chore: publish 1.3.0+v1.55.2 release

Closes https://git.coopcloud.tech/coop-cloud/matrix-synapse/issues/25.

.drone.yml

@@ -1,10 +0,0 @@
----
-kind: pipeline
-name: recipe release
-steps:
-  - name: release a new version
-    image: thecoopcloud/drone-abra:latest
-    settings:
-      command: recipe matrix-synapse release
-      deploy_key:
-        from_secret: abra_bot_deploy_key

.env.sample

@@ -15,6 +15,9 @@ COMPOSE_FILE="compose.yml"
 
 #DISABLE_FEDERATION=1
 
+ENABLE_REGISTRATION=false
+PASSWORD_LOGIN_ENABLED=true
+
 #AUTO_JOIN_ROOM_ENABLED=1
 #AUTO_JOIN_ROOM="#example:example.com"
 

.gitignore

@@ -1 +1,2 @@
-/.envrc
+.envrc
+synapse

README.md

@@ -1,7 +1,5 @@
 # Matrix (Synapse)
 
-[![Build Status](https://drone.autonomic.zone/api/badges/coop-cloud/matrix-synapse/status.svg?ref=refs/heads/main)](https://drone.autonomic.zone/coop-cloud/matrix-synapse)
-
 <!-- metadata -->
 
 * **Category**: Apps
@@ -9,30 +7,47 @@
 * **Image**: [`matrixdotorg/synapse`](https://hub.docker.com/r/matrixdotorg/synapse), 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: No
-* **Email**: No
+* **Email**: Yes
 * **Tests**: No
-* **SSO**: No
+* **SSO**: Yes
+
 <!-- endmetadata -->
 
 ## Basic usage
 
-1. Set up Docker Swarm and [`abra`]
-2. Deploy [`coop-cloud/traefik`]
-3. `abra app new matrix-synapse --secrets` (optionally with `--pass` if you'd like
-   to save secrets in `pass`)
-4. `abra app YOURAPPDOMAIN config` - be sure to change `$DOMAIN` to something that resolves to
-   your Docker swarm box
+1. Set up Docker Swarm and [`abra`](https://docs.coopcloud.tech/abra/)
+2. Deploy [`coop-cloud/traefik`](https://git.coopcloud.tech/coop-cloud/traefik)
+3. `abra app new matrix-synapse --secrets` (optionally with `--pass` if you'd like to save secrets in `pass`)
+4. `abra app YOURAPPDOMAIN config` - be sure to change `$DOMAIN` to something that resolves to your Docker swarm box
 5. `abra app YOURAPPDOMAIN deploy`
-6. Create an initial user:
-   `abra app YOURAPPDOMAIN run app register_new_matrix_user -c /data/homeserver.yaml http://localhost:8008`
-
-[abra]: https://git.autonomic.zone/autonomic-cooperative/abra
-[cc-traefik]: https://git.autonomic.zone/coop-cloud/traefik
+6. Create an initial user: `abra app YOURAPPDOMAIN run app register_new_matrix_user -c /data/homeserver.yaml http://localhost:8008`
 
 ## Tips & Tricks
 
+### Disabling federation
+
+> We're not sure this does it exactly and there is still a discussion running
+> upstrem about whether this is the right way to do it & whether it could be
+> more convenient. We welcome issues / change sets to close up more federation
+> functionality.
+
+- use `DISABLE_FEDERATION=1` to turn off federation listeners
+- don't use [`compose.matrix.yml`](https://git.coopcloud.tech/coop-cloud/traefik/src/branch/master/compose.matrix.yml) in your traefik config to keep the federation ports closed
+
+### Seeing what changed in `homeserver.yaml` between versions
+
+Change the version range to suit your needs.
+
+```
+git clone https://github.com/matrix-org/synapse
+cd synapse/docs
+git log --follow -p v1.48.0..v1.51.0 sample_config.yaml
+```
+
 ### Generating a new `homeserver.yaml`
 
+The default is also available to see [here](https://matrix-org.github.io/synapse/latest/usage/configuration/homeserver_sample_config.html).
+
 ```
 docker run -it \
   --entrypoint="" \
@@ -52,3 +67,9 @@ docker run -it \
   matrixdotorg/synapse:v1.48.0 \
   sh -c '/start.py generate; cat /data/foo.com.log.config' > log.config
 ```
+
+### Getting client discovery on a custom domain
+
+You'll need to deploy something like [this](https://git.autonomic.zone/ruangrupa/well-known-uris).
+
+This could be implemented in this recipe but we haven't merged it in yet. Chang sets are welcome.

