cat "$__global/explorer/os")
 distribution=$(cat "$__global/explorer/lsb_codename")
 
 case "$os" in
-   debian)
-     synapse_user=matrix-synapse
-     synapse_pkg=matrix-synapse
-     synapse_service=matrix-synapse
-     ldap_auth_provider_pkg=matrix-synapse-ldap3
-     psycopg2_pkg=python3-psycopg2
-     synapse_conf_dir='/etc/matrix-synapse'
-     synapse_data_dir='/var/lib/matrix-synapse'
+	debian)
+		synapse_user=matrix-synapse
+		synapse_pkg=matrix-synapse
+		synapse_service=matrix-synapse
+		ldap_auth_provider_pkg=matrix-synapse-ldap3
+		synapse_conf_dir='/etc/matrix-synapse'
+		synapse_data_dir='/var/lib/matrix-synapse'
 
-     if [ ! -f "$__global/explorer/lsb_codename" ]; then
-       ls "$__global/explorer" >&2
-       echo "Could not determine Debian release, ensure that lsb-release is installed on the target." >&2
-       exit 1
-     fi
-     ;;
-   fedora)
-     synapse_user=synapse
-     synapse_pkg=matrix-synapse
-     synapse_service=synapse
-     ldap_auth_provider_pkg=python-matrix-synapse-ldap3
-     synapse_conf_dir='/etc/synapse'
-     synapse_data_dir='/var/lib/synapse'
-     ;;
-   freebsd)
-     synapse_user=synapse
-     synapse_pkg=py36-matrix-synapse
-     synapse_service=synapse
-     ldap_auth_provider_pkg=py36-matrix-synapse-ldap3
-     synapse_conf_dir='/usr/local/etc/matrix-synapse'
-     synapse_data_dir='/var/matrix-synapse'
-     ;;
-   alpine)
-     echo "As of 2019-12-19  matrix-synapse is not in alpine stable. Exiting."
-     exit 1
-     ;;
-   *)
-      printf "Your operating system (%s) is currently not supported by this type (%s)\n" "$os" "${__type##*/}" >&2
-      printf "Please contribute an implementation for it if you can.\n" >&2
-      exit 1
-   ;;
+		# See https://packages.debian.org/bullseye/matrix-synapse for state of
+		# synapse packaging in debian.
+		case "$distribution" in
+			stretch)
+				echo "The matrix-synapse package in debian stretch is outdated and unusable." >&2
+				exit 1
+				;;
+			buster)
+				# Enable debian-backports for debian Buster, as the 'stable'
+				# matrix-synapse package is ways too old (< 1.0).
+				apt_target_release=buster-backports
+				__apt_source debian-backports \
+					--uri http://deb.debian.org/debian/ \
+					--distribution "$apt_target_release" \
+					--component main
+				;;
+				bullseye|sid)
+					# As of writting (2021-02), the default matrix-synapse of those
+					# release is perfectly usable.
+					:
+				;;
+				*)
+					echo "Unknown debian release '$distribution'. Exiting" >&2
+					exit 1
+				;;
+		esac
+		;;
+	alpine)
+		synapse_user=synapse
+		synapse_pkg=synapse
+		synapse_service=synapse
+		# Note available as of writing (2021-02-15)
+		ldap_auth_provider_pkg=
+		synapse_conf_dir='/etc/synapse'
+		synapse_data_dir='/var/lib/synapse'
+		;;
+	*)
+		printf "Your operating system (%s) is currently not supported by this type (%s)\n" "$os" "${__type##*/}" >&2
+		printf "Please contribute an implementation for it if you can.\n" >&2
+		exit 1
+		;;
 esac
 
-# Required parameters:
-SERVER_NAME=$(cat "$__object/parameter/server-name")
-export SERVER_NAME
-BASE_URL=$(cat "$__object/parameter/base-url")
-export BASE_URL
+# Small helper used to get boolean values which can be used as-is in the
+# configuration template.
+get_boolean_for () {
+	if [ -f "$__object/parameter/${1:?}" ]; then
+		echo 'true'
+	else
+		echo 'false'
+	fi
+}
 
+# Small helper for erroring out on invalid combinations.
+is_required_when () {
+	value=$1
+	flag=$2
+	when=$3
+
+	if [ -z "$value" ]; then
+		echo "$flag is required when $when." >&2
+		exit 1
+	fi
+}
+
+# Generic configuration.
 export DATA_DIR=$synapse_data_dir
 export LOG_DIR='/var/log/matrix-synapse'
 export PIDFILE='/var/run/matrix/homeserver.pid'
 export LOG_CONFIG_PATH="$synapse_conf_dir/log.yaml"
 export SIGNING_KEY_PATH="$synapse_conf_dir/signin.key"
 
-DATABASE_ENGINE=$(cat "$__object/parameter/database-engine")
-export DATABASE_ENGINE
-DATABASE_NAME=$(cat "$__object/parameter/database-name")
-export DATABASE_NAME
+# Base parameters.
+SERVER_NAME=$(cat "$__object/parameter/server-name")
+BASE_URL=$(cat "$__object/parameter/base-url")
+REPORT_STATS=$(get_boolean_for 'report-stats')
+MAX_UPLOAD_SIZE=$(cat "$__object/parameter/max-upload-size")
+EXPOSE_METRICS=$(get_boolean_for 'expose-metrics')
+WEB_CLIENT_URL=$(cat "$__object/parameter/web-client-url")
+ROOM_ENCRYPTION_POLICY=$(cat "$__object/parameter/room-encryption-policy")
+export SERVER_NAME BASE_URL REPORT_STATS MAX_UPLOAD_SIZE EXPOSE_METRICS \
+	WEB_CLIENT_URL ROOM_ENCRYPTION_POLICY
 
-# Optional parameters:
-DATABASE_HOST=$(cat "$__object/parameter/database-host")
-export DATABASE_HOST
-DATABASE_USER=$(cat "$__object/parameter/database-user")
-export DATABASE_USER
-DATABASE_PASSWORD=$(cat "$__object/parameter/database-password")
-export DATABASE_PASSWORD
+if [ -f "$__object/parameter/enable-server-notices" ]; then
+    export ENABLE_SERVER_NOTICES=1
+fi
 
+# Performance flags.
 GLOBAL_CACHE_FACTOR=$(cat "$__object/parameter/global-cache-factor")
-export GLOBAL_CACHE_FACTOR
 EVENT_CACHE_SIZE=$(cat "$__object/parameter/event-cache-size")
-export EVENT_CACHE_SIZE
+export GLOBAL_CACHE_FACTOR EVENT_CACHE_SIZE
 
+if [ -f "$__object/parameter/disable-presence" ]; then
+	export USE_PRESENCE='false'
+else
+	export USE_PRESENCE='true'
+fi
+
+# Database configuration.
+DATABASE_ENGINE=$(cat "$__object/parameter/database-engine")
+DATABASE_NAME=$(cat "$__object/parameter/database-name")
+DATABASE_HOST=$(cat "$__object/parameter/database-host")
+DATABASE_USER=$(cat "$__object/parameter/database-user")
+DATABASE_PASSWORD=$(cat "$__object/parameter/database-password")
+export DATABASE_ENGINE DATABASE_NAME DATABASE_HOST DATABASE_USER \
+	DATABASE_PASSWORD
+
+# LDAP-based authentication.
+ENABLE_LDAP_AUTH=$(get_boolean_for 'enable-ldap-auth')
 LDAP_FILTER=$(cat "$__object/parameter/ldap-filter")
-export LDAP_FILTER
 LDAP_UID_ATTRIBUTE=$(cat "$__object/parameter/ldap-uid-attribute")
-export LDAP_UID_ATTRIBUTE
 LDAP_MAIL_ATTRIBUTE=$(cat "$__object/parameter/ldap-mail-attribute")
-export LDAP_MAIL_ATTRIBUTE
 LDAP_NAME_ATTRIBUTE=$(cat "$__object/parameter/ldap-name-attribute")
-export LDAP_NAME_ATTRIBUTE
 LDAP_URI=$(cat "$__object/parameter/ldap-uri")
-export LDAP_URI
 LDAP_BASE_DN=$(cat "$__object/parameter/ldap-base-dn")
-export LDAP_BASE_DN
 LDAP_BIND_DN=$(cat "$__object/parameter/ldap-bind-dn")
-export LDAP_BIND_DN
 LDAP_BIND_PASSWORD=$(cat "$__object/parameter/ldap-bind-password")
-export LDAP_BIND_PASSWORD
+LDAP_USE_STARTTLS=$(get_boolean_for 'ldap-use-starttls')
+export ENABLE_LDAP_AUTH LDAP_FILTER LDAP_UID_ATTRIBUTE LDAP_MAIL_ATTRIBUTE \
+	LDAP_NAME_ATTRIBUTE LDAP_URI LDAP_BASE_DN LDAP_BIND_DN LDAP_BIND_PASSWORD \
+	LDAP_USE_STARTTLS
 
-TURN_USER_LIFETIME=$(cat "$__object/parameter/turn-user-lifetime")
-export TURN_USER_LIFETIME
-if [ -f "$__object/parameter/turn-shared-secret" ]; then
-    TURN_SHARED_SECRET=$(cat "$__object/parameter/turn-shared-secret")
-    export TURN_SHARED_SECRET
-fi
-if [ -f "$__object/parameter/turn-uri" ]; then
-    uris=$(tr "\n" "," < "$__object/parameter/turn-uri" | sed 's/,$//')
-    export TURN_URIS="[$uris]"
+# Outgoing emails (= notifications).
+ENABLE_NOTIFICATIONS=$(get_boolean_for 'enable-notifications')
+SMTP_HOST=$(cat "$__object/parameter/smtp-host")
+SMTP_PORT=$(cat "$__object/parameter/smtp-port")
+SMTP_USE_STARTTLS=$(get_boolean_for 'smtp-use-starttls')
+SMTP_USER=$(cat "$__object/parameter/smtp-user")
+SMTP_PASSWORD=$(cat "$__object/parameter/smtp-password")
+export SMTP_HOST SMTP_PORT SMTP_USER SMTP_PASSWORD SMTP_USE_STARTTLS \
+	ENABLE_NOTIFICATIONS
+
+if [ -f "$__object/parameter/notification-from" ]; then
+	NOTIFICATION_FROM=$(cat "$__object/parameter/notification-from")
+	export NOTIFICATION_FROM
+else
+	export NOTIFICATION_FROM="Matrix <no-reply@$SERVER_NAME>"
 fi
 
-if [ -f "$__object/parameter/registration-allows-email-pattern" ]; then
-    RESGISTRATION_ALLOWS_EMAIL_PATTERN=$(cat "$__object/parameter/registration-allows-email-pattern")
-    export RESGISTRATION_ALLOWS_EMAIL_PATTERN
+# Registrations and users.
+ALLOW_GUEST_ACCESS=$(get_boolean_for 'allow-guest-access')
+ENABLE_REGISTRATIONS=$(get_boolean_for 'enable-registrations')
+USER_DIRECTORY_SEARCH_ALL_USERS=$(get_boolean_for 'user-directory-search-all-users')
+export ALLOW_GUEST_ACCESS ENABLE_REGISTRATIONS USER_DIRECTORY_SEARCH_ALL_USERS
+
+if [ -f "$__object/parameter/registration-requires-email" ]; then
+    export REGISTRATION_REQUIRES_EMAIL=1
 fi
 
 if [ -f "$__object/parameter/auto-join-room" ]; then
@@ -133,153 +185,109 @@ if [ -f "$__object/parameter/auto-join-room" ]; then
     export AUTO_JOIN_ROOMS
 fi
 
-if [ -f "$__object/parameter/app-service-config-file" ]; then
-    APP_SERVICE_CONFIG_FILES=$(cat "$__object/parameter/app-service-config-file")
-    export APP_SERVICE_CONFIG_FILES
+if [ -f "$__object/parameter/registration-allows-email-pattern" ]; then
+    RESGISTRATION_ALLOWS_EMAIL_PATTERN=$(cat "$__object/parameter/registration-allows-email-pattern")
+    export RESGISTRATION_ALLOWS_EMAIL_PATTERN
 fi
 
-MAX_UPLOAD_SIZE=$(cat "$__object/parameter/max-upload-size")
-export MAX_UPLOAD_SIZE
-RIOT_BASE_URL=$(cat "$__object/parameter/riot-base-url")
-export RIOT_BASE_URL
+# Federation.
+DISABLE_FEDERATION=$(get_boolean_for 'disable-federation')
+ALLOW_PUBLIC_ROOMS_OVER_FEDERATION=$(get_boolean_for 'allow-public-room-over-federation')
+ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH=$(get_boolean_for 'allow-public-rooms-without-auth')
+LIMIT_REMOTE_ROOM_COMPLEXITY=$(get_boolean_for 'limit-remote-room-complexity')
+REMOTE_ROOM_COMPLEXITY_TRESHOLD=$(cat "$__object/parameter/remote-room-complexity-treshold")
+export DISABLE_FEDERATION ALLOW_PUBLIC_ROOMS_OVER_FEDERATION \
+	ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH LIMIT_REMOTE_ROOM_COMPLEXITY \
+	REMOTE_ROOM_COMPLEXITY_TRESHOLD
 
