Merge pull request 'Add documentation for matrix federation + traefik labels for federation via port 8448 on matrix-federation entrypoint' (#62 ) from compress-and-federate into main

Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/62 Reviewed-by: 3wordchant <3wordchant@noreply.git.coopcloud.tech>
Merge pull request 'Add compression to recipe' (#61 ) from compress into main
2026-06-08 18:17:34 +00:00 · 2026-06-08 18:17:11 +00:00 · 2026-06-08 18:13:25 +00:00 · 2026-06-08 14:03:16 -04:00 · 2026-06-04 14:30:29 -04:00 · 2026-05-28 17:11:13 +00:00
42 changed files with 2035 additions and 730 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -17,17 +17,21 @@ steps:
      DOMAIN: matrix-synapse.swarm-test.autonomic.zone
      STACK_NAME: matrix-synapse
      LETS_ENCRYPT_ENV: production
-      DISCORD_BRIDGE_YAML_VERSION: v1
-      ENTRYPOINT_CONF_VERSION: v1
-      HOMESERVER_YAML_VERSION: v17
-      LOG_CONFIG_VERSION: v1
-      SHARED_SECRET_AUTH_VERSION: v1
-      SIGNAL_BRIDGE_YAML_VERSION: v1
-      TELEGRAM_BRIDGE_YAML_VERSION: v1
+      DISCORD_BRIDGE_YAML_VERSION: v2
+      ENTRYPOINT_CONF_VERSION: v3
+      HOMESERVER_YAML_VERSION: v29
+      LOG_CONFIG_VERSION: v2
+      SHARED_SECRET_AUTH_VERSION: v2
+      SIGNAL_BRIDGE_YAML_VERSION: v5
+      TELEGRAM_BRIDGE_YAML_VERSION: v6
+      PG_BACKUP_VERSION: v1
+      WK_CLIENT_VERSION: v1
+      WK_SERVER_VERSION: v1
+      NGINX_CONFIG_VERSION: v8
      SECRET_DB_PASSWORD_VERSION: v1
      SECRET_FORM_SECRET_VERSION: v1
-      SECRET_MACAROON_SECRET_KEY_VERSION: v1
-      SECRET_REGISTRATION_SHARED_SECRET_VERSION: v1
+      SECRET_MACAROON_VERSION: v1
+      SECRET_REGISTRATION_VERSION: v1
 trigger:
  branch:
    - main
@ -43,7 +47,7 @@ steps:
        from_secret: drone_abra-bot_token
      fork: true
      repositories:
-        - coop-cloud/auto-recipes-catalogue-json
+        - toolshed/auto-recipes-catalogue-json

 trigger:
  event: tag
--- a/.env.sample
+++ b/.env.sample
@ -1,10 +1,12 @@
 TYPE=matrix-synapse
 DOMAIN=matrix-synapse.example.com
+# SERVER_NAME=example.com
 TIMEOUT=300
 ENABLE_AUTO_UPDATE=true
 LETS_ENCRYPT_ENV=production
 COMPOSE_FILE="compose.yml"
 # POST_DEPLOY_CMDS="db set_admin"
+ENABLE_BACKUPS=true

 ## Admin details

@ -17,20 +19,97 @@ SECRET_FORM_SECRET_VERSION=v1
 SECRET_MACAROON_VERSION=v1
 SECRET_REGISTRATION_VERSION=v1

+## Authentication
+
+# All login / SSO / MAS-related toggles in one place.
+
+### Local password & registration (Synapse native)
+
+# With MAS_ENABLED=1 you must set PASSWORD_LOGIN_ENABLED=false — Synapse forbids legacy password DB alongside matrix_authentication_service.
+PASSWORD_LOGIN_ENABLED=true
+ENABLE_REGISTRATION=false
+
+# Token based registration. Enable ADMIN_INTERFACE (below) to use the admin interface to generate tokens.
+#REGISTRATION_REQUIRES_TOKEN=true
+
+### OIDC via Keycloak-shaped API (e.g. Authentik)
+
+#COMPOSE_FILE="$COMPOSE_FILE:compose.keycloak.yml"
+#KEYCLOAK_ENABLED=1
+#KEYCLOAK_ID=keycloak
+#KEYCLOAK_NAME=
+#KEYCLOAK_URL=
+#KEYCLOAK_CLIENT_ID=
+#KEYCLOAK_CLIENT_DOMAIN=
+#KEYCLOAK_ALLOW_EXISTING_USERS=false
+#SECRET_KEYCLOAK_CLIENT_SECRET_VERSION=v1
+
+### Second OIDC provider (compose.keycloak2.yml)
+
+#COMPOSE_FILE="$COMPOSE_FILE:compose.keycloak2.yml"
+#KEYCLOAK2_ENABLED=1
+#KEYCLOAK2_ID=keycloak2
+#KEYCLOAK2_NAME=
+#KEYCLOAK2_URL=
+#KEYCLOAK2_CLIENT_ID=
+#KEYCLOAK2_CLIENT_DOMAIN=
+#KEYCLOAK2_ALLOW_EXISTING_USERS=false
+#SECRET_KEYCLOAK2_CLIENT_SECRET_VERSION=v1
+
+### Third OIDC provider (compose.keycloak3.yml)
+
+#COMPOSE_FILE="$COMPOSE_FILE:compose.keycloak3.yml"
+#KEYCLOAK3_ENABLED=1
+#KEYCLOAK3_ID=keycloak3
+#KEYCLOAK3_NAME=
+#KEYCLOAK3_URL=
+#KEYCLOAK3_CLIENT_ID=
+#KEYCLOAK3_CLIENT_DOMAIN=
+#KEYCLOAK3_ALLOW_EXISTING_USERS=false
+#SECRET_KEYCLOAK3_CLIENT_SECRET_VERSION=v1
+
+### Matrix Authentication Service (MAS) — Element X / OIDC-native auth
+
+#COMPOSE_FILE="$COMPOSE_FILE:compose.mas.yml"
+#MAS_ENABLED=1 # Leave commented if you plan to migrate an existing homeserver
+#PASSWORD_LOGIN_ENABLED=false
+#SECRET_MAS_ENCRYPTION_VERSION=v1 # length=64 charset=hex
+#SECRET_MAS_SYNAPSE_SHARED_VERSION=v1 # length=64 charset=hex
+# PEM private key: abra cannot generate this format — use `abra app cmd -l YOURAPPDOMAIN generate_mas_signing_rsa`
+#SECRET_MAS_SIGNING_RSA_VERSION=v1 # generate=false
+
+#### MAS upstream OIDC provider (e.g. Authentik)
+# Create a new OAuth2 app in your IdP with redirect URI: https://<DOMAIN>/upstream/callback/<MAS_UPSTREAM_PROVIDER_ID>
+#COMPOSE_FILE="$COMPOSE_FILE:compose.mas-upstream.yml"
+#MAS_UPSTREAM_PROVIDER_ID=          # ULID, e.g. 01JSHPZHAXC50QBKH67MH33TNF — generate at https://www.ulidtools.com
+#MAS_UPSTREAM_ISSUER=               # e.g. https://auth.example.com/application/o/matrix-mas/
+#MAS_UPSTREAM_CLIENT_ID=
+#MAS_UPSTREAM_HUMAN_NAME=Authentik
+# For migration from previous direct Keycloud-style config: set to oidc-<your old KEYCLOAK_ID> so syn2mas maps users correctly.
+#MAS_UPSTREAM_SYNAPSE_IDP_ID=
+#SECRET_MAS_UPSTREAM_CLIENT_VERSION=v1
+
+### Shared secret auth (bridges / automation)
+
+#COMPOSE_FILE="$COMPOSE_FILE:compose.shared_secret_auth.yml"
+#SHARED_SECRET_AUTH_ENABLED=1
+#SECRET_SHARED_SECRET_AUTH_VERSION=v1 # length=128
+
 ## Federation

 #DISABLE_FEDERATION=1

+# SERVE_SERVER_WELLKNOWN only works if SERVER_NAME and DOMAIN are the same
+# if they are different, then a different federation method is needed (like compose.wellknown.yml)
 # Set "true" to enable federation endpoint on $DOMAIN/.well-known/matrix/server
 SERVE_SERVER_WELLKNOWN=false

+# Serve /.well-known/matrix/{server,client} on SERVER_NAME via Traefik.
+# Can be used when SERVER_NAME != DOMAIN and SERVER_NAME is served by Traefik.
+#COMPOSE_FILE="$COMPOSE_FILE:compose.wellknown.yml"
+
 ALLOW_PUBLIC_ROOMS_FEDERATION=false

-## Registration
-
-ENABLE_REGISTRATION=false
-PASSWORD_LOGIN_ENABLED=true
-
 ## Room auto-join

 #AUTO_JOIN_ROOM_ENABLED=1
@ -42,6 +121,13 @@ PASSWORD_LOGIN_ENABLED=true
 SQL_LOG_LEVEL=WARN
 ROOT_LOG_LEVEL=WARN

+# for nginx
+NGINX_ACCESS_LOG_LOCATION="/dev/null"
+NGINX_ERROR_LOG_LOCATION="/dev/null"
+# Comment the previous two lines and uncomment these to enable logging
+#NGINX_ACCESS_LOG_LOCATION="/dev/stdout"
+#NGINX_ERROR_LOG_LOCATION="/dev/stderr"
+
 ## Privacy

 ENABLE_3PID_LOOKUP=true
@ -56,6 +142,18 @@ ENCRYPTED_BY_DEFAULT=all
 # Set these to keyservers you trust - usually the same as your federation allowlist
 #TRUSTED_KEYSERVERS="trusted_key_servers:\n  - server_name: 'example.com'\n  - server_name: 'example2.com'"

+# some optional configs to increase privacy and security
+#REQUIRE_AUTH_FOR_PROFILE_REQUESTS=true
+#LIMIT_PROFILE_REQUESTS_TO_USERS_WHO_SHARE_ROOMS=true
+#DELETE_STALE_DEVICES_AFTER=1y
+#SESSION_LIFETIME=60d
+#TRACK_PUPPETED_USER_IPS=true
+
+
+## Room complexity limit (prevents joining large remote rooms that cause DB bloat)
+## complexity ≈ state_events / 500. Default 100.0 blocks rooms with >50000 state events.
+#ROOM_COMPLEXITY_LIMIT=100.0
+
 ## Retention

 ALLOWED_LIFETIME_MAX=4w
@ -66,30 +164,20 @@ RETENTION_MAX_LIFETIME=4w
 #MEDIA_RETENTION_LOCAL_LIFETIME=30d
 #MEDIA_RETENTION_REMOTE_LIFETIME=14d

-## Keycloak SSO
+## Old Signing Key
+#OLD_SIGNING_KEY_ID=a_OLDKEYID
+#OLD_SIGNING_KEY=base64string
+#OLD_SIGNING_KEY_EXPIRES=123456789123

-#COMPOSE_FILE="$COMPOSE_FILE:compose.keycloak.yml"
-#KEYCLOAK_ENABLED=1
-#KEYCLOAK_ID=keycloak
-#KEYCLOAK_NAME=
-#KEYCLOAK_URL=
-#KEYCLOAK_CLIENT_ID=
-#KEYCLOAK_CLIENT_DOMAIN=
-#KEYCLOAK_ALLOW_EXISTING_USERS=false
-#SECRET_KEYCLOAK_CLIENT_SECRET_VERSION=v1
+## Ratelimit
+
+#LOGIN_LIMIT_IP_PER_SECOND=5
+#LOGIN_LIMIT_IP_BURST=15
+#LOGIN_LIMIT_ACCOUNT_PER_SECOND=1
+#LOGIN_LIMIT_ACCOUNT_BURST=10

 ## TURN

-#COMPOSE_FILE="$COMPOSE_FILE:compose.keycloak3.yml"
-#KEYCLOAK3_ENABLED=1
-#KEYCLOAK3_ID=keycloak3
-#KEYCLOAK3_NAME=
-#KEYCLOAK3_URL=
-#KEYCLOAK3_CLIENT_ID=
-#KEYCLOAK3_CLIENT_DOMAIN=
-#KEYCLOAK3_ALLOW_EXISTING_USERS=false
-#SECRET_KEYCLOAK3_CLIENT_SECRET_VERSION=v1
-
 #COMPOSE_FILE="$COMPOSE_FILE:compose.turn.yml"
 #TURN_ENABLED=1
 #TURN_URIS="[\"turns:coturn.foo.zone?transport=udp\", \"turns:coturn.foo.zone?transport=tcp\"]"
@ -107,6 +195,13 @@ RETENTION_MAX_LIFETIME=4w
 #SMTP_USER=
 #SECRET_SMTP_PASSWORD_VERSION=v1

+## USER-DIRECTORY
+
+#USER_DIRECTORY_ENABLED=true
+#USER_DIRECTORY_SEARCH_ALL_USERS=true
+#USER_DIRECTORY_PREFER_LOCAL_USERS=true
+#USER_DIRECTORY_SHOW_LOCKED_USERS=false
+
 ## App services

 #APP_SERVICES_ENABLED=1
@ -118,12 +213,12 @@ RETENTION_MAX_LIFETIME=4w
 #APP_SERVICE_BOT_USERNAME=telegrambot
 #APP_SERVICE_DISPLAY_NAME="Telegram bridge bot"
 #APP_SERVICE_ID=
-#HOMESERVER_DOMAIN=
-#HOMESERVER_URL=
+#HOMESERVER_DOMAIN=$DOMAIN
+#HOMESERVER_URL=https://$DOMAIN
 #VERIFY_SSL=false
 #ENABLE_ENCRYPTION=true
 #TELEGRAM_APP_ID=
-#TELEGRAM_BRIDGE_PERMISSIONS="{ \"*\": \"relaybot\" }"
+#TELEGRAM_BRIDGE_PERMISSIONS="{ \"*\": \"relaybot\", \"@foo:matrix.example.com\": \"admin\" }"
 #TELEGRAM_SYNC_CHANNEL_MEMBERS=true
 #SECRET_TELEGRAM_DB_PASSWORD_VERSION=v1
 #SECRET_TELEGRAM_API_HASH_VERSION=v1
@ -143,13 +238,25 @@ RETENTION_MAX_LIFETIME=4w