abra.sh

@@ -1,3 +1,3 @@
 export ENTRYPOINT_CONF_VERSION=v1
-export HOMESERVER_YAML_VERSION=v3
+export HOMESERVER_YAML_VERSION=v6
 export LOG_CONFIG_VERSION=v2

compose.keycloak2.yml

@@ -0,0 +1,17 @@
+---
+version: "3.8"
+
+services:
+  app:
+    secrets:
+      - keycloak2_client_secret
+    environment:
+      - KEYCLOAK2_CLIENT_ID
+      - KEYCLOAK2_ENABLED
+      - KEYCLOAK2_NAME
+      - KEYCLOAK2_URL
+
+secrets:
+  keycloak2_client_secret:
+    external: true
+    name: ${STACK_NAME}_keycloak2_client_secret_${SECRET_KEYCLOAK2_CLIENT_SECRET_VERSION}

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "matrixdotorg/synapse:v1.48.0"
+    image: "matrixdotorg/synapse:v1.55.2"
     volumes:
       - "data:/data"
     secrets:
@@ -18,8 +18,10 @@ services:
       - DOMAIN
       - ENABLE_3PID_LOOKUP
       - ENABLE_ALLOWLIST
+      - ENABLE_REGISTRATION
       - FEDERATION_ALLOWLIST
       - LETSENCRYPT_HOST=${DOMAIN}
+      - PASSWORD_LOGIN_ENABLED
       - REDACTION_RETENTION_PERIOD
       - ROOT_LOG_LEVEL
       - SQL_LOG_LEVEL
@@ -51,15 +53,17 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=0.1.0+v1.48.0"
+        - "coop-cloud.${STACK_NAME}.version=1.3.0+v1.55.2"
 
   db:
     image: postgres:13-alpine
     secrets:
       - db_password
     environment:
+      - LC_COLLATE=C
+      - LC_CTYPE=C
       - POSTGRES_DB=synapse
-      - POSTGRES_INITDB_ARGS="--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
+      - POSTGRES_INITDB_ARGS="-E \"UTF8\""
       - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
       - POSTGRES_USER=synapse
     networks:

homeserver.yaml.tmpl

@@ -1169,7 +1169,7 @@ turn_allow_guests: {{ env "TURN_ALLOW_GUESTS" }}
 
 # Enable registration for new users.
 #
-#enable_registration: false
+enable_registration: {{ env "ENABLE_REGISTRATION" }}
 
 # Time that a user's session remains valid for, after they log in.
 #
@@ -1897,6 +1897,19 @@ oidc_providers:
         display_name_template: "{{ "{{ user.name }}" }}"
   {{ end }}
 
+  {{ if eq (env "KEYCLOAK2_ENABLED") "1" }}
+  - idp_id: keycloak2
+    idp_name: {{ env "KEYCLOAK2_NAME" }}
+    issuer: "{{ env "KEYCLOAK2_URL" }}"
+    client_id: "{{ env "KEYCLOAK2_CLIENT_ID" }}"
+    client_secret: "{{ secret "keycloak2_client_secret" }}"
+    scopes: ["openid", "profile"]
+    user_mapping_provider:
+      config:
+        localpart_template: "{{ "{{ user.preferred_username }}" }}"
+        display_name_template: "{{ "{{ user.name }}" }}"
+  {{ end }}
+
 
 # Enable Central Authentication Service (CAS) for registration and login.
 #
@@ -2035,7 +2048,7 @@ sso:
 password_config:
    # Uncomment to disable password login
    #
-   #enabled: false
+   enabled: {{ env "PASSWORD_LOGIN_ENABLED" }}
 
    # Uncomment to disable authentication against the local password
    # database. This is ignored if `enabled` is false, and is only useful

release/1.3.0+v1.55.2

@@ -0,0 +1,3 @@
+The deployment failed due to the app/db getting confused. I think this is just
+due to the recipe not having good healthcheck config. After the app container
+flapped a bit, everything came up nicely. d1 @ autonomic co-op