-SMTP_HOST=$(cat "$__object/parameter/smtp-host")
-export SMTP_HOST
-SMTP_PORT=$(cat "$__object/parameter/smtp-port")
-export SMTP_PORT
-SMTP_USER=$(cat "$__object/parameter/smtp-user")
-export SMTP_USER
-SMTP_PASS=$(cat "$__object/parameter/smtp-pass")
-export SMTP_PASS
+# Message retention.
+ENABLE_MESSAGE_RETENTION_POLICY=$(get_boolean_for 'enable-message-retention-policy')
+MESSAGE_RETENTION_POLICY_MAX_LIFETIME=$(cat "$__object/parameter/message-max-lifetime")
+export ENABLE_MESSAGE_RETENTION_POLICY MESSAGE_RETENTION_POLICY_MAX_LIFETIME
 
+# Rate-limiting
 RC_MESSAGE_PER_SECOND=$(cat "$__object/parameter/rc-message-per-second")
-export RC_MESSAGE_PER_SECOND
-RC_MESSAGE_BURST=$(cat "$__object/parameter/rc_message_burst")
-export RC_MESSAGE_BURST
+RC_MESSAGE_BURST=$(cat "$__object/parameter/rc-message-burst")
 RC_LOGIN_PER_SECOND=$(cat "$__object/parameter/rc-login-per-second")
-export RC_LOGIN_PER_SECOND
 RC_LOGIN_BURST=$(cat "$__object/parameter/rc-login-burst")
-export RC_LOGIN_BURST
+export RC_MESSAGE_PER_SECOND RC_MESSAGE_BURST RC_LOGIN_PER_SECOND \
+	RC_LOGIN_BURST
 
+# Application services.
+if [ -f "$__object/parameter/app-service-config-file" ]; then
+	APP_SERVICE_CONFIG_FILES=$(cat "$__object/parameter/app-service-config-file")
+	export APP_SERVICE_CONFIG_FILES
+fi
+
+# Anything that did not fit in this type's template.
 if [ -f "$__object/parameter/extra-setting" ]; then
-    EXTRA_SETTINGS=$(cat "$__object/parameter/extra-setting")
-    export EXTRA_SETTINGS
+	EXTRA_SETTINGS=$(cat "$__object/parameter/extra-setting")
+	export EXTRA_SETTINGS
 fi
 
-# Boolean parameters:
-if [ -f "$__object/parameter/report-stats" ]; then
-    export REPORT_STATS='true'
-else
-    export REPORT_STATS='false'
-fi
-if [ -f "$__object/parameter/allow-registration" ]; then
-    export ALLOW_REGISTRATION='true'
-else
-    export ALLOW_REGISTRATION='false'
-fi
-if [ -f "$__object/parameter/enable-ldap-auth" ]; then
-    export ENABLE_LDAP_AUTH='true'
-else
-    export ENABLE_LDAP_AUTH='false'
-fi
-if [ -f "$__object/parameter/ldap-search-mode" ]; then
-    export LDAP_SEARCH_MODE=1
-fi
-if [ -f "$__object/parameter/expose-metrics" ]; then
-    export EXPOSE_METRICS='true'
-else
-    export EXPOSE_METRICS='false'
-fi
-if [ -f "$__object/parameter/enable-notifications" ]; then
-    export ENABLE_NOTIFICATIONS='true'
-else
-    export ENABLE_NOTIFICATIONS='false'
-fi
-if [ -f "$__object/parameter/enable_notifications-by-default" ]; then
-    export ENABLE_NOTIFICATIONS_BY_DEFAULT='true'
-else
-    export ENABLE_NOTIFICATIONS_BY_DEFAULT='false'
-fi
-if [ -f "$__object/parameter/smtp-requires-tls" ]; then
-    export SMTP_TLS='true'
-else
-    export SMTP_TLS='false'
-fi
-if [ -f "$__object/parameter/disable-federation" ]; then
-    export DISABLE_FEDERATION='true'
-else
-    export DISABLE_FEDERATION='false'
-fi
-if [ -f "$__object/parameter/allow-guest-access" ]; then
-    export ALLOW_GUEST_ACCESS='true'
-else
-    export ALLOW_GUEST_ACCESS='false'
-fi
-if [ -f "$__object/parameter/registration-requires-email" ]; then
-    export REGISTRATION_REQUIRES_EMAIL=1
-fi
-if [ -f "$__object/parameter/allow-public-rooms-over-federation" ]; then
-    export ALLOW_PUBLIC_ROOMS_OVER_FEDERATION='true'
-else
-    export ALLOW_PUBLIC_ROOMS_OVER_FEDERATION='false'
-fi
-if [ -f "$__object/parameter/allow-public-rooms-without-auth" ]; then
-    export ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH='true'
-else
-    export ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH='false'
-fi
-if [ -f "$__object/parameter/enable-server-notices" ]; then
-    export ENABLE_SERVER_NOTICES=1
+# TURN server (NAT traversal for P2P calls).
+TURN_USER_LIFETIME=$(cat "$__object/parameter/turn-user-lifetime")
+export TURN_USER_LIFETIME
+
+if [ -f "$__object/parameter/turn-shared-secret" ]; then
+	TURN_SHARED_SECRET=$(cat "$__object/parameter/turn-shared-secret")
+	export TURN_SHARED_SECRET
 fi
 
-# Specific case for debian-buster, boilerplate but there's not much I can do
-# about it.
+if [ -f "$__object/parameter/turn-uri" ]; then
+	TURN_URIS=$(cat "$__object/parameter/turn-uri")
+	export TURN_URIS
+fi
 
-installation_reqs=""
-if [ "$os" = "debian" ] && [ "$distribution" = "buster" ]; then
-  # Enable debian-backports for debian Buster, as the 'stable'
-  # matrix-synapse package is ways too old (< 1.0).
-  __apt_source debian-backports \
-    --uri http://deb.debian.org/debian/ \
-    --distribution "$distribution-backports" \
-    --component main
-   require="__apt_source/debian-backports" __apt_update_index
+# Worker-mode configuration.
+export MAIN_LISTENER_PORT=8008
+export ENABLE_MEDIA_REPO='true'
+export SEND_FEDERATION_FROM_MAIN_PROCESS='true'
+export RUN_BACKGROUND_TASKS_ON=
+export ENABLE_REPLICATION=
+export ENABLE_REDIS_SUPPORT='false'
+MAIN_LISTENER_RESOURCES="[federation,client]"
+if [ "$EXPOSE_METRICS" = "true" ]; then
+	MAIN_LISTENER_RESOURCES="$(echo "$MAIN_LISTENER_RESOURCES" | tr -d ']'),metrics]"
+fi
+export MAIN_LISTENER_RESOURCES
 
-  # Install base matrix-synapse package.
-  require="__apt_update_index" __package_apt $synapse_pkg \
-    --state present \
-    --target-release "$distribution-backports"
+# Error out on invalid parameter combination.
+case "$DATABASE_ENGINE" in
+	sqlite3)
+		:
+	;;
+	psycopg2)
+		when='database engine is psycopg2'
+		is_required_when "$DATABASE_HOST" '--database-host' "$when"
+		is_required_when "$DATABASE_USER" '--database-user' "$when"
+	;;
+	*)
+		echo "Invalid database engine: $DATABASE_ENGINE." >&2
+		exit 1
+	;;
+esac
 
-  # Install LdapAuthProvider module if LDAP auth is enabled.
-  if [ "$ENABLE_LDAP_AUTH" = "true" ]; then
-    require="__package_apt/$synapse_pkg" __package_apt $ldap_auth_provider_pkg \
-      --state present \
-      --target-release "$distribution-backports"
-    installation_reqs="$installation_reqs __package_apt/$ldap_auth_provider_pkg"
-  fi
 
-  # For some reason, psycopg2 is not considered a dependency of
-  # matrix-synapse in matrix.org's APT repository.
-  if [ "$DATABASE_ENGINE" = "psycopg2" ]; then
-    require="__package_apt/$synapse_pkg" __package_apt $psycopg2_pkg \
-      --state present
-      installation_reqs="$installation_reqs __package_apt/$psycopg2_pkg"
-  fi
-
-  # Used for dependency order resolution.
-  installation_reqs="$installation_reqs __package_apt/$synapse_pkg"
+# Install OS packages. We have a bit of boilerplate to handle the debian
+# backports situation.
+synapse_req=
+if [ -n "$apt_target_release" ]; then
+	__package_apt "$synapse_pkg" \
+		--target-release "$apt_target_release"
+	synapse_req="__package_apt/$synapse_pkg"
 else
-  # Install base matrix-synapse package.
-  __package $synapse_pkg --state present
+	__package "$synapse_pkg"
+	synapse_req="__package/$synapse_pkg"
+fi
 
-  # Install LdapAuthProvider module if LDAP auth is enabled.
-  if [ "$ENABLE_LDAP_AUTH" = "true" ]; then
-    require="__package/$synapse_pkg" __package $ldap_auth_provider_pkg \
-      --state present
-  fi
-
-  # Used for dependency order resolution.
-  installation_reqs="__package/$synapse_pkg"
+if [ "$ENABLE_LDAP_AUTH" = "true" ]; then
+	if [ -n "$apt_target_release" ]; then
+		require="__package_apt/$synapse_pkg" __package_apt "$ldap_auth_provider_pkg" \
+			--target-release "$apt_target_release"
+		else
+			__package "$ldap_auth_provider_pkg"
+	fi
 fi
 
 # Generate and deploy configuration files.
@@ -287,34 +295,35 @@ mkdir -p "$__object/files"
 "$__type/files/homeserver.yaml.sh" > "$__object/files/homeserver.yaml"
 "$__type/files/log.config.sh" > "$__object/files/log.config"
 
-require="$installation_reqs" __file "$synapse_conf_dir/homeserver.yaml" \
-  --state present \
+require="$synapse_req" __file "$synapse_conf_dir/homeserver.yaml" \
   --owner $synapse_user \
   --mode 600 \
   --source "$__object/files/homeserver.yaml"
-require="$installation_reqs" __file "$LOG_CONFIG_PATH" \
-  --state present \
+require="$synapse_req" __file "$LOG_CONFIG_PATH" \
   --owner $synapse_user \
   --mode 600 \
   --source "$__object/files/log.config"
-require="$installation_reqs" __directory $DATA_DIR --state present --owner $synapse_user
-require="$installation_reqs" __directory $LOG_DIR --state present --owner $synapse_user
 
-# Work around dpkg-reconfigure for Debian package.
-RESTART_REQUIRES="__file/$synapse_conf_dir/homeserver.yaml"
+for directory in $DATA_DIR $LOG_DIR; do
+	require="$synapse_req" __directory $directory \
+		--state present \
+		--owner $synapse_user
+done
+
+# Make dpkg-reconfigure happy on debian systems.
 if [ "$os" = "debian" ]; then
-  require="$installation_reqs" __file "$synapse_conf_dir/conf.d/server_name.yaml" \
-    --state present --owner $synapse_user --source - << EOF
-server_name: "$SERVER_NAME"
-EOF
-  require="$installation_reqs" __file "$synapse_conf_dir/conf.d/report_stats.yaml" \
-    --state present --owner $synapse_user --source - << EOF
-report_stats: $REPORT_STATS
-EOF
+	require="$synapse_req" __file "$synapse_conf_dir/conf.d/server_name.yaml" \
+		--owner $synapse_user \
+		--source - <<- EOF
+		server_name: "$SERVER_NAME"
+		EOF
 
-  RESTART_REQUIRES="$RESTART_REQUIRES __file/$synapse_conf_dir/conf.d/server_name.yaml \
-      __file/$synapse_conf_dir/conf.d/report_stats.yaml"
+	require="$synapse_req" __file "$synapse_conf_dir/conf.d/report_stats.yaml" \
+		--owner $synapse_user \
+		--source - <<- EOF
+		report_stats: $REPORT_STATS
+		EOF
 fi
 
-# Restart synapse homeserver to reload configuration.
-require="$RESTART_REQUIRES" __service $synapse_service --action restart
+# Start service at boot - started/reload in gencode-remote.
+require="$synapse_req" __start_on_boot $synapse_service
diff --git a/type/__matrix_synapse/parameter/boolean b/type/__matrix_synapse/parameter/boolean
index 62905a5..809bf63 100644
--- a/type/__matrix_synapse/parameter/boolean
+++ b/type/__matrix_synapse/parameter/boolean
@@ -1,14 +1,18 @@
 allow-registration
 enable-ldap-auth
-ldap-search-mode
 report-stats
 expose-metrics
 enable-notifications
 enable-notifications-by-default
-smtp-requires-tls
+smtp-use-starttls
 disable-federation
 registration-requires-email
 allow-public-rooms-over-federation
 enable-server-notices
 allow-guest-access
 allow-public-rooms-without-auth
+limit-remote-room-complexity
+disable-presence
+ldap-use-starttls
+user-directory-search-all-users
+enable-message-retention-policy
diff --git a/type/__matrix_synapse/parameter/default/message-max-lifetime b/type/__matrix_synapse/parameter/default/message-max-lifetime
new file mode 100644
index 0000000..4730191
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/message-max-lifetime
@@ -0,0 +1 @@
+1y
diff --git a/type/__matrix_synapse/parameter/default/remote-room-complexity-treshold b/type/__matrix_synapse/parameter/default/remote-room-complexity-treshold
new file mode 100644
index 0000000..d3827e7
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/remote-room-complexity-treshold
@@ -0,0 +1 @@
+1.0
diff --git a/type/__matrix_synapse/parameter/default/room-encryption-policy b/type/__matrix_synapse/parameter/default/room-encryption-policy
new file mode 100644
index 0000000..cfb931e
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/room-encryption-policy
@@ -0,0 +1 @@
+off
diff --git a/type/__matrix_synapse/parameter/default/smtp-pass b/type/__matrix_synapse/parameter/default/smtp-password
similarity index 100%
rename from type/__matrix_synapse/parameter/default/smtp-pass
rename to type/__matrix_synapse/parameter/default/smtp-password
diff --git a/type/__matrix_synapse/parameter/default/web-client-url b/type/__matrix_synapse/parameter/default/web-client-url
new file mode 100644
index 0000000..4ed1053
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/web-client-url
@@ -0,0 +1 @@
+https://app.element.io/
diff --git a/type/__matrix_synapse/parameter/optional b/type/__matrix_synapse/parameter/optional
index 529c06a..73a7dfa 100644
--- a/type/__matrix_synapse/parameter/optional
+++ b/type/__matrix_synapse/parameter/optional
@@ -15,11 +15,15 @@ max-upload-size
 smtp-host
 smtp-port
 smtp-user
-smtp-pass
-riot-base-url
+smtp-password
+web-client-url
 rc-message-per-second
 rc-message-burst
 rc-login-per-second
 rc-login-burst
 global-cache-factor
 event-cache-size
+remote-room-complexity-treshold
+room-encryption-policy
+notification-from
+message-max-lifetime