 #COMPOSE_FILE="$COMPOSE_FILE:compose.signal.yml"
 #SIGNAL_ENABLE_ENCRYPTION=true
+#SIGNAL_DEFAULT_ENCRYPTION=true
 #SIGNAL_BRIDGE_PERMISSIONS="{ \"*\": \"relay\" }"
 #SECRET_SIGNAL_AS_TOKEN_VERSION=v1
 #SECRET_SIGNAL_DB_PASSWORD_VERSION=v1
 #SECRET_SIGNAL_HS_TOKEN_VERSION=v1
+#SECRET_SIGNAL_PICKLE_KEY_VERSION=v1

-## Shared auth
+## Web Client (Redirect)
+#WEB_CLIENT_LOCATION=https://element-web.example.com

-#COMPOSE_FILE="$COMPOSE_FILE:compose.shared_secret_auth.yml"
-#SHARED_SECRET_AUTH_ENABLED=1
-#SECRET_SHARED_SECRET_AUTH_VERSION=v1 # length=128
+
+## State compression (reduces database bloat from federation)
+## Runs synapse_auto_compressor daily, built from source on first start
+#COMPOSE_FILE="$COMPOSE_FILE:compose.compress-state.yml"
+# See https://github.com/matrix-org/rust-synapse-compress-state#running-options
+#STATE_COMPRESS_CHUNK_SIZE=500
+#STATE_COMPRESS_CHUNKS=100
+#STATE_COMPRESS_SCHEDULE=0 3 * * *
+
+## Admin interface at /admin
+#COMPOSE_FILE="$COMPOSE_FILE:compose.admin.yml"
+#ADMIN_INTERFACE_ENABLED=1
--- a/README.md
+++ b/README.md
@ -24,6 +24,10 @@

 ## Tips & Tricks

+### Create User
+
+`register_new_matrix_user -u <username> -k $(cat /var/run/secrets/registration) -p <password>`
+
 ### Set Admin User

 `abra app cmd YOURAPPDOMAIN db set_admin <adminuser>`
@ -35,44 +39,193 @@

 ### Enabling federation

-See [`#27`](https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/27) for more. Depending on your setup, using `SERVE_SERVER_WELLKNOWN=true` might work to start federating. Make sure you don't leave `DISABLE_FEDERATION=1` set!
+Federation is on by default (`DISABLE_FEDERATION=0`). Remote homeservers need a way to discover the host:port that serves your `SERVER_NAME`. 
+There are three supported approaches. At least one needs to be working for federation to work (and matrix will fallback between them).
+
+#### Option 1: built-in well-known (`SERVER_NAME` = `DOMAIN`)
+
+Set `SERVE_SERVER_WELLKNOWN=true` and leave `SERVER_NAME` unset (defaults to `DOMAIN`). The recipe's nginx serves `/.well-known/matrix/server` and `/.well-known/matrix/client` on `DOMAIN`. 
+
+Suitable when users are e.g. `@alice:matrix.example.com`.
+
+#### Option 2: external well-known on `SERVER_NAME`
+
+Use when you want users to be e.g. `@alice:example.com` while Synapse runs at `matrix.example.com` (and SERVER_NAME is served by the same machine that Synapse is running on). Set:
+
+```
+SERVER_NAME=example.com
+DOMAIN=matrix.example.com
+SERVE_SERVER_WELLKNOWN=false
+```
+
+The two paths that must be served on `SERVER_NAME` are:
+
+- `https://example.com/.well-known/matrix/server` → `{"m.server": "matrix.example.com:443"}`
+- `https://example.com/.well-known/matrix/client` → `{"m.homeserver": {"base_url": "https://matrix.example.com"}}`
+
+**Recommended — let this recipe serve them via Traefik** by enabling `compose.wellknown.yml`:
+
+```
+COMPOSE_FILE="$COMPOSE_FILE:compose.wellknown.yml"
+```
+
+This publishes a Traefik router `Host(${SERVER_NAME}) && PathPrefix(/.well-known/matrix)`
+pointing at the matrix nginx, which already serves both files. The path-scoped, high-priority
+rule coexists with any apex website that also serves `Host(${SERVER_NAME})` — that site keeps
+serving everything except `/.well-known/matrix`. `SERVER_NAME` must resolve to this Traefik so
+ACME can issue its certificate.
+
+**Alternative** — serve the two files yourself from whatever already hosts `example.com`.
+
+
+#### Option 3: Traefik `matrix-federation` entrypoint (port 8448)
+
+Use when `SERVER_NAME` ≠ `DOMAIN` but you have no separate web service at `SERVER_NAME`. Remote homeservers fall back to `SERVER_NAME:8448` when there's no delegation (also requires SERVER_NAME pointing to same server that matrix is running on).
+
+Requirements:
+
+- [traefik](https://git.coopcloud.tech/coop-cloud/traefik) `>= 5.1.2+v3.6.15` with `MATRIX_FEDERATION_ENABLED=1` and `compose.matrix.yml` enabled.
+- `SERVER_NAME` set in your matrix-synapse env (used by the federation router's Host rule).
+
+With these in place, the recipe publishes a Traefik router on `Host(${SERVER_NAME})` via the `matrix-federation` entrypoint, reusing the existing matrix nginx → synapse path.
+
+
+#### Option 4: DNS SRV records (usually not viable here)
+
+For reasons explained below, I might be confused, but I think SRV records usually don't help with co-op cloud matrix deployments.
+
+You should probably prefer Option 2 (well known), but the possibility of SRV is explained below:
+
+Federation can also be delegated with a DNS `SRV` record on `SERVER_NAME` instead of well-known:
+
+```
+_matrix-fed._tcp.example.com.  3600 IN SRV 10 0 8448 matrix.example.com.   # modern
+_matrix._tcp.example.com.      3600 IN SRV 10 0 8448 matrix.example.com.   # deprecated, for older peers
+```
+
+The catch is TLS: on the SRV path a remote validates the certificate against **`SERVER_NAME`**, *not* the SRV target. This recipe's Traefik only issues a cert for **`DOMAIN`**, so:
+
+- **SRV → `DOMAIN`:443 fails** — the presented cert is for `DOMAIN`, but the peer requires one for `SERVER_NAME`.
+- **SRV → `SERVER_NAME`:443 collides** — Traefik routes TLS by SNI, and `Host(SERVER_NAME)` on `:443` is already owned by whatever apex site serves `SERVER_NAME`.
+- **SRV → `SERVER_NAME`:8448 works** — the Option 3 `matrix-federation` router holds a cert for `SERVER_NAME` — but that's just Option 3 made explicit (the `:8448` fallback already works with no SRV record).
+
+
+#### Verifying
+
+The canonical test:
+
+- https://federationtester.matrix.org/#YOUR_SERVER_NAME
+
+Or check the underlying paths directly. They should all return JSON:
+
+```bash
+# Options 1 & 2 — delegation
+curl https://SERVER_NAME/.well-known/matrix/server
+
+# Option 3 — federation endpoint via 8448
+curl https://SERVER_NAME:8448/_matrix/key/v2/server
+
+# Confirms Synapse itself is healthy (independent of the path remote servers use)
+curl https://DOMAIN/_matrix/key/v2/server
+```

 ### Getting client discovery on a custom domain

-You'll need to deploy something like [this](https://git.autonomic.zone/ruangrupa/well-known-uris). This could be implemented in this recipe but we haven't merged it in yet. Change sets are welcome.
+Enable `compose.wellknown.yml` (see Option 2 above) — it serves `/.well-known/matrix/client`
+on `SERVER_NAME` too, so clients signing in as `@alice:example.com` auto-discover the homeserver.
+
+### Matrix Authentication Service (MAS)
+
+[MAS](https://element-hq.github.io/matrix-authentication-service/) is Element’s OAuth/OIDC-native auth service for Matrix: it handles login, tokens, and upstream IdPs while Synapse delegates authentication via `matrix_authentication_service`.
+
+> [!IMPORTANT]
+> **If you plan to migrate an existing homeserver with `syn2mas`:** deploy and configure MAS as below, but **leave `MAS_ENABLED=1` commented** until migration and cutover are done, so Synapse keeps using your current login path until you intentionally switch. You cannot use Synapse legacy OIDC/Keycloak SSO alongside MAS; plan IdP apps and envs accordingly.
+
+**Enable the stack:**
+
+- In `.env`, uncomment `compose.mas.yml` (and `compose.mas-upstream.yml` plus upstream envs if you use an external IdP), and uncomment the `SECRET_MAS_*` version lines.
+- `abra app secret generate YOURAPPDOMAIN`
+- `abra app cmd -l YOURAPPDOMAIN generate_mas_signing_rsa` — generates and inserts the PEM RSA key for `SECRET_MAS_SIGNING_RSA_VERSION`. Requires `openssl` on the local machine.
+- `abra app cmd YOURAPPDOMAIN db ensure_mas_database` (once, creates the `mas` database in Postgres)
+- `abra app deploy YOURAPPDOMAIN`
+
+<details>
+<summary><strong>Migrating an existing server (<code>syn2mas</code>)</strong></summary>
+
+Requires PostgreSQL on Synapse and a dedicated MAS database. Backup Postgres (and configs) before you start. Official background: [MAS migration guide](https://element-hq.github.io/matrix-authentication-service/setup/migration.html).
+
+1. **Prepare (Synapse still running):** With MAS in `COMPOSE_FILE` but **`MAS_ENABLED` still off**, deploy, then run checks from your machine:
+   ```bash
+   abra app cmd YOURAPPDOMAIN prepare_mas_migration
+   ```
+   This fetches rendered `homeserver.yaml` into the MAS container, runs `syn2mas check`, then `migrate --dry-run` (the dry run rolls back MAS data at the end). The file stays in the MAS container until next restart, so you can repeat this step to provide the file for the actual migration.
+
+2. **Optional snapshot:** save a copy of the rendered config while `app` is up, e.g. `abra app run -t YOURAPPDOMAIN app cat /data/homeserver.yaml > homeserver.snapshot.yaml`.
+
+3. **Downtime — stop Synapse:** run on the **host** with Docker/Swarm access (not inside a container), e.g.:
+   ```bash
+   docker service scale <STACK_NAME>_app=0
+   ```
+   Use the real service name from `docker service ls` (suffix `_app`).
+
+4. **Migration:** with MAS still running and Synapse at zero replicas, run `run_mas_migration` from your machine. The homeserver snapshot at `/tmp/homeserver.yaml` in `mas` must still be present from step 1.
+   ```bash
+   abra app cmd YOURAPPDOMAIN run_mas_migration
+   ```
+
+5. **Cutover:** in `.env`, set `MAS_ENABLED=1`, `PASSWORD_LOGIN_ENABLED=false`, remove legacy Keycloak/SSO envs, then `abra app deploy YOURAPPDOMAIN` (Synapse comes back with MAS delegation). `syn2mas` does not write to the Synapse database; if you abort before serving traffic through MAS, you can often drop and recreate the MAS DB and revert env.
+
+</details>
+
+## Bridges
+For all Bridges:
+- Setting it up is a bit of a chicken/egg & chasing cats moment.
+- Make sure to uncomment `APP_SERVICES_ENABLED`, `HOMESERVER_URL`, `HOMESERVER_DOMAIN`, `compose.shared_secret_auth.yml`, `SHARED_SECRET_AUTH_ENABLED` and `SECRET_SHARED_SECRET_AUTH_VERSION`
+- include the registration in synapse, e.g. `APP_SERVICE_CONFIGS="[\"/telegram-data/registration.yaml\"]"`
+- and set yourself as admin, e.g.: `TELEGRAM_BRIDGE_PERMISSIONS="{ \"*\": \"relaybot\", \"@akadmin:example.com\": \"admin\"}"`
+
+> [!IMPORTANT]
+> The shared secret authenticator may break when matrix-synapse uses a newer python version with an error stating something like "module not found". You have to fix the path in the compose.shared_secret_auth.yml like [here](https://git.coopcloud.tech/coop-cloud/matrix-synapse/commit/3d1350533079ce1ad3bea92039fe003684589b95)

 ### Telegram bridging

-> WIP docs
-
-Setting it up is a bit of a chicken/egg & chasing cats moment.
-
-You need to get your bot setup on the telegram side first and have these values:
+You need to get your bot setup on the telegram side first by creating a [telegram app](https://my.telegram.org/apps) and a [telegram bot](https://docs.mau.fi/bridges/python/telegram/relay-bot.html#setup) and have these values:

 ```
 api_id: ...
 api_hash: ...
 telegram_bot_token: ...
 ```
+Experimental script for a automated token replacement:
+```
+DOMAIN=<domain>
+abra app secret insert $DOMAIN telegram_api_hash v1 <secret>
+abra app secret insert $DOMAIN telegram_bot_token v1 <secret>
+abra app secret generate -a $DOMAIN

-Here is a rough guide:
+abra app deploy $DOMAIN
+abra app cmd -l $DOMAIN set_bridge_tokens telegram
+```
+
+Alternatively a manual guide for the necessary steps:

 ```
-abra app secret insert <domain> telegram_api_hash v1 <secret>
-abra app secret insert <domain> telegram_bot_token v1 <secret>
-abra app secret generate -a <domain>
+DOMAIN=<domain>
+abra app secret insert $DOMAIN telegram_api_hash v1 <secret>
+abra app secret insert $DOMAIN telegram_bot_token v1 <secret>
+abra app secret generate -a $DOMAIN

-abra app deploy <domain>
-abra app run matrix.fva.wtf telegram_bridge cat /data/registration.yaml
-abra app undeploy <domain>
+abra app deploy $DOMAIN
+abra app run $DOMAIN telegrambridge cat /data/registration.yaml
+abra app undeploy $DOMAIN

-abra app secret rm <domain> telegram_as_token
-abra app secret insert <domain> telegram_as_token v1 <secret>
+abra app secret rm $DOMAIN telegram_as_token
+abra app secret insert $DOMAIN telegram_as_token v1 <secret>

-abra app secret rm <domain> telegram_as_token
-abra app secret insert <domain> telegram_hs_token v1 <secret>
+abra app secret rm $DOMAIN telegram_hs_token
+abra app secret insert $DOMAIN telegram_hs_token v1 <secret>

-abra app deploy <domain>
+abra app deploy $DOMAIN
 ```

 Some helpful documentation:
@ -101,15 +254,29 @@ Some helpful documentation:

 ### Signal bridging

-> WIP docs
+Experimental script for a more automated token replacement:
+```
+DOMAIN=<domain>
+abra app secret generate -a $DOMAIN
+abra app deploy $DOMAIN
+abra app cmd -l $DOMAIN set_bridge_tokens signal
+```
+Alternatively a manual guide for the necessary steps:
+```
+DOMAIN=<domain>
+abra app secret insert $DOMAIN signal_hs_token v1 foo
+abra app secret insert $DOMAIN signal_as_token v1 foo
+abra app secret generate $DOMAIN -a
+abra app deploy $DOMAIN
+abra app run $DOMAIN signalbridge cat /data/registration.yaml

-OK, it's also awful to set this up. Do you see a pattern emerging :)
+abra app secret rm $DOMAIN signal_as_token
+abra app secret insert $DOMAIN signal_as_token v1 <secret>
+abra app secret rm $DOMAIN signal_hs_token
+abra app secret insert $DOMAIN signal_hs_token v1 <secret>

- fake that you have the required tokens:
-  - `abra app secret insert example.com signal_hs_token v1 foo`
-  - `abra app secret insert example.com signal_as_token v1 foo`
- generate the database password:
-  - `abra app secret generate example.com -a`
- deploy the thing and then check the `/data/registration.yaml`
- rm the fake `signal_hs/as_token` values and re-insert the new ones from `registration.yaml`
- re-deploy the whole thing and then it should come up, message `@signalbot:example.com` to test
+abra app deploy $DOMAIN
+```
+
+- message `@signalbot:example.com` to test
+- See the [docs](https://docs.mau.fi/bridges/go/signal/authentication.html) for authentication
--- a/abra.sh
+++ b/abra.sh
@ -1,19 +1,354 @@
 export DISCORD_BRIDGE_YAML_VERSION=v2
-export ENTRYPOINT_CONF_VERSION=v1
-export HOMESERVER_YAML_VERSION=v26
+export ENTRYPOINT_CONF_VERSION=v3
+export HOMESERVER_YAML_VERSION=v37
 export LOG_CONFIG_VERSION=v2
-export SHARED_SECRET_AUTH_VERSION=v1
-export SIGNAL_BRIDGE_YAML_VERSION=v4
+export SHARED_SECRET_AUTH_VERSION=v2
+export SIGNAL_BRIDGE_YAML_VERSION=v6
 export TELEGRAM_BRIDGE_YAML_VERSION=v6
-export NGINX_CONFIG_VERSION=v4
+export NGINX_CONFIG_VERSION=v13
 export WK_SERVER_VERSION=v1
-export WK_CLIENT_VERSION=v1
+export WK_CLIENT_VERSION=v2
+export MAS_CONFIG_VERSION=v2
+export PG_BACKUP_VERSION=v2
+export ADMIN_CONFIG_VERSION=v1
+export COMPRESS_STATE_ENTRYPOINT_VERSION=v5
+
+###############################################################################
+# Database maintenance — shrink a bloated Synapse database
+#
+# See https://levans.fr/shrink-synapse-database.html
+#
+# Recommended steps to reclaim disk space:
+#   1. abra app cmd <domain> compress-state run_compressor 500 10000
+#      (compress redundant state — safe while Synapse is running)
+#   2. abra app cmd <domain> db reindex
+#      (rebuild indexes — stop Synapse first)
+#   3. abra app cmd <domain> db vacuum_full
+#      (rewrite tables and reclaim disk — stop Synapse first)
+#
+# Diagnostic commands (safe to run anytime):
+#   abra app cmd <domain> db db_size
+#   abra app cmd <domain> db state_bloat
+#   abra app cmd <domain> db empty_rooms
+#
+# Purge commands (require an admin token):
+#   abra app cmd <domain> app register_admin <user> <pass>
+#   abra app cmd <domain> app get_token <user> <pass>
+#   abra app cmd <domain> app purge_remote_media <days> <token>
+#   abra app cmd <domain> app purge_empty_rooms <token>
+#   abra app cmd <domain> app purge_room <room_id> <token>
+#   abra app cmd <domain> app purge_history <room_id> <days> <token>
+###############################################################################
+
+# --- Diagnostics (db) ---
+
+db_size() {
+    echo "=== Database size ==="
+    psql -U synapse -d synapse -c "SELECT pg_size_pretty(pg_database_size('synapse')) AS db_size;"
+    echo ""
+    echo "=== Top 10 largest tables ==="
+    psql -U synapse -d synapse -c "
+        SELECT nspname || '.' || relname AS table,
+               pg_size_pretty(pg_total_relation_size(C.oid)) AS total_size
+        FROM pg_class C
+        LEFT JOIN pg_namespace N ON (N.oid = C.relnamespace)
+        WHERE nspname NOT IN ('pg_catalog', 'information_schema')
+        ORDER BY pg_total_relation_size(C.oid) DESC
+        LIMIT 10;"
+}
+
+state_bloat() {
+    echo "=== Rooms with most state bloat ==="
+    psql -U synapse -d synapse -c "
+        SELECT room_id, count(*) AS state_entries
+        FROM state_groups_state
+        GROUP BY room_id
+        ORDER BY state_entries DESC
+        LIMIT 20;"
+}
+
+empty_rooms() {
+    echo "=== Rooms with no local members ==="
+    psql -U synapse -d synapse -c "
+        SELECT room_id, room_version
+        FROM rooms
+        WHERE room_id NOT IN (
+            SELECT room_id FROM local_current_membership WHERE membership = 'join'
+        );"
+}
+
+# --- Compression (compress-state) ---
+
+run_compressor() {
+    CHUNK_SIZE="${1:-${STATE_COMPRESS_CHUNK_SIZE:-500}}"
+    CHUNKS="${2:-${STATE_COMPRESS_CHUNKS:-100}}"
+    DB_PASS=$(cat /run/secrets/db_password)
+    echo "Running synapse_auto_compressor (chunk_size=$CHUNK_SIZE, chunks=$CHUNKS)..."
+    /build/synapse_auto_compressor \
+        -p "postgresql://synapse:${DB_PASS}@db:5432/synapse" \
+        -c "$CHUNK_SIZE" -n "$CHUNKS"
+}
+
+# --- Maintenance (db) — stop Synapse before running these ---
+
+reindex() {
+    echo "WARNING: REINDEX locks tables. Synapse should be stopped before running this."
+    echo "Running REINDEX on synapse database..."
+    psql -U synapse -d synapse -c "REINDEX (VERBOSE) DATABASE synapse;"
+    echo "REINDEX complete."
+    psql -U synapse -d synapse -c "SELECT pg_size_pretty(pg_database_size('synapse')) AS db_size;"
+}
+
+vacuum_full() {
+    echo "WARNING: VACUUM FULL locks tables and requires temporary disk space."
+    echo "Synapse should be stopped before running this."
+    echo "Running VACUUM FULL on synapse database..."
+    psql -U synapse -d synapse -c "VACUUM FULL;"
+    echo "VACUUM FULL complete."
+    psql -U synapse -d synapse -c "SELECT pg_size_pretty(pg_database_size('synapse')) AS db_size;"
+}
+
+# --- Purge commands (app) — require an admin access token ---
+
+register_admin() {
+    USER="${1}"
+    PASS="${2}"
+    if [ -z "$USER" ] || [ -z "$PASS" ]; then
+        echo "Usage: register_admin <username> <password>"
+        return 1
+    fi
+    register_new_matrix_user -u "$USER" -p "$PASS" -a -c /data/homeserver.yaml http://localhost:8008
+}
+
+get_token() {
+    USER="${1}"
+    PASS="${2}"
+    if [ -z "$USER" ] || [ -z "$PASS" ]; then
+        echo "Usage: get_token <username> <password>"
+        echo "Returns an admin access token for use with purge commands."
+        return 1
+    fi
+    curl -s -X POST "http://localhost:8008/_matrix/client/r0/login" \
+        -H "Content-Type: application/json" \
+        -d "{\"type\":\"m.login.password\",\"user\":\"$USER\",\"password\":\"$PASS\"}" \
+        | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('access_token', d.get('error', 'unknown error')))"
+}
+
+purge_remote_media() {
+    DAYS="${1:-30}"
+    TOKEN="${2}"
+    if [ -z "$TOKEN" ]; then
+        echo "Usage: purge_remote_media <days> <admin_token>"
+        return 1
+    fi
+    BEFORE_TS=$(( $(date +%s) * 1000 - DAYS * 86400000 ))
+    echo "Purging remote media older than $DAYS days..."
+    curl -s -X POST "http://localhost:8008/_synapse/admin/v1/purge_media_cache?before_ts=$BEFORE_TS" \
+        -H "Authorization: Bearer $TOKEN"
+    echo ""
+}
+
+purge_room() {
+    ROOM_ID="${1}"
+    TOKEN="${2}"
+    if [ -z "$ROOM_ID" ] || [ -z "$TOKEN" ]; then
+        echo "Usage: purge_room <room_id> <admin_token>"
+        return 1
+    fi
+    echo "Purging room $ROOM_ID..."
+    curl -s -X DELETE "http://localhost:8008/_synapse/admin/v1/rooms/$ROOM_ID" \
+        -H "Authorization: Bearer $TOKEN" \
+        -H "Content-Type: application/json" \
+        -d '{"purge": true}'
+    echo ""
+}
+
+purge_history() {
+    ROOM_ID="${1}"
+    DAYS="${2:-90}"
+    TOKEN="${3}"
+    if [ -z "$ROOM_ID" ] || [ -z "$TOKEN" ]; then
+        echo "Usage: purge_history <room_id> <days> <admin_token>"
+        return 1
+    fi
+    BEFORE_TS=$(( $(date +%s) * 1000 - DAYS * 86400000 ))
+    echo "Purging history older than $DAYS days from $ROOM_ID..."
+    curl -s -X POST "http://localhost:8008/_synapse/admin/v1/purge_history/$ROOM_ID" \
+        -H "Authorization: Bearer $TOKEN" \
+        -H "Content-Type: application/json" \
+        -d "{\"purge_up_to_ts\": $BEFORE_TS}"
+    echo ""
+}
+
+purge_empty_rooms() {
+    TOKEN="${1}"
+    if [ -z "$TOKEN" ]; then
+        echo "Usage: purge_empty_rooms <admin_token>"
+        return 1
+    fi
+    echo "Fetching rooms with no local members..."
+    ROOMS=$(curl -s "http://localhost:8008/_synapse/admin/v1/rooms?limit=1000" \
+        -H "Authorization: Bearer $TOKEN" \
+        | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+for r in data.get('rooms', []):
+    if r.get('joined_local_members', 0) == 0:
+        print(r['room_id'])
+")
+    COUNT=$(echo "$ROOMS" | grep -c '.' || true)
+    echo "Found $COUNT empty rooms."
+    if [ "$COUNT" -eq 0 ]; then
+        echo "Nothing to purge."
+        return 0
+    fi
+    echo "$ROOMS"
+    echo ""
+    echo "Purging..."
+    for ROOM_ID in $ROOMS; do
+        echo "  Purging $ROOM_ID"
+        curl -s -X DELETE "http://localhost:8008/_synapse/admin/v1/rooms/$ROOM_ID" \
+            -H "Authorization: Bearer $TOKEN" \
+            -H "Content-Type: application/json" \
+            -d '{"purge": true}' > /dev/null
+    done
+    echo "Done."
+}
+
+###############################################################################
+# Other commands
+###############################################################################
+
+ensure_mas_database () {
+    if ! psql -U synapse -d postgres -v ON_ERROR_STOP=1 -Atqc "SELECT 1 FROM pg_database WHERE datname = 'mas'" | grep -qx 1
+    then
+        psql -U synapse -d postgres -v ON_ERROR_STOP=1 -c "CREATE DATABASE mas OWNER synapse"
+    fi
+}
+
+# Generate a PEM RSA private key and insert it as the MAS signing secret.
+# `abra app secret generate` can only produce random hex/charset strings, so this
+# secret is marked `generate=false` in .env.sample and handled here instead.
+generate_mas_signing_rsa() {
+    if ! command -v openssl &> /dev/null; then
+        echo "openssl is required on your local machine to generate the MAS signing key."
+        echo "It could not be found in your PATH, please install openssl to proceed."
+        exit 1
+    fi
+
+    KEY=$(openssl genrsa 2048 2>/dev/null)
+    if [ -z "$KEY" ]; then
+        echo "Failed to generate RSA private key with openssl."
+        exit 1
+    fi
+
+    if printf '%s\n' "$KEY" | abra app secret insert -C "$APP_NAME" mas_signing_rsa v1; then
+        echo "MAS signing RSA key generated and inserted as v1."
+    else
+        echo "Failed to insert MAS signing RSA key."
+        exit 1
+    fi
+}
+
+# Local helper: fetch homeserver.yaml from app, push to mas, then syn2mas check + dry-run.
+prepare_mas_migration () {
+    local syn_cfg
+
+    syn_cfg=/tmp/homeserver.yaml
+
+    cleanup_prepare_mas_migration() {
+        rm -f "homeserver.yaml"
+    }
+    trap cleanup_prepare_mas_migration EXIT
+
+    echo "Fetching /data/homeserver.yaml from app to homeserver.yaml (abra app run … cat)..."
+    if ! abra app run -t "$DOMAIN" app cat /data/homeserver.yaml > "homeserver.yaml"
+    then
+        return 1
+    fi
+    if [ ! -s "homeserver.yaml" ]; then
+        echo "Error: fetched homeserver.yaml is empty." >&2
+        return 1
+    fi
+
+    echo "Copying into mas:/tmp"
+    abra app cp "$DOMAIN" "homeserver.yaml" "mas:/tmp" || return 1
+
+    echo "Running mas-cli syn2mas check..."
+    abra app run -t "$DOMAIN" mas -- mas-cli syn2mas check \
+        --config /etc/mas/config.yaml \
+        --synapse-config "$syn_cfg" || return 1
+
+    echo "Running mas-cli syn2mas migrate --dry-run..."
+    abra app run -t "$DOMAIN" mas -- mas-cli syn2mas migrate \
+        --config /etc/mas/config.yaml \
+        --synapse-config "$syn_cfg" \
+        --dry-run || return 1
+
+    trap - EXIT
+    cleanup_prepare_mas_migration
+
+    echo ""
+    echo "=== Next migration step: stop Synapse (downtime) ==="
+    echo "Run on a host whose Docker CLI targets this Swarm (same machine you use for 'abra app deploy')."
+    if [ -n "${STACK_NAME:-}" ]; then
+        echo "  docker service scale ${STACK_NAME}_app=0"
+    else
+        echo "STACK_NAME is not set here; resolve the Synapse service name with 'docker service ls' on that host, then:"
+        echo "docker service scale <STACK_NAME>_app=0"
+    fi
+}
+
+# Run syn2mas migrate for real (writes MAS data). Run from your operator machine as MAS image is distroless.
+# Requires /tmp/homeserver.yaml in the mas container (e.g. from prepare_mas_migration) and
+# Synapse scaled down before migrate.
+run_mas_migration () {
+    local syn_cfg=/tmp/homeserver.yaml
+
+    echo "Running mas-cli syn2mas migrate in mas via abra app run..."
+    abra app run -t "$DOMAIN" mas -- mas-cli syn2mas migrate \
+        --config /etc/mas/config.yaml \
+        --synapse-config "$syn_cfg"
+}