From a1ad30f0c5d90937d68ebfd9219470338c47a9fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Wed, 17 Feb 2021 09:44:50 +0100
Subject: [PATCH 05/23] [__matrix_synapse] refresh manpage, fix various
 parameter handling issues

---
 .../__matrix_synapse/files/homeserver.yaml.sh |   8 +-
 type/__matrix_synapse/man.rst                 | 136 ++++++++++++++----
 type/__matrix_synapse/parameter/boolean       |   3 +-
 .../parameter/default/web-client-url          |   1 -
 4 files changed, 118 insertions(+), 30 deletions(-)

diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index e164342..b030fbd 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -2289,9 +2289,13 @@ email:
   #
   # (This setting used to be called riot_base_url; the old name is still
   # supported for backwards-compatibility but is now deprecated.)
-  #
-  client_base_url: "${WEB_CLIENT_URL:?}"
+EOF
 
+if [ -n "$WEB_CLIENT_URL" ]; then
+	echo "  client_base_url: \"$WEB_CLIENT_URL\""
+fi
+
+cat << EOF
   # Configure the time that a validation email will expire after sending.
   # Defaults to 1h.
   #
diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index f0e8c10..db67b59 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -16,17 +16,16 @@ REQUIRED PARAMETERS
 -------------------
 server-name
   Name of your homeserver (e.g. ungleich.ch) used as part of your MXIDs. This
-  value cannot be changed without meddling with the database once the server is
-  being used.
+  value cannot be changed later on.
 
 base-url
-  Public URL of your homeserver (e.g. http://matrix.ungleich.ch).
+  Public URL of your homeserver (e.g. `<http://matrix.ungleich.ch>`_).
 
 database-engine
-  'sqlite3' or 'postgresql'
+  'sqlite3' or 'psycopg2' (= Postgresql).
 
 database-name
-  Path to the database if SQLite3 is used or database name if PostgresSQL is
+  Path to database file if SQLite3 is used or database name if PostgresSQL is
   used.
 
 OPTIONAL PARAMETERS
@@ -64,6 +63,55 @@ ldap-bind-password
 ldap-filter
   LDAP user filter, defaulting to `(objectClass=posixAccount)`.
 
+smtp-host
+  The hostname of the outgoing SMTP server to use. Defaults to 'localhost'.
+
+smtp-port
+  # The port on the mail server for outgoing SMTP. Defaults to 25.
+
+smtp-user
+  Username for authentication to the SMTP server. By
+  default, no authentication is attempted.
+
+smtp-password
+  Password for authentication to the SMTP server. By
+  default, no authentication is attempted.
+
+notification-from
+  From address to use when sending emails. Defaults
+  to "%(app)s <no-reply@$SERVER_NAME>".
+
+message-max-lifetime
+  Default retention policy. If set, Synapse will apply it to rooms that lack
+  the 'm.room.retention' state event. Ignored if
+  enable-message-retention-policy is not set. Defaults to 1y.
+
+web-client-url
+  Custom URL for client links within the email
+  notifications. By default links will be based on
+  "https://matrix.to".
+
+global-cache-factor
+  Controls the global cache factor, which is the default cache factor for all
+  caches if a specific factor for that cache is not otherwise set. Defaults to
+  0.5, which will half the size of all caches.
+
+event-cache-size
+  The number of events to cache in memory. Not affected by
+  caches.global_factor. Defaults to 10K.
+
+remote-room-complexity-threshold
+  The limit above which rooms cannot be joined when
+  limit-remote-room-complexity is set. Room complexity is an arbitrary measure
+  based on factors such as the number of users in the room. The default is 1.0.
+
+room-encrypt-policy
+  Controls whether locally-created rooms should be end-to-end encrypted by
+  default. Possible options are "all" (any locally-created room), "invite"
+  (any room created with the private_chat or trusted_private_chat room
+  creation presets , and "off" (this option will take no effect). Defaults to
+  "off".
+
 turn-uri
   URI to TURN server, can be provided multiple times if there is more than one
   server.
@@ -89,12 +137,6 @@ rc-login-per-second
 rc-login-burst
   Login rate-limiting (burst). Defaults to 3.
 
-branding-auth-header-logo-url
-  A logo that is shown in the header during authentication flows.
-
-branding-auth-footer-links
-  A list of links to show in the authentication page footer: `[{"text": "Link text", "url": "https://link.target"}, {"text": "Other link", ...}]`
-
 registration-allows-email-pattern
     Only allow email addresses matching specified filter. Can be specified multiple times. A pattern must look like `.*@vector\.im`.
 
@@ -109,14 +151,14 @@ extra-setting
 
 BOOLEAN PARAMETERS
 ------------------
-allow-registration
+enable-registrations
   Enables user registration on the homeserver.
 
 enable-ldap-auth
   Enables ldap-backed authentication.
 
-ldap-search-mode
-  Enables 'search' mode for LDAP auth backend.
+ldap-use-starttls
+  Use STARTTLS when connection to the LDAP server.
 
 report-stats
   Whether or not to report anonymized homeserver usage statistics.
@@ -124,6 +166,12 @@ report-stats
 expose-metrics
   Expose metrics endpoint for Prometheus.
 
+enable-notifications
+  Enable mail notifications (see smtp-* optinal parameters).
+
+smtp-use-starttls
+  Use STARTTLS when connection to the SMTP server.
+
 disable-federation
   Disable federation to the broader matrix network.
 
@@ -139,18 +187,50 @@ allow-public-rooms-without-auth
 enable-server-notices
   Enable the server notices room.
 
-global-cache-factor
-  Controls the global cache factor, which is the default cache factor
-  for all caches if a specific factor for that cache is not otherwise
-  set. Defaults to 0.5.
-
-event-cache-size
-  Number of events to cache in memory. Defaults to 10K.
-
 allow-guest-access
   Allows users to register as guests without a password/email/etc, and
-  participate in rooms hosted on this server which have been made accessible to
-  anonymous users.
+  participate in rooms hosted on this server which have been made accessible
+  to anonymous users.
+
+limit-remote-room-complexity
+  When this is enabled, the room "complexity" will be checked before a user joins
+  a new remote room. If it is above the complexity limit (see
+  remote-room-complexity-threshold parameter), the server will disallow
+  joining, or will instantly leave.
+
+disable-presence
+  Disable presence tracking on this homeserver.
+
+user-directory-search-all-users
+  Defines whether to search all users visible to your HS when searching the
+  user directory, rather than limiting to users visible in public rooms.
+  If you set it True, you'll have to rebuild the user_directory search indexes,
+  see
+  `<https://github.com/matrix-org/synapse/blob/master/docs/user_directory.md>`_.
+
+enable-message-retention-policy
+  If this feature is enabled, Synapse will regularly look for and purge events
+  which are older than the room's maximum retention period. Synapse will also
+  filter events received over federation so that events that should have been
+  purged are ignored and not stored again. See message-max-lifetime flag.
+
+PERFORMANCE
+-----------
+
+The Synapse server is not very performant (initial implementation, pretty
+resource hungry, etc.) and will eventually be replaced by Dendrite. The
+following parameters (see above descriptions) will help you with performance
+tuning:
+
+  * global-cache-factor
+  * event-cache-size
+  * disable-presence
+  * limit-remote-room-complexity and remote-room-complexity-threshold
+
+WORKER MODE
+-----------
+
+Not implemented yet.
 
 EXAMPLES
 --------
@@ -162,9 +242,15 @@ EXAMPLES
       --database-engine sqlite3 \
       --database-name /var/lib/matrix-syanpse/homeserver.db
 
+You might also be interested in ungleich's `__ungleich_matrix
+<https://code.ungleich.ch/ungleich-public/cdist-ungleich/-/tree/master/type/__ungleich_matrix>`_
+meta-type.
+
 SEE ALSO
 --------
 - `cdist-type__matrix_element(7) <cdist-type__matrix_element.html>`_
+- `cdist-type__matrix_synapse_admin(7) <cdist-type__matrix_synapse_admin.html>`_
+- `cdist-type__matrix_synapse_worker(7) <cdist-type__matrix_synapse_worker.html>`_
 
 
 AUTHORS
@@ -174,7 +260,7 @@ Timothée Floure <timothee.floure@ungleich.ch>
 
 COPYING
 -------
-Copyright \(C) 2019 Timothée Floure. You can redistribute it
+Copyright \(C) 2019-2021 Timothée Floure. You can redistribute it
 and/or modify it under the terms of the GNU General Public License as
 published by the Free Software Foundation, either version 3 of the
 License, or (at your option) any later version.
diff --git a/type/__matrix_synapse/parameter/boolean b/type/__matrix_synapse/parameter/boolean
index 809bf63..ed738fe 100644
--- a/type/__matrix_synapse/parameter/boolean
+++ b/type/__matrix_synapse/parameter/boolean
@@ -1,9 +1,8 @@
-allow-registration
+enable-registrations
 enable-ldap-auth
 report-stats
 expose-metrics
 enable-notifications
-enable-notifications-by-default
 smtp-use-starttls
 disable-federation
 registration-requires-email
diff --git a/type/__matrix_synapse/parameter/default/web-client-url b/type/__matrix_synapse/parameter/default/web-client-url
index 4ed1053..e69de29 100644
--- a/type/__matrix_synapse/parameter/default/web-client-url
+++ b/type/__matrix_synapse/parameter/default/web-client-url
@@ -1 +0,0 @@
-https://app.element.io/

From 2bcc81555565059b6a4c6f46291821e2356b2462 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Wed, 17 Feb 2021 10:05:26 +0100
Subject: [PATCH 06/23] [__matrix_synapse] wire up worker mode

---
 .../__matrix_synapse/files/homeserver.yaml.sh |  4 +-
 type/__matrix_synapse/man.rst                 | 40 ++++++++++++++++++-
 type/__matrix_synapse/manifest                | 16 ++++++--
 type/__matrix_synapse/parameter/boolean       |  1 +
 .../parameter/default/background-tasks-worker |  0
 .../default/worker-replication-secret         |  0
 type/__matrix_synapse/parameter/optional      |  2 +
 7 files changed, 56 insertions(+), 7 deletions(-)
 create mode 100644 type/__matrix_synapse/parameter/default/background-tasks-worker
 create mode 100644 type/__matrix_synapse/parameter/default/worker-replication-secret

diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index b030fbd..7195dd5 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -2825,8 +2825,8 @@ cat << EOF
 #
 EOF
 
-if [ -n "$RUN_BACKGROUND_TASKS_ON" ]; then
-	echo "run_background_tasks_on: ${RUN_BACKGROUND_TASKS_ON:?}"
+if [ -n "$BACKGROUND_TASKS_WORKER" ]; then
+	echo "run_background_tasks_on: ${BACKGROUND_TASKS_WORKER:?}"
 fi
 
 cat << EOF
diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index db67b59..ead1649 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -146,6 +146,15 @@ auto-join-room
 app-service-config-file
   Path (on remote) of an application service configuration file to load. Can be specified multiple times.
 
+worker-replication-secret
+  A shared secret used by the replication APIs to authenticate HTTP requests
+  from workers. Ignored if worker-mode is not set. By default this is unused and
+  traffic is not authenticated.
+
+background-task-worker
+  The worker that is used to run background tasks (e.g. cleaning up expired
+  data). If not provided this defaults to the main process.
+
 extra-setting
   Arbitrary string to be added to the configuration file. Can be specified multiple times.
 
@@ -214,6 +223,13 @@ enable-message-retention-policy
   filter events received over federation so that events that should have been
   purged are ignored and not stored again. See message-max-lifetime flag.
 
+worker-mode
+  For small instances it recommended to run Synapse in the default monolith
+  mode. For larger instances where performance is a concern it can be helpful
+  to split out functionality into multiple separate python processes. These
+  processes are called 'workers'. Please read the  WORKER MODE section of this
+  manpage before enabling, as extra work and considerations are required.
+
 PERFORMANCE
 -----------
 
@@ -230,7 +246,29 @@ tuning:
 WORKER MODE
 -----------
 
-Not implemented yet.
+Worker mode allows to move some processing out of the main synapse process for
+horizontal scaling. You are expected to use the
+`cdist-type__matrix_synapse_worker(7)
+<cdist-type__matrix_synapse_worker.html>`_ type to set up workers when the
+worker-mode flag is set.
+
+Worker mode depend on the following components:
+
+  * A working `redis <https://redis.io/>`_ server
+  * The hiredis python package (`python3-hiredis
+    <https://packages.debian.org/buster/python3-hiredis>`_ on debian, not
+    packaged in alpine as of 2021-02-17).
+  * The txredisapi python package, which is not packaged on debian nor alpine
+    as of 2021-02-17.
+
+The current way to install the above two python packages (if not packaged in
+your distribution) is sadly to use pip (see `cdist-type__python_pip(7)
+<cdist-type__python_pip.html>`_ core cdist type).
+
+It is also recommended to first take a look at:
+
+  - `upstream's high-level overview on workers (matrix.org blog post) <https://matrix.org/blog/2020/11/03/how-we-fixed-synapses-scalability>`_
+  - `upstream's documentation on workers <https://github.com/matrix-org/synapse/blob/develop/docs/workers.md>`_
 
 EXAMPLES
 --------
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 1f01ca9..6341461 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -167,7 +167,7 @@ if [ -f "$__object/parameter/notification-from" ]; then
 	NOTIFICATION_FROM=$(cat "$__object/parameter/notification-from")
 	export NOTIFICATION_FROM
 else
-	export NOTIFICATION_FROM="Matrix <no-reply@$SERVER_NAME>"
+	export NOTIFICATION_FROM="%(app)s <no-reply@$SERVER_NAME>"
 fi
 
 # Registrations and users.
@@ -243,15 +243,23 @@ fi
 export MAIN_LISTENER_PORT=8008
 export ENABLE_MEDIA_REPO='true'
 export SEND_FEDERATION_FROM_MAIN_PROCESS='true'
-export RUN_BACKGROUND_TASKS_ON=
-export ENABLE_REPLICATION=
-export ENABLE_REDIS_SUPPORT='false'
 MAIN_LISTENER_RESOURCES="[federation,client]"
 if [ "$EXPOSE_METRICS" = "true" ]; then
 	MAIN_LISTENER_RESOURCES="$(echo "$MAIN_LISTENER_RESOURCES" | tr -d ']'),metrics]"
 fi
 export MAIN_LISTENER_RESOURCES
 
+ENABLE_REPLICATION=
+ENABLE_REDIS_SUPPORT='false'
+WORKER_REPLICATION_SECRET=$(cat "$__object/parameter/worker-replication-secret")
+BACKGROUND_TASKS_WORKER=$(cat "$__object/parameter/background-tasks-worker")
+if [ -f "$__object/parameter/worker-mode" ]; then
+	ENABLE_REPLICATION=1
+	ENABLE_REDIS_SUPPORT='true'
+fi
+export ENABLE_REPLICATION ENABLE_REDIS_SUPPORT WORKER_REPLICATION_SECRET \
+	BACKGROUND_TASKS_WORKER
+
 # Error out on invalid parameter combination.
 case "$DATABASE_ENGINE" in
 	sqlite3)
diff --git a/type/__matrix_synapse/parameter/boolean b/type/__matrix_synapse/parameter/boolean
index ed738fe..481fb9d 100644
--- a/type/__matrix_synapse/parameter/boolean
+++ b/type/__matrix_synapse/parameter/boolean
@@ -15,3 +15,4 @@ disable-presence
 ldap-use-starttls
 user-directory-search-all-users
 enable-message-retention-policy
+worker-mode
diff --git a/type/__matrix_synapse/parameter/default/background-tasks-worker b/type/__matrix_synapse/parameter/default/background-tasks-worker
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/default/worker-replication-secret b/type/__matrix_synapse/parameter/default/worker-replication-secret
new file mode 100644
index 0000000..e69de29
diff --git a/type/__matrix_synapse/parameter/optional b/type/__matrix_synapse/parameter/optional
index 73a7dfa..16d1dd4 100644
--- a/type/__matrix_synapse/parameter/optional
+++ b/type/__matrix_synapse/parameter/optional
@@ -27,3 +27,5 @@ remote-room-complexity-treshold
 room-encryption-policy
 notification-from
 message-max-lifetime
+worker-replication-secret
+background-tasks-worker

From 37762dd1cacec8652b142b614d76518bf647a9d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Wed, 17 Feb 2021 10:52:29 +0100
Subject: [PATCH 07/23] [__matrix_synapse_worker] initial implementation

---
 .../files/matrix-synapse-worker@.service      | 25 ++++++
 .../files/worker.yaml.sh                      | 25 ++++++
 type/__matrix_synapse_worker/man.rst          | 77 +++++++++++++++++++
 type/__matrix_synapse_worker/manifest         | 67 ++++++++++++++++
 .../parameter/default/replication-host        |  1 +
 .../parameter/default/replication-port        |  1 +
 .../parameter/optional                        |  3 +
 .../parameter/optional_multiple               |  1 +
 .../parameter/required                        |  3 +
 9 files changed, 203 insertions(+)
 create mode 100644 type/__matrix_synapse_worker/files/matrix-synapse-worker@.service
 create mode 100755 type/__matrix_synapse_worker/files/worker.yaml.sh
 create mode 100644 type/__matrix_synapse_worker/man.rst
 create mode 100755 type/__matrix_synapse_worker/manifest
 create mode 100644 type/__matrix_synapse_worker/parameter/default/replication-host
 create mode 100644 type/__matrix_synapse_worker/parameter/default/replication-port
 create mode 100644 type/__matrix_synapse_worker/parameter/optional
 create mode 100644 type/__matrix_synapse_worker/parameter/optional_multiple
 create mode 100644 type/__matrix_synapse_worker/parameter/required

diff --git a/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service b/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service
new file mode 100644
index 0000000..cb5ac0a
--- /dev/null
+++ b/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service
@@ -0,0 +1,25 @@
+[Unit]
+Description=Synapse %i
+AssertPathExists=/etc/matrix-synapse/workers/%i.yaml
+
+# This service should be restarted when the synapse target is restarted.
+PartOf=matrix-synapse.target
+
+# if this is started at the same time as the main, let the main process start
+# first, to initialise the database schema.
+After=matrix-synapse.service
+
+[Service]
+Type=notify
+NotifyAccess=main
+User=matrix-synapse
+WorkingDirectory=/var/lib/matrix-synapse
+EnvironmentFile=/etc/default/matrix-synapse
+ExecStart=/opt/venvs/matrix-synapse/bin/python -m synapse.app.generic_worker --config-path=/etc/matrix-synapse/homeserver.yaml --config-path=/etc/matrix-synapse/conf.d/ --config-path=/etc/matrix-synapse/workers/%i.yaml
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=always
+RestartSec=3
+SyslogIdentifier=matrix-synapse-%i
+
+[Install]
+WantedBy=matrix-synapse.target
diff --git a/type/__matrix_synapse_worker/files/worker.yaml.sh b/type/__matrix_synapse_worker/files/worker.yaml.sh
new file mode 100755
index 0000000..0d24636
--- /dev/null
+++ b/type/__matrix_synapse_worker/files/worker.yaml.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+cat << EOF
+worker_app: "${WORKER_APP:?}"
+worker_name: "${WORKER_NAME:?}"
+
+# The replication listener on the main synapse process.
+worker_replication_host: "${WORKER_REPLICATION_HOST:?}"
+worker_replication_http_port: "${WORKER_REPLICATION_PORT:?}"
+
+worker_listeners:
+ - type: http
+   port: "${WORKER_PORT:?}"
+   resources:
+     - names:
+EOF
+
+for resource in ${WORKER_RESOURCES:?}; do
+echo "       - \"$resource\""
+done
+
+cat << EOF
+
+worker_log_config: "${WORKER_LOG_CONFIG:?}"
+EOF
diff --git a/type/__matrix_synapse_worker/man.rst b/type/__matrix_synapse_worker/man.rst
new file mode 100644
index 0000000..c8150f6
--- /dev/null
+++ b/type/__matrix_synapse_worker/man.rst
@@ -0,0 +1,77 @@
+cdist-type__matrix_synapse(7)
+======================
+
+NAME
+----
+cdist-type__matrix_synapse_worker - Configure a synapse worker
+
+
+DESCRIPTION
+-----------
+This type configures and start a matrix worker. This type does not install
+synapse: `cdist-type__matrix_synapse(7) <cdist-type__matrix_synapse.html>`_
+type must be run first.
+
+It is also recommended to take a look at:
+
+  - `upstream's high-level overview on workers (matrix.org blog post) <https://matrix.org/blog/2020/11/03/how-we-fixed-synapses-scalability>`_
+  - `upstream's documentation on workers <https://github.com/matrix-org/synapse/blob/develop/docs/workers.md>`_
+
+REQUIRED PARAMETERS
+-------------------
+app
+  Worker application to be used. A detailed list is available on `upstream's
+  documentation
+  <https://github.com/matrix-org/synapse/blob/master/docs/workers.md#available-worker-applications>`_.
+
+port
+  Port on which this worker will listen.
+
+resource
+  Resources to be served by this worker. Can be specified multiple times.
+
+OPTIONAL PARAMETERS
+-------------------
+replication-host
+  Replication endpoint host of your main synapse process. Defaults to
+  localhost.
+
+replication-port
+  Replication endpoint port of your main synapse process. Defaults to 9093.
+
+log-config
+  Path to log configuration. Defaults to synapse's main process log
+  configuration.
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    __matrix_synapse --server-name ungleich.ch \
+      --base-url https://matrix.ungleich.ch \
+      --database-engine sqlite3 \
+      --database-name /var/lib/matrix-syanpse/homeserver.db \
+      --worker-mode
+    require="__matrix_synapse" __matrix_synapse_worker generic \
+      --app 'synapse.app.generic_worker' \
+      --port 8083 \
+      --resource 'federation' \
+      --resource 'client'
+
+SEE ALSO
+--------
+- `cdist-type__matrix_synapse(7) <cdist-type__matrix_synapse.html>`_
+
+
+AUTHORS
+-------
+Timothée Floure <timothee.floure@ungleich.ch>
+
+
+COPYING
+-------
+Copyright \(C) 2019-2021 Timothée Floure. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/type/__matrix_synapse_worker/manifest b/type/__matrix_synapse_worker/manifest
new file mode 100755
index 0000000..c1867ed
--- /dev/null
+++ b/type/__matrix_synapse_worker/manifest
@@ -0,0 +1,67 @@
+#!/bin/sh
+
+# TODO: check if matrix-synapse package is installed (fail if not - it's not
+# this type's job to install it).
+
+name=$__object_id
+os=$(cat "$__global/explorer/os")
+
+case "$os" in
+	debian)
+		synapse_conf_dir='/etc/synapse'
+		synapse_workers_conf_dir="$synapse_conf_dir/workers"
+
+		# Synapse log configuration on debian - default value of config-log
+		# parameter.
+		WORKER_LOG_CONFIG="$synapse_conf_dir/log.yaml"
+
+		# As of writing, debian's matrix-synapse package does not install the
+		# matrix-synapse-worker@.service systemd unit.
+		systemd_worker_service_override=present
+		systemd_worker_service="matrix-synapse-worker@$name"
+		;;
+	*)
+		printf "Your operating system (%s) is currently not supported by this type (%s)\n" "$os" "${__type##*/}" >&2
+		printf "Please contribute an implementation for it if you can.\n" >&2
+		exit 1
+		;;
+esac
+
+# Type parameters.
+WORKER_NAME=$__object_id
+WORKER_APP=$(cat "$__object/parameter/app")
+WORKER_PORT=$(cat "$__object/parameter/port")
+WORKER_RESOURCES=$(cat "$__object/parameter/resource")
+
+export WORKER_APP WORKER_NAME WORKER_PORT
+
+if [ -f "$__object/parameter/log-config" ]; then
+	WORKER_LOG_CONFIG=$(cat "$__object/parameter/log-config")
+fi
+export WORKER_LOG_CONFIG
+
+WORKER_REPLICATION_HOST=$(cat "$__object/parameter/replication-host")
+WORKER_REPLICATION_PORT=$(cat "$__object/parameter/replication-port")
+export WORKER_REPLICATION_HOST WORKER_REPLICATION_PORT
+
+# Generate and deploy configuration files.
+mkdir -p "$__object/files"
+"$__type/files/worker.yaml.sh" > "$__object/files/worker.yaml"
+
+__directory "$synapse_workers_conf_dir" --parents
+require="__directory/$synapse_workers_conf_dir" \
+	__file "$synapse_workers_conf_dir/$name.yaml" \
+	--source "$__object/files/worker.yaml" \
+	--mode 0644
+
+__file "/etc/systemd/systemd/matrix-synapse-worker@.service" \
+	--source "$__type/files/matrix-synapse-worker@.service" \
+	--mode 0644 \
+	--state $systemd_worker_service_override
+
+# Start service, enable at boot.
+require="__file/$synapse_workers_conf_dir/$name.yaml \
+	__file/etc/systemd/systemd/matrix-synapse-worker@.service"  \
+	__service "$systemd_worker_service" --action start
+require="__service/$systemd_worker_service" \
+	__start_on_boot "$systemd_worker_service"
diff --git a/type/__matrix_synapse_worker/parameter/default/replication-host b/type/__matrix_synapse_worker/parameter/default/replication-host
new file mode 100644
index 0000000..2fbb50c
--- /dev/null
+++ b/type/__matrix_synapse_worker/parameter/default/replication-host
@@ -0,0 +1 @@
+localhost
diff --git a/type/__matrix_synapse_worker/parameter/default/replication-port b/type/__matrix_synapse_worker/parameter/default/replication-port
new file mode 100644
index 0000000..ed91c92
--- /dev/null
+++ b/type/__matrix_synapse_worker/parameter/default/replication-port
@@ -0,0 +1 @@
+9093
diff --git a/type/__matrix_synapse_worker/parameter/optional b/type/__matrix_synapse_worker/parameter/optional
new file mode 100644
index 0000000..2f61487
--- /dev/null
+++ b/type/__matrix_synapse_worker/parameter/optional
@@ -0,0 +1,3 @@
+replication-host
+replication-port
+log-config
diff --git a/type/__matrix_synapse_worker/parameter/optional_multiple b/type/__matrix_synapse_worker/parameter/optional_multiple
new file mode 100644
index 0000000..91e75c6
--- /dev/null
+++ b/type/__matrix_synapse_worker/parameter/optional_multiple
@@ -0,0 +1 @@
+resource
diff --git a/type/__matrix_synapse_worker/parameter/required b/type/__matrix_synapse_worker/parameter/required
new file mode 100644
index 0000000..62d5bd6
--- /dev/null
+++ b/type/__matrix_synapse_worker/parameter/required
@@ -0,0 +1,3 @@
+app
+name
+port