 set_admin () {
    admin=akadmin
    if [ -n "$1" ]
    then
-        admin=$1 
+        admin=$1
    fi
    psql -U synapse -c "UPDATE users SET admin = 1 WHERE name = '@$admin:$DOMAIN'";
 }
+
+set_bridge_tokens() {
+    if [ -z "$1" ]; then
+        echo "Error: Missing parameter. Usage: set_bridge_tokens <BRIDGETYPE>"
+        return 1
+    fi
+
+    BRIDGETYPE=$1
+    echo "retrieve tokens from registration.yaml..."
+    output=$(abra app run $DOMAIN app cat /${BRIDGETYPE}-data/registration.yaml)
+    if [ $? -ne 0 ]; then
+        echo "Error: Failed to retrieve registration.yaml for ${BRIDGETYPE} bridge:"
+        echo "$output"
+        return 1
+    fi
+
+    hs_token=$(echo "$output" | sed -n 's/^hs_token:[[:space:]]*\(.*\)$/\1/p')
+    as_token=$(echo "$output" | sed -n 's/^as_token:[[:space:]]*\(.*\)$/\1/p')
+
+    echo "HS Token: $hs_token"
+    echo "AS Token: $as_token"
+    echo "UNDEPLOY $DOMAIN?"
+    abra app undeploy $DOMAIN
+
+    echo "Replacing tokens:"
+    abra app secret rm $DOMAIN ${BRIDGETYPE}_as_token
+    abra app secret insert $DOMAIN ${BRIDGETYPE}_as_token v1 $as_token
+    abra app secret rm $DOMAIN ${BRIDGETYPE}_hs_token
+    abra app secret insert $DOMAIN ${BRIDGETYPE}_hs_token v1 $hs_token
+
+    echo "Redeploying $DOMAIN..."
+    abra app deploy -n $DOMAIN
+}
--- a/admin.conf.tmpl
+++ b/admin.conf.tmpl
@ -0,0 +1,3 @@
+{
+  "restrictBaseUrl": "https://{{ env "DOMAIN" }}"
+}
--- a/alaconnect.yml
+++ b/alaconnect.yml
@ -0,0 +1,15 @@
+authentik:
+    env:
+        KEYCLOAK_ID: authentik
+        KEYCLOAK_NAME: sso
+        KEYCLOAK_URL: https://authentik.example.com/application/o/matrix/
+        KEYCLOAK_CLIENT_DOMAIN: https://element-web.example.com
+        KEYCLOAK_ALLOW_EXISTING_USERS: "true"
+        KEYCLOAK_CLIENT_ID: matrix
+    uncomment:
+        - compose.keycloak.yml
+        - KEYCLOAK_ENABLED
+        - KEYCLOAK_CLIENT_ID
+        - SECRET_KEYCLOAK_CLIENT_SECRET_VERSION
+    shared_secrets:
+        matrix_secret: keycloak_client_secret
--- a/compose.admin.yml
+++ b/compose.admin.yml
@ -0,0 +1,46 @@
+---
+version: "3.8"
+
+services:
+  admin:
+    image: awesometechnologies/synapse-admin:0.11.4
+    networks:
+      - proxy
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.swarm.network=proxy"
+        - "traefik.http.services.${STACK_NAME}_admin.loadbalancer.server.port=80"
+        - "traefik.http.routers.${STACK_NAME}_admin.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})&&PathPrefix(`/admin`)"
+        - "traefik.http.routers.${STACK_NAME}_admin.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}_admin.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.${STACK_NAME}_admin.middlewares=admin,admin_path"
+        - "traefik.http.middlewares.admin.redirectregex.regex=^(.*)/admin/?"
+        - "traefik.http.middlewares.admin.redirectregex.replacement=$${1}/admin/"
+        - "traefik.http.middlewares.admin_path.stripprefix.prefixes=/admin"
+    environment:
+      - DOMAIN
+    configs:
+      - source: admin_config
+        target: /app/config.json
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost"]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 1m
+  web:
+    environment:
+      - ADMIN_INTERFACE_ENABLED
+
+
+networks:
+  proxy:
+    external: true
+
+configs:
+  admin_config:
+    name: ${STACK_NAME}_admin_config_${ADMIN_CONFIG_VERSION}
+    file: admin.conf.tmpl
+    template_driver: golang
+
--- a/compose.compress-state.yml
+++ b/compose.compress-state.yml
@ -0,0 +1,31 @@
+version: "3.8"
+
+services:
+  compress-state:
+    image: rust:1-alpine
+    entrypoint: /compress_state_entrypoint.sh
+    environment:
+      - STATE_COMPRESS_CHUNK_SIZE=${STATE_COMPRESS_CHUNK_SIZE:-500}
+      - STATE_COMPRESS_CHUNKS=${STATE_COMPRESS_CHUNKS:-100}
+      - STATE_COMPRESS_SCHEDULE=${STATE_COMPRESS_SCHEDULE:-0 3 * * *}
+    secrets:
+      - db_password
+    configs:
+      - source: compress_entrypoint
+        target: /compress_state_entrypoint.sh
+        mode: 0555
+    volumes:
+      - compress_state_build:/build
+    networks:
+      - internal
+    deploy:
+      restart_policy:
+        condition: on-failure
+
+volumes:
+  compress_state_build:
+
+configs:
+  compress_entrypoint:
+    name: ${STACK_NAME}_compress_ep_${COMPRESS_STATE_ENTRYPOINT_VERSION}
+    file: compress_state_entrypoint.sh
--- a/compose.discord.yml
+++ b/compose.discord.yml
@ -2,7 +2,7 @@
 version: "3.8"

 services:
-  synapse:
+  app:
    environment:
      - APP_SERVICES_ENABLED
      - APP_SERVICE_CONFIGS
--- a/compose.keycloak.yml
+++ b/compose.keycloak.yml
@ -2,7 +2,7 @@
 version: "3.8"

 services:
-  synapse:
+  app:
    secrets:
      - db_password
      - form_secret
--- a/compose.keycloak2.yml
+++ b/compose.keycloak2.yml
@ -2,7 +2,7 @@
 version: "3.8"

 services:
-  synapse:
+  app:
    secrets:
      - keycloak2_client_secret
    environment:
--- a/compose.keycloak3.yml
+++ b/compose.keycloak3.yml
@ -2,7 +2,7 @@
 version: "3.8"

 services:
-  synapse:
+  app:
    secrets:
      - keycloak3_client_secret
    environment:
--- a/compose.mas-upstream.yml
+++ b/compose.mas-upstream.yml
@ -0,0 +1,21 @@
+---
+version: "3.8"
+
+# Upstream OIDC provider for MAS (e.g. Authentik, Keycloak).
+# Requires compose.mas.yml. Adds the client secret and env vars needed by mas.config.yaml.tmpl.
+
+services:
+  mas:
+    environment:
+      - MAS_UPSTREAM_PROVIDER_ID
+      - MAS_UPSTREAM_ISSUER
+      - MAS_UPSTREAM_CLIENT_ID
+      - MAS_UPSTREAM_HUMAN_NAME
+      - MAS_UPSTREAM_SYNAPSE_IDP_ID
+    secrets:
+      - mas_upstream_client
+
+secrets:
+  mas_upstream_client:
+    external: true
+    name: ${STACK_NAME}_mas_upstream_client_${SECRET_MAS_UPSTREAM_CLIENT_VERSION}
--- a/compose.mas.yml
+++ b/compose.mas.yml
@ -0,0 +1,64 @@
+---
+version: "3.8"
+
+# Matrix Authentication Service (MAS) — optional overlay for Element X / OIDC-native auth.
+
+services:
+  mas:
+    image: ghcr.io/element-hq/matrix-authentication-service:1.14.0
+    command: ["server", "--config=/etc/mas/config.yaml"]
+    environment:
+      - DOMAIN
+      - SERVER_NAME
+      - STACK_NAME
+    networks:
+      - internal
+    configs:
+      - source: mas_config
+        target: /etc/mas/config.yaml
+    secrets:
+      - db_password
+      - mas_encryption
+      - mas_synapse_shared
+      - mas_signing_rsa
+    # Official image is distroless (no curl/wget); upstream suggests `mas-cli config check` for probes.
+    # See https://github.com/element-hq/matrix-authentication-service/issues/3741 — validates config, not HTTP.
+    # GET /health is still served (resource `health` in mas.config.yaml.tmpl) for probes from other images.
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "/usr/local/bin/mas-cli",
+          "--config",
+          "/etc/mas/config.yaml",
+          "config",
+          "check",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    deploy:
+      restart_policy:
+        condition: on-failure
+
+  app:
+    secrets:
+      - mas_synapse_shared
+
+configs:
+  mas_config:
+    name: ${STACK_NAME}_mas_config_${MAS_CONFIG_VERSION}
+    file: mas.config.yaml.tmpl
+    template_driver: golang
+
+secrets:
+  mas_encryption:
+    external: true
+    name: ${STACK_NAME}_mas_encryption_${SECRET_MAS_ENCRYPTION_VERSION}
+  mas_synapse_shared:
+    external: true
+    name: ${STACK_NAME}_mas_synapse_shared_${SECRET_MAS_SYNAPSE_SHARED_VERSION}
+  mas_signing_rsa:
+    external: true
+    name: ${STACK_NAME}_mas_signing_rsa_${SECRET_MAS_SIGNING_RSA_VERSION}
--- a/compose.shared_secret_auth.yml
+++ b/compose.shared_secret_auth.yml
@ -2,14 +2,14 @@
 version: "3.8"

 services:
-  synapse:
+  app:
    environment:
      - SHARED_SECRET_AUTH_ENABLED
    secrets:
      - shared_secret_auth
    configs:
      - source: shared_secret_auth
-        target: /usr/local/lib/python3.11/site-packages/shared_secret_authenticator.py
+        target: /usr/local/lib/python3.13/site-packages/shared_secret_authenticator.py

 configs:
  shared_secret_auth:
--- a/compose.signal.yml
+++ b/compose.signal.yml
@ -2,22 +2,15 @@
 version: "3.8"

 services:
-  synapse:
+  app:
    environment:
      - APP_SERVICES_ENABLED
      - APP_SERVICE_CONFIGS
    volumes:
      - signal-data:/signal-data

-  signald:
-    image: docker.io/signald/signald:0.23.2-non-root
-    networks:
-      - internal
-    volumes:
-      - signald-data:/signald
-
  signalbridge:
-    image: dock.mau.dev/mautrix/signal:v0.4.3
+    image: dock.mau.dev/mautrix/signal:v0.8.7
    depends_on:
      - signaldb
    configs:
@ -28,15 +21,16 @@ services:
      - HOMESERVER_URL
      - SIGNAL_BRIDGE_PERMISSIONS
      - SIGNAL_ENABLE_ENCRYPTION
+      - SIGNAL_DEFAULT_ENCRYPTION=${SIGNAL_DEFAULT_ENCRYPTION:-false}
      - VERIFY_SSL
    secrets:
      - signal_as_token
      - signal_db_password
      - signal_hs_token
      - shared_secret_auth
+      - signal_pickle_key
    volumes:
      - signal-data:/data
-      - signald-data:/signald
    networks:
      - internal

@ -57,6 +51,15 @@ services:
      test: ["CMD", "pg_isready", "-U", "$POSTGRES_USER" ]
    volumes:
      - signal-postgres:/var/lib/postgresql/data
+    deploy:
+      labels:
+        backupbot.backup.pre-hook: "/pg_backup.sh backup"
+        backupbot.backup.volumes.signal-postgres.path: "backup.sql"
+        backupbot.restore.post-hook: '/pg_backup.sh restore'
+    configs:
+        - source: pg_backup
+          target: /pg_backup.sh
+          mode: 0555

 configs:
  signal_bridge_yaml:
@ -65,7 +68,6 @@ configs:
    template_driver: golang

 volumes:
-  signald-data:
  signal-data:
  signal-postgres:

@ -79,3 +81,6 @@ secrets:
  signal_hs_token:
    external: true
    name: ${STACK_NAME}_signal_hs_token_${SECRET_SIGNAL_HS_TOKEN_VERSION}
+  signal_pickle_key:
+    external: true
+    name: ${STACK_NAME}_signal_pickle_key_${SECRET_SIGNAL_PICKLE_KEY_VERSION}
--- a/compose.smtp.yml
+++ b/compose.smtp.yml
@ -2,7 +2,7 @@
 version: "3.8"

 services:
-  synapse:
+  app:
    secrets:
      - db_password
      - form_secret
--- a/compose.telegram.yml
+++ b/compose.telegram.yml
@ -2,7 +2,7 @@
 version: "3.8"

 services:
-  synapse:
+  app:
    environment:
      - APP_SERVICES_ENABLED
      - APP_SERVICE_CONFIGS
@ -10,7 +10,7 @@ services:
      - telegram-data:/telegram-data

  telegrambridge:
-    image: dock.mau.dev/mautrix/telegram:v0.14.2
+    image: dock.mau.dev/mautrix/telegram:v0.15.3
    depends_on:
      - telegramdb
    configs:
@ -56,6 +56,15 @@ services:
      test: ["CMD", "pg_isready", "-U", "$POSTGRES_USER" ]
    volumes:
      - telegram-postgres:/var/lib/postgresql/data
+    deploy:
+      labels:
+        backupbot.backup.pre-hook: "/pg_backup.sh backup"
+        backupbot.backup.volumes.telegram-postgres.path: "backup.sql"
+        backupbot.restore.post-hook: '/pg_backup.sh restore'
+    configs:
+        - source: pg_backup
+          target: /pg_backup.sh
+          mode: 0555

 configs:
  telegram_bridge_yaml:
--- a/compose.turn.yml
+++ b/compose.turn.yml
@ -2,7 +2,7 @@
 version: "3.8"

 services:
-  synapse:
+  app:
    secrets:
      - db_password
      - form_secret
--- a/compose.wellknown.yml
+++ b/compose.wellknown.yml
@ -0,0 +1,24 @@
+---
+version: "3.8"
+
+# Serve /.well-known/matrix/{server,client} on SERVER_NAME via Traefik, routed to
+# the matrix nginx (`web`) — so server/client delegation works without hand-placing
+# files on whatever else hosts SERVER_NAME.
+#
+# Enable when SERVER_NAME != DOMAIN (users are @alice:example.com, Synapse runs at
+# matrix.example.com). The PathPrefix rule is more specific than a bare Host()
+# router, and the explicit high priority guarantees it wins over any apex website
+# that also serves Host(SERVER_NAME) — so the two coexist, the apex site keeps
+# serving everything except /.well-known/matrix.
+#
+# Requires SERVER_NAME to resolve to this Traefik so ACME can issue its cert.
+services:
+  web:
+    deploy:
+      labels:
+        - "traefik.http.routers.${STACK_NAME}-wellknown.rule=Host(`${SERVER_NAME}`) && PathPrefix(`/.well-known/matrix`)"
+        - "traefik.http.routers.${STACK_NAME}-wellknown.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}-wellknown.tls=true"
+        - "traefik.http.routers.${STACK_NAME}-wellknown.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.${STACK_NAME}-wellknown.service=${STACK_NAME}"
+        - "traefik.http.routers.${STACK_NAME}-wellknown.priority=1000"
--- a/compose.yml
+++ b/compose.yml
@ -2,13 +2,18 @@
 version: "3.8"

 services:
-  app:
-    image: nginx:1.23.3
+  web:
+    image: nginx:1.29.6
    networks:
      - proxy
      - internal
    environment:
+      - DOMAIN
      - STACK_NAME
+      - MAS_ENABLED
+      - NGINX_ACCESS_LOG_LOCATION
+      - NGINX_ERROR_LOG_LOCATION
+      - MAX_UPLOAD_SIZE
    configs:
      - source: nginx_config
        target: /etc/nginx/nginx.conf
@ -18,23 +23,27 @@ services:
        target: /var/www/.well-known/matrix/client
    deploy:
      restart_policy:
-        condition: on-failure
+        condition: any
      labels:
        - "traefik.enable=true"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=5.0.0+v1.93.0"
-        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
+        - "traefik.http.routers.${STACK_NAME}-federation.rule=Host(`${SERVER_NAME}`)"
+        - "traefik.http.routers.${STACK_NAME}-federation.entrypoints=matrix-federation"
+        - "traefik.http.routers.${STACK_NAME}-federation.tls=true"
+        - "traefik.http.routers.${STACK_NAME}-federation.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.${STACK_NAME}-federation.service=${STACK_NAME}"
    healthcheck:
-      test: curl -f http://synapse:8008/health || exit 1
-      interval: 5s
-      timeout: 3s
-      retries: 20
+      test: curl -f http://${STACK_NAME}_app:8008/health || exit 1
+      interval: 30s
+      timeout: 15s
+      retries: 90
+      start_period: 2m

-  synapse:
-    image: "matrixdotorg/synapse:v1.93.0"
+  app:
+    image: "matrixdotorg/synapse:v1.149.1"
    volumes:
      - "data:/data"
    secrets:
@ -43,6 +52,7 @@ services:
      - macaroon
      - form_secret
    environment:
+      - MAS_ENABLED
      - ALLOWED_LIFETIME_MAX
      - ALLOW_PUBLIC_ROOMS_FEDERATION
      - AUTO_JOIN_ROOM
@ -52,8 +62,21 @@ services:
      - ENABLE_3PID_LOOKUP
      - ENABLE_ALLOWLIST
      - ENABLE_REGISTRATION
+      - REGISTRATION_REQUIRES_TOKEN
      - ENCRYPTED_BY_DEFAULT
+      - OLD_SIGNING_KEY
+      - OLD_SIGNING_KEY_ID
+      - OLD_SIGNING_KEY_EXPIRES
+      - USER_DIRECTORY_ENABLED=${USER_DIRECTORY_ENABLED:-true}
+      - USER_DIRECTORY_SEARCH_ALL_USERS=${USER_DIRECTORY_SEARCH_ALL_USERS:-true}
+      - USER_DIRECTORY_PREFER_LOCAL_USERS=${USER_DIRECTORY_PREFER_LOCAL_USERS:-true}
+      - USER_DIRECTORY_SHOW_LOCKED_USERS=${USER_DIRECTORY_SHOW_LOCKED_USERS:-false}
      - FEDERATION_ALLOWLIST
+      - REQUIRE_AUTH_FOR_PROFILE_REQUESTS=${REQUIRE_AUTH_FOR_PROFILE_REQUESTS:-false}
+      - LIMIT_PROFILE_REQUESTS_TO_USERS_WHO_SHARE_ROOMS=${LIMIT_PROFILE_REQUESTS_TO_USERS_WHO_SHARE_ROOMS:-false}
+      - DELETE_STALE_DEVICES_AFTER
+      - SESSION_LIFETIME
+      - TRACK_PUPPETED_USER_IPS=${TRACK_PUPPETED_USER_IPS:-false}
      - LETSENCRYPT_HOST=${DOMAIN}
      - MEDIA_RETENTION_LOCAL_LIFETIME
      - MEDIA_RETENTION_REMOTE_LIFETIME
@ -70,6 +93,12 @@ services:
      - USER_IPS_MAX_AGE
      - VIRTUAL_HOST=${DOMAIN}
      - VIRTUAL_PORT=8008
+      - LOGIN_LIMIT_IP_PER_SECOND=${LOGIN_LIMIT_IP_PER_SECOND:-0.003}
+      - LOGIN_LIMIT_IP_BURST=${LOGIN_LIMIT_IP_BURST:-5}
+      - LOGIN_LIMIT_ACCOUNT_PER_SECOND=${LOGIN_LIMIT_ACCOUNT_PER_SECOND:-0.003}
+      - LOGIN_LIMIT_ACCOUNT_BURST=${LOGIN_LIMIT_ACCOUNT_BURST:-5}
+      - ROOM_COMPLEXITY_LIMIT=${ROOM_COMPLEXITY_LIMIT:-100.0}
+      - WEB_CLIENT_LOCATION
    networks:
      - internal
    entrypoint: /docker-entrypoint.sh
@ -81,41 +110,50 @@ services:
      - source: entrypoint_conf
        target: /docker-entrypoint.sh
        mode: 0555
+    deploy:
+      restart_policy:
+        condition: on-failure
+      labels:
+        - "coop-cloud.${STACK_NAME}.version=7.1.1+v1.149.1"
+        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8008/health"]
      interval: 30s
      timeout: 10s
-      retries: 10
+      retries: 30
      start_period: 1m

  db:
-    image: postgres:13-alpine
+    image: pgautoupgrade/pgautoupgrade:17-alpine
    secrets:
      - db_password
    environment:
      - LC_COLLATE=C
      - LC_CTYPE=C
      - POSTGRES_DB=synapse
-      - POSTGRES_INITDB_ARGS="-E \"UTF8\""
+      - POSTGRES_INITDB_ARGS=-E UTF8
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
      - POSTGRES_USER=synapse
      - DOMAIN
    networks:
      - internal
    healthcheck:
-      test: ["CMD", "pg_isready", "-U", "synapse"]
      interval: 30s
      timeout: 10s
-      retries: 10
+      retries: 20
      start_period: 1m
    volumes:
      - postgres:/var/lib/postgresql/data
    deploy:
      labels:
-          backupbot.backup: "true"
-          backupbot.backup.pre-hook: "mkdir -p /tmp/backup/ && PGPASSWORD=$$(cat $${POSTGRES_PASSWORD_FILE}) pg_dump -U $${POSTGRES_USER} $${POSTGRES_DB} > /tmp/backup/backup.sql"
-          backupbot.backup.post-hook: "rm -rf /tmp/backup"
-          backupbot.backup.path: "/tmp/backup/"
+        backupbot.backup: "${ENABLE_BACKUPS:-true}"
+        backupbot.backup.pre-hook: "/pg_backup.sh backup"
+        backupbot.backup.volumes.postgres.path: "backup.sql"
+        backupbot.restore.post-hook: "/pg_backup.sh restore"
+    configs:
+      - source: pg_backup
+        target: /pg_backup.sh
+        mode: 0555

 volumes:
  data:
@ -151,6 +189,9 @@ configs:
    name: ${STACK_NAME}_wk_client_${WK_CLIENT_VERSION}
    file: well_known_client.conf.tmpl
    template_driver: golang
+  pg_backup:
+    name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
+    file: pg_backup.sh

 secrets:
  db_password:
--- a/compress_state_entrypoint.sh
+++ b/compress_state_entrypoint.sh
@ -0,0 +1,46 @@
+#!/bin/sh
+set -e
+
+BINARY="/build/synapse_auto_compressor"
+REPO_DIR="/build/rust-synapse-compress-state"
+DB_PASS=$(cat /run/secrets/db_password)
+CONN="postgresql://synapse:${DB_PASS}@db:5432/synapse"
+CHUNK_SIZE="${STATE_COMPRESS_CHUNK_SIZE:-500}"
+CHUNKS="${STATE_COMPRESS_CHUNKS:-100}"
+SCHEDULE="${STATE_COMPRESS_SCHEDULE:-0 3 * * *}"
+
+# Build from source if binary doesn't exist
+if [ ! -f "$BINARY" ]; then
+  echo "[compress-state] Binary not found, building from source..."
+  apk add --no-cache git openssl-dev openssl-libs-static perl make musl-dev jemalloc-dev
+  rm -rf "$REPO_DIR"
+  git clone https://github.com/matrix-org/rust-synapse-compress-state "$REPO_DIR"
+  cd "$REPO_DIR"
+  cargo build --release -p synapse_auto_compressor
+  cp target/release/synapse_auto_compressor "$BINARY"
+  echo "[compress-state] Build complete"
+  # Clean up source to save space
+  rm -rf "$REPO_DIR"
+else
+  echo "[compress-state] Using cached binary"
+fi
+
+# Run once at startup
+echo "[compress-state] Running initial compression at $(date)"
+"$BINARY" -p "$CONN" -c "$CHUNK_SIZE" -n "$CHUNKS" || echo "[compress-state] Error: $?"
+
+# Set up cron job
+CRON_SCRIPT="/build/run_compressor.sh"
+cat > "$CRON_SCRIPT" <<EOF
+#!/bin/sh
+echo "[compress-state] Running at \$(date)"
+$BINARY -p "$CONN" -c $CHUNK_SIZE -n $CHUNKS || echo "[compress-state] Error: \$?"
+echo "[compress-state] Done at \$(date)"
+EOF
+chmod +x "$CRON_SCRIPT"
+
+echo "$SCHEDULE $CRON_SCRIPT" | crontab -
+echo "[compress-state] Cron scheduled: $SCHEDULE"
+
+# Run crond in the foreground
+exec crond -f -l 2
--- a/entrypoint.sh.tmpl
+++ b/entrypoint.sh.tmpl
@ -6,6 +6,11 @@ chown 991:991 /data

 if [[ ! -f /data/{{ env "DOMAIN" }}.signing.key ]]; then
    /start.py generate
+    chown -R 991:991 /data/*.config /data/*.key
+fi
+
+if [[ -d /signal-data ]]; then
+    chown -R 991:991 /signal-data
 fi