From 33bf0fd4165bde47b097de05ef7e3ff1fbd25ece Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Wed, 17 Feb 2021 14:01:06 +0100
Subject: [PATCH 08/23] [__matrix_synapse] wire TLS certs, fix some templating
 errors

---
 type/__matrix_synapse/files/homeserver.yaml.sh | 11 +++++++++--
 type/__matrix_synapse/man.rst                  |  6 ++++++
 type/__matrix_synapse/manifest                 |  9 +++++++++
 type/__matrix_synapse/parameter/boolean        |  1 +
 type/__matrix_synapse/parameter/required       |  2 ++
 5 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index 7195dd5..ad81569 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -1,7 +1,8 @@
 #!/bin/sh
-
 # Note: template originally generated from synapse's 1.26.0 sample config.
 
+set -e
+
 cat << EOF
 ###############################################################
 # THIS FILE HAS BEEN GENERATED BY CDIST. DO NOT EDIT BY HAND. #
@@ -49,8 +50,13 @@ pid_file: "${PIDFILE:?}"
 # under the 'listeners' configuration, however this is a security risk:
 # https://github.com/matrix-org/synapse#security-note
 #
-web_client_location: "${WEB_CLIENT_URL:?}"
+EOF
 
+if [ -n "$WEB_CLIENT_URL" ]; then
+	echo "web_client_location: \"$WEB_CLIENT_URL\""
+fi
+
+cat << EOF
 # The public-facing base URL that clients use to access this Homeserver (not
 # including _matrix/...). This is the same URL a user might enter into the
 # 'Custom Homeserver URL' field on their client. If you use Synapse with a
@@ -690,6 +696,7 @@ if [ -n "$DISABLE_FEDERATION" ]; then
 fi
 
 cat << EOF
+
 # Report prometheus metrics on the age of PDUs being sent to and received from
 # the following domains. This can be used to give an idea of "delay" on inbound
 # and outbound federation, though be aware that any delay can be due to problems
diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index ead1649..a0e9b03 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -28,6 +28,12 @@ database-name
   Path to database file if SQLite3 is used or database name if PostgresSQL is
   used.
 
+tls-cert
+  Path to PEM-encoded X509 TLS certificate.
+
+tls-private-key
+  Path to PEM-encoded TLS private key.
+
 OPTIONAL PARAMETERS
 -------------------
 database-host
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 6341461..1795b76 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -118,6 +118,11 @@ if [ -f "$__object/parameter/enable-server-notices" ]; then
     export ENABLE_SERVER_NOTICES=1
 fi
 
+# TLS.
+TLS_CERTIFICATE_PATH=$(cat "$__object/parameter/tls-cert")
+TLS_PRIVATE_KEY_PATH=$(cat "$__object/parameter/tls-private-key")
+export TLS_PRIVATE_KEY_PATH TLS_CERTIFICATE_PATH
+
 # Performance flags.
 GLOBAL_CACHE_FACTOR=$(cat "$__object/parameter/global-cache-factor")
 EVENT_CACHE_SIZE=$(cat "$__object/parameter/event-cache-size")
@@ -205,6 +210,10 @@ ENABLE_MESSAGE_RETENTION_POLICY=$(get_boolean_for 'enable-message-retention-poli
 MESSAGE_RETENTION_POLICY_MAX_LIFETIME=$(cat "$__object/parameter/message-max-lifetime")
 export ENABLE_MESSAGE_RETENTION_POLICY MESSAGE_RETENTION_POLICY_MAX_LIFETIME
 
+# Previews.
+ENABLE_URL_PREVIEW=$(get_boolean_for 'enable-url-preview')
+export ENABLE_URL_PREVIEW
+
 # Rate-limiting
 RC_MESSAGE_PER_SECOND=$(cat "$__object/parameter/rc-message-per-second")
 RC_MESSAGE_BURST=$(cat "$__object/parameter/rc-message-burst")
diff --git a/type/__matrix_synapse/parameter/boolean b/type/__matrix_synapse/parameter/boolean
index 481fb9d..7ff48de 100644
--- a/type/__matrix_synapse/parameter/boolean
+++ b/type/__matrix_synapse/parameter/boolean
@@ -16,3 +16,4 @@ ldap-use-starttls
 user-directory-search-all-users
 enable-message-retention-policy
 worker-mode
+enable-url-preview
diff --git a/type/__matrix_synapse/parameter/required b/type/__matrix_synapse/parameter/required
index f9ebcb3..344ae4c 100644
--- a/type/__matrix_synapse/parameter/required
+++ b/type/__matrix_synapse/parameter/required
@@ -2,3 +2,5 @@ server-name
 base-url
 database-engine
 database-name
+tls-cert
+tls-private-key

From c84831331e39e125022d360f6538c0a046301469 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Wed, 17 Feb 2021 14:02:02 +0100
Subject: [PATCH 09/23] [__matrix_synapse_worker] add forgotten variable export

---
 type/__matrix_synapse_worker/manifest | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/type/__matrix_synapse_worker/manifest b/type/__matrix_synapse_worker/manifest
index c1867ed..daa6dd7 100755
--- a/type/__matrix_synapse_worker/manifest
+++ b/type/__matrix_synapse_worker/manifest
@@ -32,8 +32,7 @@ WORKER_NAME=$__object_id
 WORKER_APP=$(cat "$__object/parameter/app")
 WORKER_PORT=$(cat "$__object/parameter/port")
 WORKER_RESOURCES=$(cat "$__object/parameter/resource")
-
-export WORKER_APP WORKER_NAME WORKER_PORT
+export WORKER_APP WORKER_NAME WORKER_PORT WORKER_RESOURCES
 
 if [ -f "$__object/parameter/log-config" ]; then
 	WORKER_LOG_CONFIG=$(cat "$__object/parameter/log-config")

From e8b0ced1b1d5eb6e444df95bea78f3230fdfe8f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Thu, 18 Feb 2021 11:27:34 +0100
Subject: [PATCH 10/23] [__matrix_synapse] various configuration fixes

---
 .../__matrix_synapse/files/homeserver.yaml.sh | 16 +++-
 type/__matrix_synapse/files/log.config.sh     | 95 +++++++++----------
 type/__matrix_synapse/gencode-remote          |  8 +-
 type/__matrix_synapse/man.rst                 | 14 +--
 type/__matrix_synapse/manifest                | 41 +++++---
 type/__matrix_synapse/parameter/optional      |  3 +
 type/__matrix_synapse/parameter/required      |  2 -
 7 files changed, 97 insertions(+), 82 deletions(-)

diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index ad81569..6ee035c 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -525,13 +525,19 @@ retention:
 # full certificate chain including any intermediate certificates (for
 # instance, if using certbot, use \`fullchain.pem\` as your certificate,
 # not \`cert.pem\`).
-#
-tls_certificate_path: "${TLS_CERTIFICATE_PATH:?}"
+EOF
+
+if [ -n "$TLS_CERTIFICATE_PATH" ] && [ -n "$TLS_PRIVATE_KEY_PATH" ]; then
+	cat << EOF
+tls_certificate_path: "$TLS_CERTIFICATE_PATH}"
 
 # PEM-encoded private key for TLS
 #
-tls_private_key_path: "${TLS_PRIVATE_KEY_PATH:?}"
+tls_private_key_path: "$TLS_PRIVATE_KEY_PATH"
+EOF
+fi
 
+cat << EOF
 # Whether to verify TLS server certificates for outbound federation requests.
 #
 # Defaults to \`true\`. To disable certificate verification, uncomment the
@@ -2495,7 +2501,7 @@ push:
   # The default value is "true" to include message details. Uncomment to only
   # include the event ID and room ID in push notification payloads.
   #
-  #include_content: false
+  include_content: true
 
   # When a push notification is received, an unread count is also sent.
   # This number can either be calculated as the number of unread messages
@@ -2538,7 +2544,7 @@ spam_checker:
 # Note that this option will only affect rooms created after it is set. It
 # will also not affect rooms created by other servers.
 #
-encryption_enabled_by_default_for_room_type: "${ROOM_ENCRYPTION_POLICY:?}"j
+encryption_enabled_by_default_for_room_type: "${ROOM_ENCRYPTION_POLICY:?}"
 
 
 # Uncomment to allow non-server-admin users to create groups on this server
diff --git a/type/__matrix_synapse/files/log.config.sh b/type/__matrix_synapse/files/log.config.sh
index 5eaf594..42502ec 100755
--- a/type/__matrix_synapse/files/log.config.sh
+++ b/type/__matrix_synapse/files/log.config.sh
@@ -5,6 +5,7 @@ cat << EOF
 # THIS FILE HAS BEEN GENERATED BY CDIST. DO NOT EDIT BY HAND. #
 ###############################################################
 
+
 # Log configuration for Synapse.
 #
 # This is a YAML file containing a standard Python logging configuration
@@ -15,65 +16,55 @@ cat << EOF
 #
 # [1]: https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
 # [2]: https://github.com/matrix-org/synapse/blob/master/docs/structured_logging.md
-
+#
 version: 1
 
 formatters:
-    precise:
-        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+  precise:
+   format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
+
+filters:
+  context:
+    (): synapse.util.logcontext.LoggingContextFilter
+    request: ""
 
 handlers:
-    file:
-        class: logging.handlers.TimedRotatingFileHandler
-        formatter: precise
-        filename: ${LOG_DIR:?}/homeserver.log
-        when: midnight
-        backupCount: 3  # Does not include the current log file.
-        encoding: utf8
-
-    # Default to buffering writes to log file for efficiency. This means that
-    # will be a delay for INFO/DEBUG logs to get written, but WARNING/ERROR
-    # logs will still be flushed immediately.
-    buffer:
-        class: logging.handlers.MemoryHandler
-        target: file
-        # The capacity is the number of log lines that are buffered before
-        # being written to disk. Increasing this will lead to better
-        # performance, at the expensive of it taking longer for log lines to
-        # be written to disk.
-        capacity: 10
-        flushLevel: 30  # Flush for WARNING logs as well
-
-    # A handler that writes logs to stderr. Unused by default, but can be used
-    # instead of "buffer" and "file" in the logger handlers.
-    console:
-        class: logging.StreamHandler
-        formatter: precise
+  file:
+    class: logging.handlers.TimedRotatingFileHandler
+    formatter: precise
+    filename: ${LOG_DIR:?}/homeserver.log
+    when: midnight
+    backupCount: 3  # Does not include the current log file.
+    filters: [context]
+    encoding: utf8
+  # Default to buffering writes to log file for efficiency. This means that
+  # will be a delay for INFO/DEBUG logs to get written, but WARNING/ERROR
+  # logs will still be flushed immediately.
+  buffer:
+    class: logging.handlers.MemoryHandler
+    target: file
+    # The capacity is the number of log lines that are buffered before
+    # being written to disk. Increasing this will lead to better
+    # performance, at the expensive of it taking longer for log lines to
+    # be written to disk.
+    capacity: 10
+    flushLevel: 30  # Flush for WARNING logs as well
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+    level: WARN
 
 loggers:
-    synapse.storage.SQL:
-        # beware: increasing this to DEBUG will make synapse log sensitive
-        # information such as access tokens.
-        level: INFO
-
-    twisted:
-        # We send the twisted logging directly to the file handler,
-        # to work around https://github.com/matrix-org/synapse/issues/3471
-        # when using "buffer" logger. Use "console" to log to stderr instead.
-        handlers: [file]
-        propagate: false
-
-root:
+  synapse:
+    level: INFO
+  synapse.storage.SQL:
+    # beware: increasing this to DEBUG will make synapse log sensitive
+    # information such as access tokens.
+    level: INFO
+  twisted:
     level: INFO
 
-    # Write logs to the \`buffer\` handler, which will buffer them together in memory,
-    # then write them to a file.
-    #
-    # Replace "buffer" with "console" to log to stderr instead. (Note that you'll
-    # also need to update the configuration for the \`twisted\` logger above, in
-    # this case.)
-    #
-    handlers: [buffer]
-
-disable_existing_loggers: false
+root:
+  level: INFO
+  handlers: [buffer, console]
 EOF
diff --git a/type/__matrix_synapse/gencode-remote b/type/__matrix_synapse/gencode-remote
index 65ff56c..cf7c648 100755
--- a/type/__matrix_synapse/gencode-remote
+++ b/type/__matrix_synapse/gencode-remote
@@ -6,11 +6,11 @@ init=$(cat "$__global/explorer/init")
 case "$os" in
 	alpine)
 		synapse_conf_dir=/etc/synapse
-		synapse_service=matrix-synapse
+		synapse_service=synapse
 		;;
 	debian)
 		synapse_conf_dir=/etc/matrix-synapse
-		synapse_service=synapse
+		synapse_service=matrix-synapse
 		;;
 	*)
 		echo "Unknown OS $os." >&2
@@ -18,10 +18,10 @@ case "$os" in
 	;;
 esac
 
-if grep -qE "^__file/$synapse_conf_dir" "${__messages_in}"; then
+if grep -qE "^__file$synapse_conf_dir" "${__messages_in}"; then
 	case "$init" in
 		systemd)
-			echo "systemctl try-reload-or-restart $synapse_service"
+			echo "systemctl restart $synapse_service"
 			;;
 		initd)
 			echo "service --ifstopped $synapse_service start"
diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index a0e9b03..81b07c7 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -28,12 +28,6 @@ database-name
   Path to database file if SQLite3 is used or database name if PostgresSQL is
   used.
 
-tls-cert
-  Path to PEM-encoded X509 TLS certificate.
-
-tls-private-key
-  Path to PEM-encoded TLS private key.
-
 OPTIONAL PARAMETERS
 -------------------
 database-host
@@ -69,6 +63,14 @@ ldap-bind-password
 ldap-filter
   LDAP user filter, defaulting to `(objectClass=posixAccount)`.
 
+tls-cert
+  Path to PEM-encoded X509 TLS certificate. Not needed if TLS termination is
+  handled by a reverse Proxy such as NGINX.
+
+tls-private-key
+  Path to PEM-encoded TLS private key. Not needed if TLS termination is
+  handled by a reverse Proxy such as NGINX.
+
 smtp-host
   The hostname of the outgoing SMTP server to use. Defaults to 'localhost'.
 
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 1795b76..84592cd 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -119,9 +119,14 @@ if [ -f "$__object/parameter/enable-server-notices" ]; then
 fi
 
 # TLS.
-TLS_CERTIFICATE_PATH=$(cat "$__object/parameter/tls-cert")
-TLS_PRIVATE_KEY_PATH=$(cat "$__object/parameter/tls-private-key")
-export TLS_PRIVATE_KEY_PATH TLS_CERTIFICATE_PATH
+if [ -f "$__object/parameter/tls-cert" ]; then
+	TLS_CERTIFICATE_PATH=$(cat "$__object/parameter/tls-cert")
+	export TLS_CERTIFICATE_PATH
+fi
+if [ -f "$__object/parameter/tls-private-key" ]; then
+	TLS_PRIVATE_KEY_PATH=$(cat "$__object/parameter/tls-private-key")
+	export TLS_PRIVATE_KEY_PATH
+fi
 
 # Performance flags.
 GLOBAL_CACHE_FACTOR=$(cat "$__object/parameter/global-cache-factor")
@@ -144,7 +149,11 @@ export DATABASE_ENGINE DATABASE_NAME DATABASE_HOST DATABASE_USER \
 	DATABASE_PASSWORD
 
 # LDAP-based authentication.
-ENABLE_LDAP_AUTH=$(get_boolean_for 'enable-ldap-auth')
+if [ -f "$__object/enable-ldap-auth" ]; then
+	ENABLE_LDAP_AUTH=$(get_boolean_for 'enable-ldap-auth')
+	export ENABLE_LDAP_AUTH
+fi
+
 LDAP_FILTER=$(cat "$__object/parameter/ldap-filter")
 LDAP_UID_ATTRIBUTE=$(cat "$__object/parameter/ldap-uid-attribute")
 LDAP_MAIL_ATTRIBUTE=$(cat "$__object/parameter/ldap-mail-attribute")
@@ -154,9 +163,8 @@ LDAP_BASE_DN=$(cat "$__object/parameter/ldap-base-dn")
 LDAP_BIND_DN=$(cat "$__object/parameter/ldap-bind-dn")
 LDAP_BIND_PASSWORD=$(cat "$__object/parameter/ldap-bind-password")
 LDAP_USE_STARTTLS=$(get_boolean_for 'ldap-use-starttls')
-export ENABLE_LDAP_AUTH LDAP_FILTER LDAP_UID_ATTRIBUTE LDAP_MAIL_ATTRIBUTE \
-	LDAP_NAME_ATTRIBUTE LDAP_URI LDAP_BASE_DN LDAP_BIND_DN LDAP_BIND_PASSWORD \
-	LDAP_USE_STARTTLS
+export LDAP_FILTER LDAP_UID_ATTRIBUTE LDAP_MAIL_ATTRIBUTE LDAP_NAME_ATTRIBUTE \
+	LDAP_URI LDAP_BASE_DN LDAP_BIND_DN LDAP_BIND_PASSWORD LDAP_USE_STARTTLS
 
 # Outgoing emails (= notifications).
 ENABLE_NOTIFICATIONS=$(get_boolean_for 'enable-notifications')
@@ -181,6 +189,11 @@ ENABLE_REGISTRATIONS=$(get_boolean_for 'enable-registrations')
 USER_DIRECTORY_SEARCH_ALL_USERS=$(get_boolean_for 'user-directory-search-all-users')
 export ALLOW_GUEST_ACCESS ENABLE_REGISTRATIONS USER_DIRECTORY_SEARCH_ALL_USERS
 
+if [ -f "$__object/parameter/registration-shared-token" ]; then
+	REGISTRATION_SHARED_SECRET=$(cat "$__object/parameter/registration-shared-secret")
+	export REGISTRATION_SHARED_SECRET
+fi
+
 if [ -f "$__object/parameter/registration-requires-email" ]; then
     export REGISTRATION_REQUIRES_EMAIL=1
 fi
@@ -196,14 +209,16 @@ if [ -f "$__object/parameter/registration-allows-email-pattern" ]; then
 fi
 
 # Federation.
-DISABLE_FEDERATION=$(get_boolean_for 'disable-federation')
 ALLOW_PUBLIC_ROOMS_OVER_FEDERATION=$(get_boolean_for 'allow-public-room-over-federation')
 ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH=$(get_boolean_for 'allow-public-rooms-without-auth')
 LIMIT_REMOTE_ROOM_COMPLEXITY=$(get_boolean_for 'limit-remote-room-complexity')
 REMOTE_ROOM_COMPLEXITY_TRESHOLD=$(cat "$__object/parameter/remote-room-complexity-treshold")
-export DISABLE_FEDERATION ALLOW_PUBLIC_ROOMS_OVER_FEDERATION \
-	ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH LIMIT_REMOTE_ROOM_COMPLEXITY \
-	REMOTE_ROOM_COMPLEXITY_TRESHOLD
+export ALLOW_PUBLIC_ROOMS_OVER_FEDERATION ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH \
+	LIMIT_REMOTE_ROOM_COMPLEXITY REMOTE_ROOM_COMPLEXITY_TRESHOLD
+
+if [ -f "$__object/parameter/disable-federation" ]; then
+	export DISABLE_FEDERATION=1
+fi
 
 # Message retention.
 ENABLE_MESSAGE_RETENTION_POLICY=$(get_boolean_for 'enable-message-retention-policy')
@@ -290,7 +305,7 @@ esac
 # backports situation.
 synapse_req=
 if [ -n "$apt_target_release" ]; then
-	__package_apt "$synapse_pkg" \
+	require="__apt_source/debian-backports" __package_apt "$synapse_pkg" \
 		--target-release "$apt_target_release"
 	synapse_req="__package_apt/$synapse_pkg"
 else
@@ -298,7 +313,7 @@ else
 	synapse_req="__package/$synapse_pkg"
 fi
 
-if [ "$ENABLE_LDAP_AUTH" = "true" ]; then
+if [ -n "$ENABLE_LDAP_AUTH" ]; then
 	if [ -n "$apt_target_release" ]; then
 		require="__package_apt/$synapse_pkg" __package_apt "$ldap_auth_provider_pkg" \
 			--target-release "$apt_target_release"
diff --git a/type/__matrix_synapse/parameter/optional b/type/__matrix_synapse/parameter/optional
index 16d1dd4..2f0bce4 100644
--- a/type/__matrix_synapse/parameter/optional
+++ b/type/__matrix_synapse/parameter/optional
@@ -29,3 +29,6 @@ notification-from
 message-max-lifetime
 worker-replication-secret
 background-tasks-worker
+tls-cert
+tls-private-key
+registration-shared-secret
diff --git a/type/__matrix_synapse/parameter/required b/type/__matrix_synapse/parameter/required
index 344ae4c..f9ebcb3 100644
--- a/type/__matrix_synapse/parameter/required
+++ b/type/__matrix_synapse/parameter/required
@@ -2,5 +2,3 @@ server-name
 base-url
 database-engine
 database-name
-tls-cert
-tls-private-key

From 12575d661b6afcbd24d7fc287e7a6a0dac96eea3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Thu, 18 Feb 2021 14:09:07 +0100
Subject: [PATCH 11/23] [__matrix_synapse] add documentation for
 --registration-shared-secret

---
 type/__matrix_synapse/man.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index 81b07c7..94c6e34 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -163,6 +163,10 @@ background-task-worker
   The worker that is used to run background tasks (e.g. cleaning up expired
   data). If not provided this defaults to the main process.
 
+registration-shared-secret
+  If set, allows registration of standard or admin accounts by anyone who
+  has the shared secret, even if registration is otherwise disabled.
+
 extra-setting
   Arbitrary string to be added to the configuration file. Can be specified multiple times.
 

From adc335669de2a8af2c271b2f08d50934344c871d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Thu, 18 Feb 2021 14:09:44 +0100
Subject: [PATCH 12/23] [__matrix_synapse] use __apt_backport instead of
 __apt_source

---
 type/__matrix_synapse/manifest | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 84592cd..ef552ba 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -42,10 +42,7 @@ case "$os" in
 				# Enable debian-backports for debian Buster, as the 'stable'
 				# matrix-synapse package is ways too old (< 1.0).
 				apt_target_release=buster-backports
-				__apt_source debian-backports \
-					--uri http://deb.debian.org/debian/ \
-					--distribution "$apt_target_release" \
-					--component main
+				__apt_backport
 				;;
 				bullseye|sid)
 					# As of writting (2021-02), the default matrix-synapse of those
@@ -305,7 +302,7 @@ esac
 # backports situation.
 synapse_req=
 if [ -n "$apt_target_release" ]; then
-	require="__apt_source/debian-backports" __package_apt "$synapse_pkg" \
+	require="__apt_backport" __package_apt "$synapse_pkg" \
 		--target-release "$apt_target_release"
 	synapse_req="__package_apt/$synapse_pkg"
 else

From 6487839cf54ece9e2d61d6295779e54105330a95 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Thu, 18 Feb 2021 14:10:19 +0100
Subject: [PATCH 13/23] [__matrix_synapse_worker] various tweaks and fixes
 following testing

---
 .../files/matrix-synapse-worker@.service            |  4 ++--
 type/__matrix_synapse_worker/files/worker.yaml.sh   |  4 ++--
 type/__matrix_synapse_worker/gencode-remote         | 12 ++++++++++++
 type/__matrix_synapse_worker/manifest               | 13 +++++++------
 type/__matrix_synapse_worker/parameter/required     |  1 -
 5 files changed, 23 insertions(+), 11 deletions(-)
 create mode 100755 type/__matrix_synapse_worker/gencode-remote

diff --git a/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service b/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service
index cb5ac0a..dba4bed 100644
--- a/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service
+++ b/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service
@@ -15,9 +15,9 @@ NotifyAccess=main
 User=matrix-synapse
 WorkingDirectory=/var/lib/matrix-synapse
 EnvironmentFile=/etc/default/matrix-synapse
-ExecStart=/opt/venvs/matrix-synapse/bin/python -m synapse.app.generic_worker --config-path=/etc/matrix-synapse/homeserver.yaml --config-path=/etc/matrix-synapse/conf.d/ --config-path=/etc/matrix-synapse/workers/%i.yaml
+ExecStart=/usr/bin/python3 -m synapse.app.generic_worker --config-path=/etc/matrix-synapse/homeserver.yaml --config-path=/etc/matrix-synapse/conf.d/ --config-path=/etc/matrix-synapse/workers/
 ExecReload=/bin/kill -HUP $MAINPID
-Restart=always
+Restart=on-failure
 RestartSec=3
 SyslogIdentifier=matrix-synapse-%i
 
diff --git a/type/__matrix_synapse_worker/files/worker.yaml.sh b/type/__matrix_synapse_worker/files/worker.yaml.sh
index 0d24636..6d885c6 100755
--- a/type/__matrix_synapse_worker/files/worker.yaml.sh
+++ b/type/__matrix_synapse_worker/files/worker.yaml.sh
@@ -6,11 +6,11 @@ worker_name: "${WORKER_NAME:?}"
 