 /start.py
--- a/homeserver.yaml.tmpl
+++ b/homeserver.yaml.tmpl
@ -1,269 +1,390 @@
-# All configuration options are documented on the following link:
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html
-
-{{ if eq (env "SHARED_SECRET_AUTH_ENABLED") "1" }}
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#modules-1
-modules:
-    - module: shared_secret_authenticator.SharedSecretAuthProvider
-      config:
-        shared_secret: {{ secret "shared_secret_auth" }}
-        m_login_password_support_enabled: true
-{{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#server_name
-server_name: {{ or (env "SERVER_NAME") (env "DOMAIN") }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#public_baseurl
-public_baseurl: https://{{ env "DOMAIN" }}/
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#serve_server_wellknown
-serve_server_wellknown: {{ env "SERVE_SERVER_WELLKNOWN" }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#allow_public_rooms_without_auth
-allow_public_rooms_without_auth: false
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#allow_public_rooms_over_federation
-allow_public_rooms_over_federation: {{ env "ALLOW_PUBLIC_ROOMS_FEDERATION" }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#listeners
-listeners:
-  - port: 8008
-    tls: false
-    type: http
-    x_forwarded: true
-
-    {{ if eq (env "DISABLE_FEDERATION") "1" }}
-    resources:
-      {{ if eq (env "KEYCLOAK_ENABLED") "1" }}
-      - names: [client, openid]
-        compress: true
-      {{ else }}
-      - names: [client]
-        compress: true
-      {{ end }}
-    {{ else }}
-    resources:
-      {{ if eq (env "KEYCLOAK_ENABLED") "1" }}
-      - names: [client, openid, federation]
-        compress: true
-      {{ else }}
-      - names: [client, federation]
-        compress: true
-      {{ end }}
-    {{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#admin_contact
-admin_contact: 'mailto:{{ env "ADMIN_EMAIL" }}'
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#limit_remote_rooms
-limit_remote_rooms:
-  enabled: true
-  complexity: 200.0
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#max_avatar_size
-max_avatar_size: 10M
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#forgotten_room_retention_period
-forgotten_room_retention_period: 3d
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#request_token_inhibit_3pid_errors
-request_token_inhibit_3pid_errors: true
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#redaction_retention_period
-redaction_retention_period: {{ env "REDACTION_RETENTION_PERIOD" }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#user_ips_max_age
-user_ips_max_age: {{ env "USER_IPS_MAX_AGE" }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#retention
-retention:
-  enabled: true
-  default_policy:
-    min_lifetime: 1d
-    max_lifetime: {{ env "RETENTION_MAX_LIFETIME" }}
-  allowed_lifetime_min: 1d
-  allowed_lifetime_max: {{ env "ALLOWED_LIFETIME_MAX" }}
-  purge_jobs:
-    - longest_max_lifetime: 3d
-      interval: 12h
-    - shortest_max_lifetime: 3d
-      interval: 1d
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist
-{{ if eq (env "DISABLE_FEDERATION") "1" }}
-federation_domain_whitelist: []
-{{ else if eq (env "ENABLE_ALLOWLIST") "1" }}
-federation_domain_whitelist: {{ env "FEDERATION_ALLOWLIST" }}
-{{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#database-1
-database:
-  name: psycopg2
-  txn_limit: 10000
-  args:
-    user: synapse
-    password: "{{ secret "db_password" }}"
-    database: synapse
-    host: "{{ env "STACK_NAME" }}_db"
-    port: 5432
-    cp_min: 5
-    cp_max: 10
-    keepalives_idle: 10
-    keepalives_interval: 10
-    keepalives_count: 3
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#log_config
-log_config: "/data/log.config"
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#media_store_path
-media_store_path: "/data/media_store"
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#max_upload_size 
-max_upload_size: 50M
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#turn
-{{ if eq (env "TURN_ENABLED") "1" }}
-turn_uris: {{ env "TURN_URIS" }}
-turn_shared_secret: "{{ secret "turn_shared_secret" }}"
-turn_user_lifetime: 1h
-turn_allow_guests: {{ env "TURN_ALLOW_GUESTS" }}
-{{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_registration
-enable_registration: {{ env "ENABLE_REGISTRATION" }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_3pid_lookup
-enable_3pid_lookup: {{ env "ENABLE_3PID_LOOKUP" }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#allow_guest_access
-allow_guest_access: false
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#registration_shared_secret
-registration_shared_secret: {{ secret "registration" }}
-
-{{ if eq (env "AUTO_JOIN_ROOM_ENABLED") "1" }}
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#auto_join_rooms
-auto_join_rooms:
-  - "{{ env "AUTO_JOIN_ROOM" }}"
-{{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#report_stats
-report_stats: false
-
-{{ if eq (env "APP_SERVICES_ENABLED") "1" }}
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#app_service_config_files
-app_service_config_files: {{ env "APP_SERVICE_CONFIGS" }}
-{{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#macaroon_secret_key
-macaroon_secret_key: "{{ secret "macaroon" }}"
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#form_secret
-form_secret: "{{ secret "form_secret" }}"
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#signing_key_path
-signing_key_path: "/data/{{ env "DOMAIN" }}.signing.key"
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#trusted_key_servers
-{{ if eq (env "ENABLE_ALLOWLIST") "1" }}
-trusted_key_servers: [] # NOTE(d1): defaults to requesting server directly, which matches FEDERATION_ALLOWLIST
-{{ else }}
-trusted_key_servers:
-  - server_name: "matrix.org"
-{{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#oidc_providers
-{{ if eq (env "KEYCLOAK_ENABLED") "1" }}
-oidc_providers:
-  - idp_id: {{ env "KEYCLOAK_ID" }}
-    idp_name: {{ env "KEYCLOAK_NAME" }}
-    issuer: "{{ env "KEYCLOAK_URL" }}"
-    client_id: "{{ env "KEYCLOAK_CLIENT_ID" }}"
-    client_secret: "{{ secret "keycloak_client_secret" }}"
-    scopes: ["openid", "profile"]
-    allow_existing_users: {{ env "KEYCLOAK_ALLOW_EXISTING_USERS" }}
-    user_mapping_provider:
-      config:
-        localpart_template: "{{ "{{ user.preferred_username }}" }}"
-        display_name_template: "{{ "{{ user.name }}" }}"
-
-  {{ if eq (env "KEYCLOAK2_ENABLED") "1" }}
-  - idp_id: {{ env "KEYCLOAK2_ID" }}
-    idp_name: {{ env "KEYCLOAK2_NAME" }}
-    issuer: "{{ env "KEYCLOAK2_URL" }}"
-    client_id: "{{ env "KEYCLOAK2_CLIENT_ID" }}"
-    client_secret: "{{ secret "keycloak2_client_secret" }}"
-    scopes: ["openid", "profile"]
-    allow_existing_users: {{ env "KEYCLOAK2_ALLOW_EXISTING_USERS" }}
-    user_mapping_provider:
-      config:
-        localpart_template: "{{ "{{ user.preferred_username }}" }}"
-        display_name_template: "{{ "{{ user.name }}" }}"
-  {{ end }}
-
-  {{ if eq (env "KEYCLOAK3_ENABLED") "1" }}
-  - idp_id: {{ env "KEYCLOAK3_ID" }}
-    idp_name: {{ env "KEYCLOAK3_NAME" }}
-    issuer: "{{ env "KEYCLOAK3_URL" }}"
-    client_id: "{{ env "KEYCLOAK3_CLIENT_ID" }}"
-    client_secret: "{{ secret "keycloak3_client_secret" }}"
-    scopes: ["openid", "profile"]
-    allow_existing_users: {{ env "KEYCLOAK3_ALLOW_EXISTING_USERS" }}
-    user_mapping_provider:
-      config:
-        localpart_template: "{{ "{{ user.preferred_username }}" }}"
-        display_name_template: "{{ "{{ user.name }}" }}"
-  {{ end }}
-{{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#sso 
-{{ if eq (env "KEYCLOAK_ENABLED") "1" }}
-sso:
-  client_whitelist:
-    - https://{{ env "KEYCLOAK_CLIENT_DOMAIN" }}
-{{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#password_config
-password_config:
-   enabled: {{ env "PASSWORD_LOGIN_ENABLED" }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#email
-{{ if eq (env "SMTP_ENABLED") "1" }}
-email:
-  smtp_host: {{ env "SMTP_HOST" }}
-  smtp_port: {{ env "SMTP_PORT" }}
-  smtp_user: {{ env "SMTP_USER" }}
-  smtp_pass: "{{ secret "smtp_password" }}"
-  require_transport_security: true
-  notif_from: Your Friendly %(app)s homeserver <{{ env "SMTP_FROM" }}>
-  app_name: {{ env "SMTP_APP_NAME" }}
-  enable_notifs: true
-  client_base_url: https://{{ env "DOMAIN" }}
-{{ end }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#encryption_enabled_by_default_for_room_type
-encryption_enabled_by_default_for_room_type: {{ env "ENCRYPTED_BY_DEFAULT" }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#user_directory
-user_directory:
-  enabled: true
-  search_all_users: true
-  prefer_local_users: true
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#media_retention
-media_retention:
-  local_media_lifetime: {{ env "MEDIA_RETENTION_LOCAL_LIFETIME" }}
-  remote_media_lifetime: {{ env "MEDIA_RETENTION_REMOTE_LIFETIME" }}
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_metrics
-enable_metrics: false
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#track_appservice_user_ips
-track_appservice_user_ips: false
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#forget_rooms_on_leave
-forget_rooms_on_leave: true
-
-# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#opentracing-1
-opentracing:
-  enabled: false
+# All configuration options are documented on the following link:
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html
+
+{{ if eq (env "SHARED_SECRET_AUTH_ENABLED") "1" }}
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#modules-1
+modules:
+    - module: shared_secret_authenticator.SharedSecretAuthProvider
+      config:
+        shared_secret: {{ secret "shared_secret_auth" }}
+        m_login_password_support_enabled: true
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#server_name
+server_name: {{ or (env "SERVER_NAME") (env "DOMAIN") }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#public_baseurl
+public_baseurl: https://{{ env "DOMAIN" }}/
+
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#require_auth_for_profile_requests
+{{ if (env "REQUIRE_AUTH_FOR_PROFILE_REQUESTS") }}
+require_auth_for_profile_requests: {{ env "REQUIRE_AUTH_FOR_PROFILE_REQUESTS" }}
+{{ end }}
+
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#limit_profile_requests_to_users_who_share_rooms
+{{ if (env "LIMIT_PROFILE_REQUESTS_TO_USERS_WHO_SHARE_ROOMS") }}
+limit_profile_requests_to_users_who_share_rooms: {{ env "LIMIT_PROFILE_REQUESTS_TO_USERS_WHO_SHARE_ROOMS" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#serve_server_wellknown
+{{ if (env "SERVE_SERVER_WELLKNOWN") }}
+serve_server_wellknown: {{ env "SERVE_SERVER_WELLKNOWN" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#allow_public_rooms_without_auth
+allow_public_rooms_without_auth: false
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#allow_public_rooms_over_federation
+{{ if (env "ALLOW_PUBLIC_ROOMS_FEDERATION") }}
+allow_public_rooms_over_federation: {{ env "ALLOW_PUBLIC_ROOMS_FEDERATION" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#listeners
+listeners:
+  - port: 8008
+    tls: false
+    type: http
+    x_forwarded: true
+
+    {{ if eq (env "DISABLE_FEDERATION") "1" }}
+    resources:
+      {{ if eq (env "KEYCLOAK_ENABLED") "1" }}
+      - names: [client, openid]
+        compress: true
+      {{ else }}
+      - names: [client]
+        compress: true
+      {{ end }}
+    {{ else }}
+    resources:
+      {{ if eq (env "KEYCLOAK_ENABLED") "1" }}
+      - names: [client, openid, federation]
+        compress: true
+      {{ else }}
+      - names: [client, federation]
+        compress: true
+      {{ end }}
+    {{ end }}
+
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#delete_stale_devices_after
+{{ if (env "DELETE_STALE_DEVICES_AFTER") }}
+delete_stale_devices_after: {{ env "DELETE_STALE_DEVICES_AFTER" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#admin_contact
+{{ if (env "ADMIN_EMAIL") }}
+admin_contact: 'mailto:{{ env "ADMIN_EMAIL" }}'
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#limit_remote_rooms
+limit_remote_rooms:
+  enabled: true
+  complexity: {{ env "ROOM_COMPLEXITY_LIMIT" }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#max_avatar_size
+max_avatar_size: 10M
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#forgotten_room_retention_period
+forgotten_room_retention_period: 3d
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#request_token_inhibit_3pid_errors
+request_token_inhibit_3pid_errors: true
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#redaction_retention_period
+{{ if (env "REDACTION_RETENTION_PERIOD") }}
+redaction_retention_period: {{ env "REDACTION_RETENTION_PERIOD" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#user_ips_max_age
+{{ if (env "USER_IPS_MAX_AGE") }}