 # The replication listener on the main synapse process.
 worker_replication_host: "${WORKER_REPLICATION_HOST:?}"
-worker_replication_http_port: "${WORKER_REPLICATION_PORT:?}"
+worker_replication_http_port: ${WORKER_REPLICATION_PORT:?}
 
 worker_listeners:
  - type: http
-   port: "${WORKER_PORT:?}"
+   port: ${WORKER_PORT:?}
    resources:
      - names:
 EOF
diff --git a/type/__matrix_synapse_worker/gencode-remote b/type/__matrix_synapse_worker/gencode-remote
new file mode 100755
index 0000000..9b82ad0
--- /dev/null
+++ b/type/__matrix_synapse_worker/gencode-remote
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# Designed for Debian/systemd - make sure to adapt when you add support for other
+# distributions/OSs.
+name=$__object_id
+synapse_conf_dir='/etc/matrix-synapse'
+synapse_workers_conf_dir="$synapse_conf_dir/workers"
+systemd_worker_service="matrix-synapse-worker@$name"
+
+if grep -qE "^__file$synapse_workers_conf_dir/$name" "${__messages_in}"; then
+	echo "systemctl restart $systemd_worker_service"
+fi
diff --git a/type/__matrix_synapse_worker/manifest b/type/__matrix_synapse_worker/manifest
index daa6dd7..fdbcbf4 100755
--- a/type/__matrix_synapse_worker/manifest
+++ b/type/__matrix_synapse_worker/manifest
@@ -8,7 +8,7 @@ os=$(cat "$__global/explorer/os")
 
 case "$os" in
 	debian)
-		synapse_conf_dir='/etc/synapse'
+		synapse_conf_dir='/etc/matrix-synapse'
 		synapse_workers_conf_dir="$synapse_conf_dir/workers"
 
 		# Synapse log configuration on debian - default value of config-log
@@ -53,14 +53,15 @@ require="__directory/$synapse_workers_conf_dir" \
 	--source "$__object/files/worker.yaml" \
 	--mode 0644
 
-__file "/etc/systemd/systemd/matrix-synapse-worker@.service" \
+__file "/etc/systemd/system/matrix-synapse-worker@.service" \
 	--source "$__type/files/matrix-synapse-worker@.service" \
 	--mode 0644 \
 	--state $systemd_worker_service_override
 
 # Start service, enable at boot.
-require="__file/$synapse_workers_conf_dir/$name.yaml \
-	__file/etc/systemd/systemd/matrix-synapse-worker@.service"  \
-	__service "$systemd_worker_service" --action start
-require="__service/$systemd_worker_service" \
+service_req=
+if [ "$systemd_worker_service_override" ]; then
+	service_req="__file/etc/systemd/system/matrix-synapse-worker@.service"
+fi
+require="__file/$synapse_workers_conf_dir/$name.yaml $service_req" \
 	__start_on_boot "$systemd_worker_service"
diff --git a/type/__matrix_synapse_worker/parameter/required b/type/__matrix_synapse_worker/parameter/required
index 62d5bd6..3d93f2a 100644
--- a/type/__matrix_synapse_worker/parameter/required
+++ b/type/__matrix_synapse_worker/parameter/required
@@ -1,3 +1,2 @@
 app
-name
 port

From f3d8717e694dfdbd4ac6e325c7c4b477e5ed3453 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Thu, 18 Feb 2021 14:32:41 +0100
Subject: [PATCH 14/23] [__matrix_synapse] fix typo in __apt_backports call

---
 type/__matrix_synapse/manifest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index ef552ba..9fad88e 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -42,7 +42,7 @@ case "$os" in
 				# Enable debian-backports for debian Buster, as the 'stable'
 				# matrix-synapse package is ways too old (< 1.0).
 				apt_target_release=buster-backports
-				__apt_backport
+				__apt_backports
 				;;
 				bullseye|sid)
 					# As of writting (2021-02), the default matrix-synapse of those
@@ -302,7 +302,7 @@ esac
 # backports situation.
 synapse_req=
 if [ -n "$apt_target_release" ]; then
-	require="__apt_backport" __package_apt "$synapse_pkg" \
+	require="__apt_backports" __package_apt "$synapse_pkg" \
 		--target-release "$apt_target_release"
 	synapse_req="__package_apt/$synapse_pkg"
 else

From 467a1350bf10dbab8f606e149326a95d6fa6e397 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Thu, 18 Feb 2021 16:03:59 +0100
Subject: [PATCH 15/23] [__matrix_synapse_worker] bind both v6 and v4, set
 x_forwarded

---
 type/__matrix_synapse_worker/files/worker.yaml.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/type/__matrix_synapse_worker/files/worker.yaml.sh b/type/__matrix_synapse_worker/files/worker.yaml.sh
index 6d885c6..a21d64c 100755
--- a/type/__matrix_synapse_worker/files/worker.yaml.sh
+++ b/type/__matrix_synapse_worker/files/worker.yaml.sh
@@ -11,12 +11,14 @@ worker_replication_http_port: ${WORKER_REPLICATION_PORT:?}
 worker_listeners:
  - type: http
    port: ${WORKER_PORT:?}
+   x_forwarded: true
+   bind_addresses: ['::1', '127.0.0.1']
    resources:
      - names:
 EOF
 
 for resource in ${WORKER_RESOURCES:?}; do
-echo "       - \"$resource\""
+echo "       - $resource"
 done
 
 cat << EOF

From 028583f09681dac0dd9ebb86fd2e90f261d0e96e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Thu, 18 Feb 2021 16:10:04 +0100
Subject: [PATCH 16/23] [__matrix_synapse_worker] fix config-path parameter in
 systemd unit

---
 .../files/matrix-synapse-worker@.service                        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service b/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service
index dba4bed..6352b00 100644
--- a/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service
+++ b/type/__matrix_synapse_worker/files/matrix-synapse-worker@.service
@@ -15,7 +15,7 @@ NotifyAccess=main
 User=matrix-synapse
 WorkingDirectory=/var/lib/matrix-synapse
 EnvironmentFile=/etc/default/matrix-synapse
-ExecStart=/usr/bin/python3 -m synapse.app.generic_worker --config-path=/etc/matrix-synapse/homeserver.yaml --config-path=/etc/matrix-synapse/conf.d/ --config-path=/etc/matrix-synapse/workers/
+ExecStart=/usr/bin/python3 -m synapse.app.generic_worker --config-path=/etc/matrix-synapse/homeserver.yaml --config-path=/etc/matrix-synapse/conf.d/ --config-path=/etc/matrix-synapse/workers/%i.yaml
 ExecReload=/bin/kill -HUP $MAINPID
 Restart=on-failure
 RestartSec=3

From f27e65f8e085a17a5d48d9ad771a379fda82444d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Fri, 19 Feb 2021 11:25:16 +0100
Subject: [PATCH 17/23] [__matrix_synapse*] add --bind-address flag

---
 type/__matrix_synapse/files/homeserver.yaml.sh | 18 +++++++++++++++---
 type/__matrix_synapse/man.rst                  |  4 ++++
 type/__matrix_synapse/manifest                 |  3 ++-
 .../parameter/default/bind-address             |  1 +
 .../parameter/optional_multiple                |  1 +
 .../files/worker.yaml.sh                       | 13 ++++++++++++-
 type/__matrix_synapse_worker/man.rst           | 12 +++++++++---
 type/__matrix_synapse_worker/manifest          |  3 ++-
 .../parameter/default/bind-address             |  1 +
 .../parameter/default/resource                 |  1 +
 .../parameter/optional_multiple                |  1 +
 11 files changed, 49 insertions(+), 9 deletions(-)
 create mode 100644 type/__matrix_synapse/parameter/default/bind-address
 create mode 100644 type/__matrix_synapse_worker/parameter/default/bind-address
 create mode 100644 type/__matrix_synapse_worker/parameter/default/resource

diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index 6ee035c..3ec4ba2 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -1,8 +1,19 @@
 #!/bin/sh
-# Note: template originally generated from synapse's 1.26.0 sample config.
+# Note: template originally generated from synapse's 1.26.0 sample config
 
 set -e
 
+generate_bind_addresses () {
+	if [ -n "$BIND_ADDRESSES" ]; then
+		echo "bind_addresses:"
+		for addr in $BIND_ADDRESSES; do
+			echo "    - '$addr'"
+		done
+	else
+		echo "bind_addresses: []"
+	fi
+}
+
 cat << EOF
 ###############################################################
 # THIS FILE HAS BEEN GENERATED BY CDIST. DO NOT EDIT BY HAND. #
@@ -263,7 +274,7 @@ listeners:
     tls: false
     type: http
     x_forwarded: true
-    bind_addresses: ['::1', '127.0.0.1']
+    $(generate_bind_addresses)
 
     resources:
       - names: ${MAIN_LISTENER_RESOURCES:?}
@@ -273,7 +284,8 @@ EOF
 if [ -n "$ENABLE_REPLICATION" ]; then
 	cat << EOF
   - port: 9093
-    bind_addresses: ['::1', '127.0.0.1']
+    $(generate_bind_addresses)
+
     type: http
     resources:
       - names: [replication]
diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index 94c6e34..b1799b6 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -167,6 +167,10 @@ registration-shared-secret
   If set, allows registration of standard or admin accounts by anyone who
   has the shared secret, even if registration is otherwise disabled.
 
+bind-address
+  Address used to bind the synapse listeners. Can be specified multiple times.
+  Defaults to '::1' and '127.0.0.1'.
+
 extra-setting
   Arbitrary string to be added to the configuration file. Can be specified multiple times.
 
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 9fad88e..c2167af 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -108,8 +108,9 @@ MAX_UPLOAD_SIZE=$(cat "$__object/parameter/max-upload-size")
 EXPOSE_METRICS=$(get_boolean_for 'expose-metrics')
 WEB_CLIENT_URL=$(cat "$__object/parameter/web-client-url")
 ROOM_ENCRYPTION_POLICY=$(cat "$__object/parameter/room-encryption-policy")
+BIND_ADDRESSES=$(cat "$__object/parameter/bind-address")
 export SERVER_NAME BASE_URL REPORT_STATS MAX_UPLOAD_SIZE EXPOSE_METRICS \
-	WEB_CLIENT_URL ROOM_ENCRYPTION_POLICY
+	WEB_CLIENT_URL ROOM_ENCRYPTION_POLICY BIND_ADDRESSES
 
 if [ -f "$__object/parameter/enable-server-notices" ]; then
     export ENABLE_SERVER_NOTICES=1
diff --git a/type/__matrix_synapse/parameter/default/bind-address b/type/__matrix_synapse/parameter/default/bind-address
new file mode 100644
index 0000000..260d4de
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/bind-address
@@ -0,0 +1 @@
+::1 127.0.0.1
diff --git a/type/__matrix_synapse/parameter/optional_multiple b/type/__matrix_synapse/parameter/optional_multiple
index c292cd7..8aa5c29 100644
--- a/type/__matrix_synapse/parameter/optional_multiple
+++ b/type/__matrix_synapse/parameter/optional_multiple
@@ -3,3 +3,4 @@ registration-allows-email-pattern
 auto-join-room
 app-service-config-file
 extra-setting
+bind-address
diff --git a/type/__matrix_synapse_worker/files/worker.yaml.sh b/type/__matrix_synapse_worker/files/worker.yaml.sh
index a21d64c..d7303c7 100755
--- a/type/__matrix_synapse_worker/files/worker.yaml.sh
+++ b/type/__matrix_synapse_worker/files/worker.yaml.sh
@@ -1,5 +1,16 @@
 #!/bin/sh
 
+generate_bind_addresses () {
+	if [ -n "$WORKER_BIND_ADDRESSES" ]; then
+		echo "bind_addresses:"
+		for addr in $WORKER_BIND_ADDRESSES; do
+			echo "    - '$addr'"
+		done
+	else
+		echo "bind_addresses: []"
+	fi
+}
+
 cat << EOF
 worker_app: "${WORKER_APP:?}"
 worker_name: "${WORKER_NAME:?}"
@@ -12,7 +23,7 @@ worker_listeners:
  - type: http
    port: ${WORKER_PORT:?}
    x_forwarded: true
-   bind_addresses: ['::1', '127.0.0.1']
+   $(generate_bind_addresses)
    resources:
      - names:
 EOF
diff --git a/type/__matrix_synapse_worker/man.rst b/type/__matrix_synapse_worker/man.rst
index c8150f6..7f9269d 100644
--- a/type/__matrix_synapse_worker/man.rst
+++ b/type/__matrix_synapse_worker/man.rst
@@ -27,9 +27,6 @@ app
 port
   Port on which this worker will listen.
 
-resource
-  Resources to be served by this worker. Can be specified multiple times.
-
 OPTIONAL PARAMETERS
 -------------------
 replication-host
@@ -43,6 +40,15 @@ log-config
   Path to log configuration. Defaults to synapse's main process log
   configuration.
 