+user_ips_max_age: {{ env "USER_IPS_MAX_AGE" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#retention
+retention:
+  enabled: true
+  default_policy:
+    min_lifetime: 1d
+    {{ if (env "RETENTION_MAX_LIFETIME") }}
+    max_lifetime: {{ env "RETENTION_MAX_LIFETIME" }}
+    {{ end }}
+  allowed_lifetime_min: 1d
+  {{ if (env "ALLOWED_LIFETIME_MAX") }}
+  allowed_lifetime_max: {{ env "ALLOWED_LIFETIME_MAX" }}
+  {{ end }}
+  purge_jobs:
+    - longest_max_lifetime: 3d
+      interval: 12h
+    - shortest_max_lifetime: 3d
+      interval: 1d
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist
+{{ if eq (env "DISABLE_FEDERATION") "1" }}
+federation_domain_whitelist: []
+{{ else if eq (env "ENABLE_ALLOWLIST") "1" }}
+federation_domain_whitelist: {{ env "FEDERATION_ALLOWLIST" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#database-1
+database:
+  name: psycopg2
+  txn_limit: 10000
+  args:
+    user: synapse
+    password: "{{ secret "db_password" }}"
+    database: synapse
+    host: "{{ env "STACK_NAME" }}_db"
+    port: 5432
+    cp_min: 5
+    cp_max: 10
+    keepalives_idle: 10
+    keepalives_interval: 10
+    keepalives_count: 3
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#log_config
+log_config: "/data/log.config"
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#media_store_path
+media_store_path: "/data/media_store"
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#max_upload_size 
+max_upload_size: 50M
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#turn
+{{ if eq (env "TURN_ENABLED") "1" }}
+{{ if (env "TURN_URIS") }}
+turn_uris: {{ env "TURN_URIS" }}
+{{ end }}
+turn_shared_secret: "{{ secret "turn_shared_secret" }}"
+turn_user_lifetime: 1h
+{{ if (env "TURN_ALLOW_GUESTS") }}
+turn_allow_guests: {{ env "TURN_ALLOW_GUESTS" }}
+{{ end }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_registration
+{{ if (env "ENABLE_REGISTRATION") }}
+enable_registration: {{ env "ENABLE_REGISTRATION" }}
+{{ end }}
+
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#registration_requires_token
+{{ if (env "REGISTRATION_REQUIRES_TOKEN") }}
+registration_requires_token: {{ env "REGISTRATION_REQUIRES_TOKEN" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_3pid_lookup
+{{ if (env "ENABLE_3PID_LOOKUP") }}
+enable_3pid_lookup: {{ env "ENABLE_3PID_LOOKUP" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#allow_guest_access
+allow_guest_access: false
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#registration_shared_secret
+registration_shared_secret: {{ secret "registration" }}
+
+{{ if eq (env "AUTO_JOIN_ROOM_ENABLED") "1" }}
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#auto_join_rooms
+
+# AUTO_JOIN_ROOM only for backwards compatibility
+{{ if (env "AUTO_JOIN_ROOM") }}
+auto_join_rooms:
+  - "{{ env "AUTO_JOIN_ROOM" }}"
+{{ else }}
+auto_join_rooms: {{ env "AUTO_JOIN_ROOM_LIST" }}
+{{ end }}
+
+{{ end }}
+
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#session_lifetime
+{{ if (env "SESSION_LIFETIME") }}
+session_lifetime: {{ env "SESSION_LIFETIME" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#report_stats
+report_stats: false
+
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#track_puppeted_user_ips
+{{ if (env "TRACK_PUPPETED_USER_IPS") }}
+track_puppeted_user_ips: {{ env "TRACK_PUPPETED_USER_IPS" }}
+{{ end }}
+
+{{ if eq (env "APP_SERVICES_ENABLED") "1" }}
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#app_service_config_files
+app_service_config_files: {{ env "APP_SERVICE_CONFIGS" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#macaroon_secret_key
+macaroon_secret_key: "{{ secret "macaroon" }}"
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#form_secret
+form_secret: "{{ secret "form_secret" }}"
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#signing_key_path
+signing_key_path: "/data/{{ env "DOMAIN" }}.signing.key"
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#old_signing_keys
+{{ if (and (env "OLD_SIGNING_KEY_ID") (env "OLD_SIGNING_KEY") (env "OLD_SIGNING_KEY_EXPIRES")) }}
+old_signing_keys:
+  "ed25519:{{ env "OLD_SIGNING_KEY_ID" }}": { key: "{{ env "OLD_SIGNING_KEY" }}", expired_ts: {{ env "OLD_SIGNING_KEY_EXPIRES" }} }
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#trusted_key_servers
+{{ if eq (env "ENABLE_ALLOWLIST") "1" }}
+trusted_key_servers: [] # NOTE(d1): defaults to requesting server directly, which matches FEDERATION_ALLOWLIST
+{{ else }}
+trusted_key_servers:
+  - server_name: "matrix.org"
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#oidc_providers
+{{ if eq (env "KEYCLOAK_ENABLED") "1" }}
+oidc_providers:
+  - idp_id: {{ env "KEYCLOAK_ID" }}
+    idp_name: {{ env "KEYCLOAK_NAME" }}
+    issuer: "{{ env "KEYCLOAK_URL" }}"
+    client_id: "{{ env "KEYCLOAK_CLIENT_ID" }}"
+    client_secret: "{{ secret "keycloak_client_secret" }}"
+    scopes: ["openid", "profile"]
+    {{ if (env "KEYCLOAK_ALLOW_EXISTING_USERS") }}
+    allow_existing_users: {{ env "KEYCLOAK_ALLOW_EXISTING_USERS" }}
+    {{ end }}
+    user_mapping_provider:
+      config:
+        localpart_template: "{{ "{{ user.preferred_username }}" }}"
+        display_name_template: "{{ "{{ user.name }}" }}"
+
+  {{ if eq (env "KEYCLOAK2_ENABLED") "1" }}
+  - idp_id: {{ env "KEYCLOAK2_ID" }}
+    idp_name: {{ env "KEYCLOAK2_NAME" }}
+    issuer: "{{ env "KEYCLOAK2_URL" }}"
+    client_id: "{{ env "KEYCLOAK2_CLIENT_ID" }}"
+    client_secret: "{{ secret "keycloak2_client_secret" }}"
+    scopes: ["openid", "profile"]
+    {{ if (env "KEYCLOAK2_ALLOW_EXISTING_USERS") }}
+    allow_existing_users: {{ env "KEYCLOAK2_ALLOW_EXISTING_USERS" }}
+    {{ end }}
+    user_mapping_provider:
+      config:
+        localpart_template: "{{ "{{ user.preferred_username }}" }}"
+        display_name_template: "{{ "{{ user.name }}" }}"
+  {{ end }}
+
+  {{ if eq (env "KEYCLOAK3_ENABLED") "1" }}
+  - idp_id: {{ env "KEYCLOAK3_ID" }}
+    idp_name: {{ env "KEYCLOAK3_NAME" }}
+    issuer: "{{ env "KEYCLOAK3_URL" }}"
+    client_id: "{{ env "KEYCLOAK3_CLIENT_ID" }}"
+    client_secret: "{{ secret "keycloak3_client_secret" }}"
+    scopes: ["openid", "profile"]
+    {{ if (env "KEYCLOAK3_ALLOW_EXISTING_USERS") }}
+    allow_existing_users: {{ env "KEYCLOAK3_ALLOW_EXISTING_USERS" }}
+    {{ end }}
+    user_mapping_provider:
+      config:
+        localpart_template: "{{ "{{ user.preferred_username }}" }}"
+        display_name_template: "{{ "{{ user.name }}" }}"
+  {{ end }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#sso 
+{{ if eq (env "KEYCLOAK_ENABLED") "1" }}
+sso:
+  client_whitelist:
+    - https://{{ env "KEYCLOAK_CLIENT_DOMAIN" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#password_config
+# With MAS (matrix_authentication_service), Synapse rejects password_config.enabled: true — set PASSWORD_LOGIN_ENABLED=false in app .env when MAS_ENABLED=1 (.env.sample).
+{{ if (env "PASSWORD_LOGIN_ENABLED") }}
+password_config:
+   enabled: {{ env "PASSWORD_LOGIN_ENABLED" }}
+{{ end }}
+
+{{ if eq (env "MAS_ENABLED") "1" }}
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#matrix_authentication_service
+matrix_authentication_service:
+  enabled: true
+  endpoint: http://{{ env "STACK_NAME"}}_mas:8080/
+  secret_path: /run/secrets/mas_synapse_shared
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#email
+{{ if eq (env "SMTP_ENABLED") "1" }}
+email:
+  smtp_host: {{ env "SMTP_HOST" }}
+  smtp_port: {{ env "SMTP_PORT" }}
+  smtp_user: {{ env "SMTP_USER" }}
+  smtp_pass: "{{ secret "smtp_password" }}"
+  require_transport_security: true
+  notif_from: Your Friendly %(app)s homeserver <{{ env "SMTP_FROM" }}>
+  app_name: {{ env "SMTP_APP_NAME" }}
+  enable_notifs: true
+  client_base_url: https://{{ env "DOMAIN" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#encryption_enabled_by_default_for_room_type
+{{ if (env "ENCRYPTED_BY_DEFAULT") }}
+encryption_enabled_by_default_for_room_type: {{ env "ENCRYPTED_BY_DEFAULT" }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#user_directory
+{{ if or (env "USER_DIRECTORY_ENABLED") (env "USER_DIRECTORY_SEARCH_ALL_USERS") (env "USER_DIRECTORY_PREFER_LOCAL_USERS") (env "USER_DIRECTORY_SHOW_LOCKED_USERS") }}
+user_directory:
+  {{ if (env "USER_DIRECTORY_ENABLED") }}
+  enabled: {{ env "USER_DIRECTORY_ENABLED" }}
+  {{ end }}
+  {{ if (env "USER_DIRECTORY_SEARCH_ALL_USERS") }}
+  search_all_users: {{ env "USER_DIRECTORY_SEARCH_ALL_USERS" }}
+  {{ end }}
+  {{ if (env "USER_DIRECTORY_PREFER_LOCAL_USERS") }}
+  prefer_local_users: {{ env "USER_DIRECTORY_PREFER_LOCAL_USERS" }}
+  {{ end }}
+  {{ if (env "USER_DIRECTORY_SHOW_LOCKED_USERS") }}
+  show_locked_users: {{ env "USER_DIRECTORY_SHOW_LOCKED_USERS" }}
+  {{ end }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#media_retention
+{{ if or (env "MEDIA_RETENTION_LOCAL_LIFETIME") (env "MEDIA_RETENTION_REMOTE_LIFETIME") }}
+media_retention:
+  {{ if (env "MEDIA_RETENTION_LOCAL_LIFETIME") }}
+  local_media_lifetime: {{ env "MEDIA_RETENTION_LOCAL_LIFETIME" }}
+  {{ end }}
+  {{ if (env "MEDIA_RETENTION_REMOTE_LIFETIME") }}
+  remote_media_lifetime: {{ env "MEDIA_RETENTION_REMOTE_LIFETIME" }}
+  {{ end }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_metrics
+enable_metrics: false
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#track_appservice_user_ips
+track_appservice_user_ips: false
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#forget_rooms_on_leave
+forget_rooms_on_leave: true
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#opentracing-1
+opentracing:
+  enabled: false
+
+# https://matrix-org.github.io/synapse/develop/usage/configuration/config_documentation.html#ratelimiting
+{{ if or (and (env "LOGIN_LIMIT_IP_PER_SECOND") (env "LOGIN_LIMIT_IP_BURST")) (and (env "LOGIN_LIMIT_ACCOUNT_PER_SECOND") (env "LOGIN_LIMIT_ACCOUNT_BURST")) }}
+rc_login:
+{{ if and (env "LOGIN_LIMIT_IP_PER_SECOND") (env "LOGIN_LIMIT_IP_BURST") }}
+  address:
+    per_second: {{ env "LOGIN_LIMIT_IP_PER_SECOND" }}
+    burst_count: {{ env "LOGIN_LIMIT_IP_BURST" }}
+{{ end }}
+{{ if and (env "LOGIN_LIMIT_ACCOUNT_PER_SECOND") (env "LOGIN_LIMIT_ACCOUNT_BURST") }}
+  account:
+    per_second: {{ env "LOGIN_LIMIT_ACCOUNT_PER_SECOND" }}
+    burst_count: {{ env "LOGIN_LIMIT_ACCOUNT_BURST" }}
+{{ end }}
+{{ end }}
+
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#web_client_location
+{{ if (env "WEB_CLIENT_LOCATION") }}
+web_client_location: {{ env "WEB_CLIENT_LOCATION" }}
+{{ end }}
--- a/mas.config.yaml.tmpl
+++ b/mas.config.yaml.tmpl
@ -0,0 +1,73 @@
+# Docs: https://element-hq.github.io/matrix-authentication-service/
+
+http:
+  public_base: https://{{ env "DOMAIN" }}/
+  trusted_proxies:
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+    - 127.0.0.0/8
+    - fd00::/8
+    - ::1/128
+  listeners:
+    - name: web
+      resources:
+        - name: discovery
+        - name: human
+        - name: oauth
+        - name: compat
+        - name: graphql
+          playground: false
+        - name: assets
+        # https://element-hq.github.io/matrix-authentication-service/reference/configuration.html#httplisteners
+        - name: health
+      binds:
+        - address: "[::]:8080"
+
+database:
+  uri: postgresql://synapse:{{ secret "db_password" }}@{{ env "STACK_NAME" }}_db:5432/mas?sslmode=disable
+
+matrix:
+  kind: synapse
+  homeserver: {{ or (env "SERVER_NAME") (env "DOMAIN") }}
+  endpoint: http://{{ env "STACK_NAME" }}_app:8008/
+  secret_file: /run/secrets/mas_synapse_shared
+
+secrets:
+  # Plain hex in file (abra: length=64 charset=hex). See .env.sample modifiers.
+  encryption_file: /run/secrets/mas_encryption
+  keys:
+    - key_file: /run/secrets/mas_signing_rsa
+
+passwords:
+  enabled: true
+  schemes:
+    - version: 1
+      algorithm: bcrypt
+      unicode_normalization: true
+    - version: 2
+      algorithm: argon2id
+
+{{ if env "MAS_UPSTREAM_PROVIDER_ID" }}
+# https://element-hq.github.io/matrix-authentication-service/setup/sso.html
+upstream_oauth2:
+  providers:
+    - id: {{ env "MAS_UPSTREAM_PROVIDER_ID" }}
+      {{ if env "MAS_UPSTREAM_SYNAPSE_IDP_ID" }}synapse_idp_id: {{ env "MAS_UPSTREAM_SYNAPSE_IDP_ID" }}{{ end }}
+      human_name: {{ or (env "MAS_UPSTREAM_HUMAN_NAME") "SSO" }}
+      issuer: {{ env "MAS_UPSTREAM_ISSUER" }}
+      client_id: {{ env "MAS_UPSTREAM_CLIENT_ID" }}
+      client_secret_file: /run/secrets/mas_upstream_client
+      token_endpoint_auth_method: client_secret_basic
+      scope: "openid profile email"
+      claims_imports:
+        localpart:
+          action: require
+          template: "{{ "{{ user.preferred_username }}" }}"
+        displayname:
+          action: suggest
+          template: "{{ "{{ user.name }}" }}"
+        email:
+          action: suggest
+          template: "{{ "{{ user.email }}" }}"
+{{ end }}
--- a/nginx.conf.tmpl
+++ b/nginx.conf.tmpl
@ -5,18 +5,68 @@ events {
 }