+resource
+  Resources to be served by this worker. Can be specified multiple times.
+  Defaults to 'client' and 'federation'.
+
+bind-address
+  Address used to bind the synapse listeners. Can be specified multiple times.
+  Defaults to '::1' and '127.0.0.1'.
+
+
 EXAMPLES
 --------
 
diff --git a/type/__matrix_synapse_worker/manifest b/type/__matrix_synapse_worker/manifest
index fdbcbf4..81db378 100755
--- a/type/__matrix_synapse_worker/manifest
+++ b/type/__matrix_synapse_worker/manifest
@@ -32,7 +32,8 @@ WORKER_NAME=$__object_id
 WORKER_APP=$(cat "$__object/parameter/app")
 WORKER_PORT=$(cat "$__object/parameter/port")
 WORKER_RESOURCES=$(cat "$__object/parameter/resource")
-export WORKER_APP WORKER_NAME WORKER_PORT WORKER_RESOURCES
+WORKER_BIND_ADDRESSES=$(cat "$__object/parameter/bind-address")
+export WORKER_APP WORKER_NAME WORKER_PORT WORKER_RESOURCES WORKER_BIND_ADDRESSES
 
 if [ -f "$__object/parameter/log-config" ]; then
 	WORKER_LOG_CONFIG=$(cat "$__object/parameter/log-config")
diff --git a/type/__matrix_synapse_worker/parameter/default/bind-address b/type/__matrix_synapse_worker/parameter/default/bind-address
new file mode 100644
index 0000000..260d4de
--- /dev/null
+++ b/type/__matrix_synapse_worker/parameter/default/bind-address
@@ -0,0 +1 @@
+::1 127.0.0.1
diff --git a/type/__matrix_synapse_worker/parameter/default/resource b/type/__matrix_synapse_worker/parameter/default/resource
new file mode 100644
index 0000000..16378ec
--- /dev/null
+++ b/type/__matrix_synapse_worker/parameter/default/resource
@@ -0,0 +1 @@
+client federation
diff --git a/type/__matrix_synapse_worker/parameter/optional_multiple b/type/__matrix_synapse_worker/parameter/optional_multiple
index 91e75c6..d777f84 100644
--- a/type/__matrix_synapse_worker/parameter/optional_multiple
+++ b/type/__matrix_synapse_worker/parameter/optional_multiple
@@ -1 +1,2 @@
 resource
+bind-address

From d589993c6d44305891c167bb1d75403bdecbbe11 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Mon, 22 Feb 2021 13:12:47 +0100
Subject: [PATCH 18/23] [__matrix_synapse] fix typo/error in LDAP configuration
 handling

---
 type/__matrix_synapse/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index c2167af..644258f 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -147,7 +147,7 @@ export DATABASE_ENGINE DATABASE_NAME DATABASE_HOST DATABASE_USER \
 	DATABASE_PASSWORD
 
 # LDAP-based authentication.
-if [ -f "$__object/enable-ldap-auth" ]; then
+if [ -f "$__object/parameter/enable-ldap-auth" ]; then
 	ENABLE_LDAP_AUTH=$(get_boolean_for 'enable-ldap-auth')
 	export ENABLE_LDAP_AUTH
 fi

From b3f5244cd658b042336a17c0d2b64ca2dd0b32f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Mon, 22 Feb 2021 13:59:53 +0100
Subject: [PATCH 19/23] __matrix_synapse: fix SMTP password handling

---
 type/__matrix_synapse/files/homeserver.yaml.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index 3ec4ba2..eea3284 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -2273,7 +2273,7 @@ email:
   # authentication is attempted.
   #
   smtp_user: "$SMTP_USER"
-  smtp_pass: "$SMTP_PASS"
+  smtp_pass: "$SMTP_PASSWORD"
 
   # Uncomment the following to require TLS transport security for SMTP.
   # By default, Synapse will connect over plain text, and will then switch to

From 4e37bc2245cad8d37a8a2489a480d9b83b087769 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Wed, 24 Feb 2021 14:36:00 +0100
Subject: [PATCH 20/23] [__matrix_synapse] fix typo in complexity threshold
 handling

---
 type/__matrix_synapse/files/homeserver.yaml.sh | 4 ++--
 type/__matrix_synapse/manifest                 | 4 ++--
 type/__matrix_synapse/parameter/optional       | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index eea3284..0ad3c42 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -392,11 +392,11 @@ limit_remote_rooms:
 
   # the limit above which rooms cannot be joined. The default is 1.0.
   #
-  complexity: ${REMOTE_ROOM_COMPLEXITY_TRESHOLD:?}
+  complexity: ${REMOTE_ROOM_COMPLEXITY_THRESHOLD:?}
 
   # override the error which is returned when the room is too complex.
   #
-  complexity_error: "This room is too complex."
+  complexity_error: "This room is too complex - local complexity policy prevents you from joing."
 
   # allow server admins to join complex rooms. Default is false.
   #
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 644258f..91e92a1 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -210,9 +210,9 @@ fi
 ALLOW_PUBLIC_ROOMS_OVER_FEDERATION=$(get_boolean_for 'allow-public-room-over-federation')
 ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH=$(get_boolean_for 'allow-public-rooms-without-auth')
 LIMIT_REMOTE_ROOM_COMPLEXITY=$(get_boolean_for 'limit-remote-room-complexity')
-REMOTE_ROOM_COMPLEXITY_TRESHOLD=$(cat "$__object/parameter/remote-room-complexity-treshold")
+REMOTE_ROOM_COMPLEXITY_THRESHOLD=$(cat "$__object/parameter/remote-room-complexity-threshold")
 export ALLOW_PUBLIC_ROOMS_OVER_FEDERATION ALLOW_PUBLIC_ROOMS_WITHOUT_AUTH \
-	LIMIT_REMOTE_ROOM_COMPLEXITY REMOTE_ROOM_COMPLEXITY_TRESHOLD
+	LIMIT_REMOTE_ROOM_COMPLEXITY REMOTE_ROOM_COMPLEXITY_THRESHOLD
 
 if [ -f "$__object/parameter/disable-federation" ]; then
 	export DISABLE_FEDERATION=1
diff --git a/type/__matrix_synapse/parameter/optional b/type/__matrix_synapse/parameter/optional
index 2f0bce4..a616538 100644
--- a/type/__matrix_synapse/parameter/optional
+++ b/type/__matrix_synapse/parameter/optional
@@ -23,7 +23,7 @@ rc-login-per-second
 rc-login-burst
 global-cache-factor
 event-cache-size
-remote-room-complexity-treshold
+remote-room-complexity-threshold
 room-encryption-policy
 notification-from
 message-max-lifetime

From 7983e341e5f452923cf1bc16e8286086b5658a38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Wed, 24 Feb 2021 17:58:42 +0100
Subject: [PATCH 21/23] [__matrix_synapse] fix yet more typos in parameter
 handling

---
 type/__matrix_synapse/man.rst                                   | 2 +-
 ...oom-complexity-treshold => remote-room-complexity-threshold} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename type/__matrix_synapse/parameter/default/{remote-room-complexity-treshold => remote-room-complexity-threshold} (100%)

diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index b1799b6..e693809 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -159,7 +159,7 @@ worker-replication-secret
   from workers. Ignored if worker-mode is not set. By default this is unused and
   traffic is not authenticated.
 
-background-task-worker
+background-tasks-worker
   The worker that is used to run background tasks (e.g. cleaning up expired
   data). If not provided this defaults to the main process.
 
diff --git a/type/__matrix_synapse/parameter/default/remote-room-complexity-treshold b/type/__matrix_synapse/parameter/default/remote-room-complexity-threshold
similarity index 100%
rename from type/__matrix_synapse/parameter/default/remote-room-complexity-treshold
rename to type/__matrix_synapse/parameter/default/remote-room-complexity-threshold

From e10ae4d0a773751fee44ecf2379f463bb4287e77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Wed, 24 Feb 2021 18:50:01 +0100
Subject: [PATCH 22/23] [__matrix_synapse] Wire parameters for PGSQL pool size

---
 type/__matrix_synapse/files/homeserver.yaml.sh              | 2 ++
 type/__matrix_synapse/man.rst                               | 6 ++++++
 type/__matrix_synapse/manifest                              | 4 +++-
 .../parameter/default/database-connection-pool-max          | 1 +
 .../parameter/default/database-connection-pool-min          | 1 +
 type/__matrix_synapse/parameter/optional                    | 2 ++
 6 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 type/__matrix_synapse/parameter/default/database-connection-pool-max
 create mode 100644 type/__matrix_synapse/parameter/default/database-connection-pool-min

diff --git a/type/__matrix_synapse/files/homeserver.yaml.sh b/type/__matrix_synapse/files/homeserver.yaml.sh
index 0ad3c42..bc94391 100755
--- a/type/__matrix_synapse/files/homeserver.yaml.sh
+++ b/type/__matrix_synapse/files/homeserver.yaml.sh
@@ -835,6 +835,8 @@ database:
     host: "${DATABASE_HOST:?}"
     user: "${DATABASE_USER:?}"
     password: "$DATABASE_PASSWORD"
+    cp_min: ${DATABASE_CP_MIN:?}
+    cp_min: ${DATABASE_CP_MAX:?}
 EOF
 	;;
 	*)
diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index e693809..a951d24 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -39,6 +39,12 @@ database-user
 database-password
   Database password, only used with PostgresSQL.
 
+database-connection-pool-min
+  The minimum number of connections in pool, defaults to 3.
+
+database-connection-pool-max
+  The maximum number of connections in pool, defaults to 5.
+
 ldap-uri
   Address of your LDAP server.
 
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 91e92a1..055fc81 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -143,8 +143,10 @@ DATABASE_NAME=$(cat "$__object/parameter/database-name")
 DATABASE_HOST=$(cat "$__object/parameter/database-host")
 DATABASE_USER=$(cat "$__object/parameter/database-user")
 DATABASE_PASSWORD=$(cat "$__object/parameter/database-password")
+DATABASE_CP_MIN=$(cat "$__object/parameter/database-connection-pool-min")
+DATABASE_CP_MAX=$(cat "$__object/parameter/database-connection-pool-max")
 export DATABASE_ENGINE DATABASE_NAME DATABASE_HOST DATABASE_USER \
-	DATABASE_PASSWORD
+	DATABASE_PASSWORD DATABASE_CP_MIN DATABASE_CP_MAX
 
 # LDAP-based authentication.
 if [ -f "$__object/parameter/enable-ldap-auth" ]; then
diff --git a/type/__matrix_synapse/parameter/default/database-connection-pool-max b/type/__matrix_synapse/parameter/default/database-connection-pool-max
new file mode 100644
index 0000000..7ed6ff8
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/database-connection-pool-max
@@ -0,0 +1 @@
+5
diff --git a/type/__matrix_synapse/parameter/default/database-connection-pool-min b/type/__matrix_synapse/parameter/default/database-connection-pool-min
new file mode 100644
index 0000000..00750ed
--- /dev/null
+++ b/type/__matrix_synapse/parameter/default/database-connection-pool-min
@@ -0,0 +1 @@
+3
diff --git a/type/__matrix_synapse/parameter/optional b/type/__matrix_synapse/parameter/optional
index a616538..1378365 100644
--- a/type/__matrix_synapse/parameter/optional
+++ b/type/__matrix_synapse/parameter/optional
@@ -1,6 +1,8 @@
 database-host
 database-user
 database-password
+database-connection-pool-min
+database-connection-pool-max
 ldap-uri
 ldap-base-dn
 ldap-uid-attribute

From 3263c5dddd0ea7f1f374cb24298a823bfcf08215 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Wed, 24 Feb 2021 19:31:48 +0100
Subject: [PATCH 23/23] [__matrix_synapse] add outbound-federation-worker
 parameter

---
 type/__matrix_synapse/man.rst                     |  4 ++++
 type/__matrix_synapse/manifest                    | 10 +++++++++-
 type/__matrix_synapse/parameter/optional_multiple |  1 +
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/type/__matrix_synapse/man.rst b/type/__matrix_synapse/man.rst
index a951d24..4eb23bb 100644
--- a/type/__matrix_synapse/man.rst
+++ b/type/__matrix_synapse/man.rst
@@ -169,6 +169,10 @@ background-tasks-worker
   The worker that is used to run background tasks (e.g. cleaning up expired
   data). If not provided this defaults to the main process.
 
+outbound-federation-worker
+  Worker to be used for sending federation requests. Can be specified multiple
+  times. Disables sending outbound federation requests from the master process.
+
 registration-shared-secret
   If set, allows registration of standard or admin accounts by anyone who
   has the shared secret, even if registration is otherwise disabled.
diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 055fc81..4650a17 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -266,11 +266,19 @@ fi
 # Worker-mode configuration.
 export MAIN_LISTENER_PORT=8008
 export ENABLE_MEDIA_REPO='true'
-export SEND_FEDERATION_FROM_MAIN_PROCESS='true'
+if [ -f "$__object/parameter/outbound-federation-worker" ]; then
+	FEDERATION_SENDER_INSTANCES=$(cat "$__object/parameter/outbound-federation-worker")
+	export FEDERATION_SENDER_INSTANCES
+fi
 MAIN_LISTENER_RESOURCES="[federation,client]"
 if [ "$EXPOSE_METRICS" = "true" ]; then
 	MAIN_LISTENER_RESOURCES="$(echo "$MAIN_LISTENER_RESOURCES" | tr -d ']'),metrics]"
 fi
+if [ -n "$FEDERATION_SENDER_INSTANCES" ]; then
+	export SEND_FEDERATION_FROM_MAIN_PROCESS='false'
+else
+	export SEND_FEDERATION_FROM_MAIN_PROCESS='true'
+fi
 export MAIN_LISTENER_RESOURCES
 
 ENABLE_REPLICATION=
diff --git a/type/__matrix_synapse/parameter/optional_multiple b/type/__matrix_synapse/parameter/optional_multiple
index 8aa5c29..8871dd6 100644
--- a/type/__matrix_synapse/parameter/optional_multiple
+++ b/type/__matrix_synapse/parameter/optional_multiple
@@ -4,3 +4,4 @@ auto-join-room
 app-service-config-file
 extra-setting
 bind-address
+outbound-federation-worker