 http {
+
+  resolver 127.0.0.11 valid=30s ipv6=off;
+  resolver_timeout 5s;
+
+  upstream matrix_upstream {
+    zone matrix_upstream 64k;
+    server {{ env "STACK_NAME"}}_app:8008 resolve;
+    keepalive 16;
+  }
+
+{{ if eq (env "MAS_ENABLED") "1" }}
+  upstream mas_upstream {
+    zone mas_upstream 64k;
+    server {{ env "STACK_NAME"}}_mas:8080 resolve;
+    keepalive 8;
+  }
+{{ end }}
+
  server {
    listen 80;

-    access_log off;
-    error_log /dev/null;
+    access_log {{ or (env "NGINX_ACCESS_LOG_LOCATION") "/dev/null" }};
+    error_log {{ or (env "NGINX_ERROR_LOG_LOCATION") "/dev/null" }};

    server_name {{ env "DOMAIN" }};

-    location ~* ^(\/_matrix|\/_synapse\/client) {
-      proxy_pass http://{{ env "STACK_NAME"}}_synapse:8008;
+    location = / {
+      proxy_pass http://matrix_upstream;
      proxy_set_header X-Forwarded-For $remote_addr;
-      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Host $host;
+      client_max_body_size 50M;
+      proxy_http_version 1.1;
+    }
+    
+{{ if eq (env "MAS_ENABLED") "1" }}
+    # MAS on same Host as Synapse (public_base = https://$DOMAIN/): browser/OIDC paths live at repo root, not only under /_matrix/
+    # Router reference: element-hq/matrix-authentication-service crates/router/src/endpoints.rs
+    # https://element-hq.github.io/matrix-authentication-service/setup/reverse-proxy.html
+    location ~ ^/(complete-compat-sso/|oauth2/|\.well-known/(openid-configuration|webfinger|change-password)|authorize|login|logout|register(/|$)|account/|upstream/|consent/|link(\?|/|$)|device/|recover(/|$)|assets/|graphql(/|$)|api/) {
+      proxy_pass http://mas_upstream;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto https;
+      client_max_body_size 50M;
+    }
+    # Matrix CS API compat (login / logout / refresh and subpaths, e.g. …/login/sso/redirect) — before generic /_matrix
+    location ~ ^/_matrix/client/[^/]+/(login|logout|refresh)(/.*)?$ {
+      proxy_pass http://mas_upstream;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto https;
+      client_max_body_size 50M;
+    }
+{{ end }}
+
+    location ~* ^(\/_matrix|\/_synapse\/client|\/_synapse\/mas) {
+      proxy_pass http://matrix_upstream;
+      proxy_set_header X-Forwarded-For $remote_addr;
+      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host $host;
      client_max_body_size 50M;
      proxy_http_version 1.1;
@ -27,5 +77,20 @@ http {
      default_type application/json;
      add_header Access-Control-Allow-Origin  *;
    }
+
+{{ if eq (env "ADMIN_INTERFACE_ENABLED") "1" }}
+    location ^~ /_synapse/admin {
+      if ($http_referer !~ "^https://{{ env "DOMAIN" }}/admin/") {
+        return 403;
+      }
+      proxy_pass http://matrix_upstream;
+      proxy_set_header X-Forwarded-For $remote_addr;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Host $host;
+      client_max_body_size 50M;
+      proxy_http_version 1.1;
+    }
+{{ end }}
+
  }
 }
--- a/pg_backup.sh
+++ b/pg_backup.sh
@ -0,0 +1,34 @@
+#!/bin/bash
+
+set -e
+
+BACKUP_FILE='/var/lib/postgresql/data/backup.sql'
+
+function backup {
+  export PGPASSWORD=$(cat $POSTGRES_PASSWORD_FILE)
+  pg_dump -U ${POSTGRES_USER} ${POSTGRES_DB} | gzip > $BACKUP_FILE
+}
+
+function restore {
+    cd /var/lib/postgresql/data/
+    restore_config(){
+        # Restore allowed connections
+        cat pg_hba.conf.bak > pg_hba.conf
+        su postgres -c 'pg_ctl reload'
+    }
+    # Don't allow any other connections than local
+    cp pg_hba.conf pg_hba.conf.bak
+    echo "local all all trust" > pg_hba.conf
+    su postgres -c 'pg_ctl reload'
+    trap restore_config EXIT INT TERM
+
+    # Recreate Database
+    psql -U ${POSTGRES_USER} -d postgres -c "DROP DATABASE ${POSTGRES_DB} WITH (FORCE);" 
+    createdb -U ${POSTGRES_USER} ${POSTGRES_DB}
+    gunzip -c $BACKUP_FILE | psql -U ${POSTGRES_USER} -d ${POSTGRES_DB} -1 -f -
+
+    trap - EXIT INT TERM
+    restore_config
+}
+
+$@
--- a/release/4.0.0+v1.93.0
+++ b/release/4.0.0+v1.93.0
@ -5,4 +5,6 @@ Copy the secrets:
 * `registration_shared_secret` to `registration`
 * `macaroon_secret_key` to `macaroon`

+The easiest way to do this is to run `abra app run <matrix.example.com> app bash` BEFORE this upgrade, then `cat /run/secrets/registration_shared_secret`.  If you haven't saved the secrets yet, and would like to, please Ctrl+C out of this upgrade and do that first.
+
 Regeneration of these secrets should also work.
--- a/release/5.0.0+v1.93.0
+++ b/release/5.0.0+v1.93.0
@ -1,17 +1 @@
-An Nginx proxy has been configured as the entrypoint for Synapse. This is not
-optional. This is done to counteract IP collection in Synapse itself. See more:
-
-!!! You MUST undeploy your Synapse install before upgrading to this version !!!
-
-This is because there have been a service rename in the recipe configuration:
-
-* `app` -> `synapse`
-
-This could break stuff in the recipe, so please report issues if you run into
-anything!
-
-    https://git.coopcloud.tech/coop-cloud/matrix-synapse/issues/38
-
-Thanks!
-
-- d1
+It's recommended not to upgrade / downgrade directly to this version (or other 5.y.z versions), because of service renaming which was reverted in 6.0.0+v1.100.0.
--- a/release/5.0.1+v1.93.0
+++ b/release/5.0.1+v1.93.0
@ -0,0 +1,6 @@
+Logging is now disabled by default. If you want to reënable it, set these options:
+
+```
+NGINX_ACCESS_LOG_LOCATION="/dev/stdout"
+NGINX_ERROR_LOG_LOCATION="/dev/stderr"
+```
--- a/release/6.0.0+v1.100.0
+++ b/release/6.0.0+v1.100.0
@ -0,0 +1 @@
+If you are upgrading from verison 5.y.z of this recipe, you will need to `undeploy` then `deploy`, because of a service rename which was reverted.
--- a/release/6.6.1+v1.124.0
+++ b/release/6.6.1+v1.124.0
@ -0,0 +1 @@
+added env REGISTRATION_REQUIRES_TOKEN
--- a/release/6.6.2+v1.124.0
+++ b/release/6.6.2+v1.124.0
@ -0,0 +1 @@
+new optional env vars for user_directory and privacy options
--- a/release/6.6.3+v1.124.0
+++ b/release/6.6.3+v1.124.0
@ -0,0 +1 @@
+added env for old-signing-keys
--- a/release/6.7.1+v1.133.0
+++ b/release/6.7.1+v1.133.0
@ -0,0 +1 @@
+This patch contains a critical nginx fix, to allow resolving docker internal hosts.
--- a/release/6.8.2+v1.139.2
+++ b/release/6.8.2+v1.139.2
@ -0,0 +1 @@
+this patch is a reset to the state of the last known deploying version 6.8.0 – so better skip 6.8.1
--- a/release/7.0.0+v1.149.1
+++ b/release/7.0.0+v1.149.1
@ -0,0 +1,2 @@
+WARNING: Backup your database!
+This upgrade switches the database image from postgres to pgautoupgrade and performs an in-place database upgrades from version 13 to 17.
--- a/release/7.1.0+v1.149.1
+++ b/release/7.1.0+v1.149.1
@ -0,0 +1 @@
+added matrix-authentication-service as opt-in to the recipe, see readme for details
--- a/release/next
+++ b/release/next
@ -1,8 +0,0 @@
-We had to rename some secrets: https://git.coopcloud.tech/coop-cloud/matrix-synapse/issues/35
-
-Copy the secrets:
-
-* `registration_shared_secret` to `registration`
-* `macaroon_secret_key` to `macaroon`
-
-Regeneration of these secrets should also work.
--- a/renovate.json
+++ b/renovate.json
@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}
--- a/signal_bridge.yaml.tmpl
+++ b/signal_bridge.yaml.tmpl
@ -1,324 +1,411 @@
-# Homeserver details
-homeserver:
-    # The address that this appservice can use to connect to the homeserver.
-    address: {{ env "HOMESERVER_URL" }}
-    # The domain of the homeserver (for MXIDs, etc).
-    domain: {{ env "HOMESERVER_DOMAIN" }}
-    # Whether or not to verify the SSL certificate of the homeserver.
-    # Only applies if address starts with https://
-    verify_ssl: {{ env "VERIFY_SSL" }}
-    # What software is the homeserver running?
-    # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here.
-    software: standard
-    # Number of retries for all HTTP requests if the homeserver isn't reachable.
-    http_retry_count: 4
-    # The URL to push real-time bridge status to.
-    # If set, the bridge will make POST requests to this URL whenever a user's Signal connection state changes.
-    # The bridge will use the appservice as_token to authorize requests.
-    status_endpoint: null
-    # Endpoint for reporting per-message status.
-    message_send_checkpoint_endpoint: null
-    # Maximum number of simultaneous HTTP connections to the homeserver.
-    connection_limit: 100
-    # Whether asynchronous uploads via MSC2246 should be enabled for media.
-    # Requires a media repo that supports MSC2246.
-    async_media: false
-
-# Application service host/registration related details
-# Changing these values requires regeneration of the registration.
-appservice:
-    # The address that the homeserver can use to connect to this appservice.
-    address: http://signalbridge:29328
-    # When using https:// the TLS certificate and key files for the address.
-    tls_cert: false
-    tls_key: false
-    # The hostname and port where this appservice should listen.
-    hostname: 0.0.0.0
-    port: 29328
-    # The maximum body size of appservice API requests (from the homeserver) in mebibytes
-    # Usually 1 is enough, but on high-traffic bridges you might need to increase this to avoid 413s
-    max_body_size: 1
-    # The full URI to the database. SQLite and Postgres are supported.
-    # However, SQLite support is extremely experimental and should not be used.
-    # Format examples:
-    #   SQLite:   sqlite:///filename.db
-    #   Postgres: postgres://username:password@hostname/dbname
-    database: postgres://signalbridge:{{ secret "signal_db_password" }}@signaldb/signalbridge
-    # Additional arguments for asyncpg.create_pool() or sqlite3.connect()
-    # https://magicstack.github.io/asyncpg/current/api/index.html#asyncpg.pool.create_pool
-    # https://docs.python.org/3/library/sqlite3.html#sqlite3.connect
-    # For sqlite, min_size is used as the connection thread pool size and max_size is ignored.
-    # Additionally, SQLite supports init_commands as an array of SQL queries to run on connect (e.g. to set PRAGMAs).
-    database_opts:
-        min_size: 1
-        max_size: 10
-    # The unique ID of this appservice.
-    id: signal
-    # Username of the appservice bot.
-    bot_username: signalbot
-    # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
-    # to leave display name/avatar as-is.
-    bot_displayname: Signal bridge bot
-    bot_avatar: mxc://maunium.net/wPJgTQbZOtpBFmDNkiNEMDUp
-    # Whether or not to receive ephemeral events via appservice transactions.
-    # Requires MSC2409 support (i.e. Synapse 1.22+).
-    # You should disable bridge -> sync_with_custom_puppets when this is enabled.
-    ephemeral_events: true
-    # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
-    as_token: "{{ secret "signal_as_token" }}"
-    hs_token: "{{ secret "signal_hs_token" }}"
-
-# Prometheus telemetry config. Requires prometheus-client to be installed.
-metrics:
-    enabled: false
-    listen_port: 8000
-
-# Manhole config.
-manhole:
-    # Whether or not opening the manhole is allowed.
-    enabled: false
-    # The path for the unix socket.
-    path: /var/tmp/mautrix-signal.manhole
-    # The list of UIDs who can be added to the whitelist.
-    # If empty, any UIDs can be specified in the open-manhole command.
-    whitelist:
-        - 0
-
-signal:
-    # Path to signald unix socket
-    socket_path: /signald/signald.sock
-    # Directory for temp files when sending files to Signal. This should be an
-    # absolute path that signald can read. For attachments in the other direction,
-    # make sure signald is configured to use an absolute path as the data directory.
-    outgoing_attachment_dir: /signald/attachments
-    # Directory where signald stores avatars for groups.
-    avatar_dir: /signald/avatars
-    # Directory where signald stores auth data. Used to delete data when logging out.
-    data_dir: /signald/data
-    # Whether or not unknown signald accounts should be deleted when the bridge is started.
-    # When this is enabled, any UserInUse errors should be resolved by restarting the bridge.
-    delete_unknown_accounts_on_start: false
-    # Whether or not message attachments should be removed from disk after they're bridged.
-    remove_file_after_handling: true
-    # Whether or not users can register a primary device
-    registration_enabled: true
-    # Whether or not to enable disappearing messages in groups. If enabled, then the expiration
-    # time of the messages will be determined by the first users to read the message, rather
-    # than individually. If the bridge has a single user, this can be turned on safely.
-    enable_disappearing_messages_in_groups: false
-
-# Bridge config
-bridge:
-    # Localpart template of MXIDs for Signal users.
-    # {userid} is replaced with an identifier for the Signal user.
-    username_template: "signal_{userid}"
+# Network-specific config options
+network:
    # Displayname template for Signal users.
-    # {displayname} is replaced with the displayname of the Signal user, which is the first
-    # available variable in displayname_preference. The variables in displayname_preference
-    # can also be used here directly.
-    displayname_template: "{displayname} (Signal)"
-    # Whether or not contact list displaynames should be used.
-    # Possible values: disallow, allow, prefer
-    #
-    # Multi-user instances are recommended to disallow contact list names, as otherwise there can
-    # be conflicts between names from different users' contact lists.
-    contact_list_names: disallow
-    # Available variables: full_name, first_name, last_name, phone, uuid
-    displayname_preference:
-        - full_name
-        - phone
-    # Whether or not to create portals for all groups on login/connect.
-    autocreate_group_portal: true
-    # Whether or not to create portals for all contacts on login/connect.
-    autocreate_contact_portal: false
-    # Whether or not to make portals of Signal groups in which joining via invite link does
-    # not need to be approved by an administrator publicly joinable on Matrix.
-    public_portals: false
-    # Whether or not to use /sync to get read receipts and typing notifications
-    # when double puppeting is enabled
-    sync_with_custom_puppets: false
-    # Whether or not to update the m.direct account data event when double puppeting is enabled.
-    # Note that updating the m.direct event is not atomic (except with mautrix-asmux)
-    # and is therefore prone to race conditions.
-    sync_direct_chat_list: false
-    # Allow using double puppeting from any server with a valid client .well-known file.
-    double_puppet_allow_discovery: false
-    # Servers to allow double puppeting from, even if double_puppet_allow_discovery is false.
-    double_puppet_server_map:
-        {{ env "HOMESERVER_DOMAIN" }}: {{ env "HOMESERVER_URL" }}
-    # Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth
-    #
-    # If set, custom puppets will be enabled automatically for local users
-    # instead of users having to find an access token and run `login-matrix`
-    # manually.
-    # If using this for other servers than the bridge's server,
-    # you must also set the URL in the double_puppet_server_map.
-    login_shared_secret_map:
-        {{ env "HOMESERVER_DOMAIN" }}: {{ secret "shared_secret_auth" }}
-    # Whether or not created rooms should have federation enabled.
-    # If false, created portal rooms will never be federated.
-    federate_rooms: true
-    # End-to-bridge encryption support options.
-    #
-    # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.
-    encryption:
-        # Allow encryption, work in group chat rooms with e2ee enabled
-        allow: {{ env "SIGNAL_ENABLE_ENCRYPTION" }}
-        # Default to encryption, force-enable encryption in all portals the bridge creates
-        # This will cause the bridge bot to be in private chats for the encryption to work properly.
-        default: false
-        # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data.
-        appservice: false
-        # Require encryption, drop any unencrypted messages.
-        require: false
-        # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
-        # You must use a client that supports requesting keys from other users to use this feature.
-        allow_key_sharing: false
-        # What level of device verification should be required from users?
-        #
-        # Valid levels:
-        #   unverified - Send keys to all device in the room.
-        #   cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys.
-        #   cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes).
-        #   cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot.
-        #                           Note that creating user signatures from the bridge bot is not currently possible.
-        #   verified - Require manual per-device verification
-        #              (currently only possible by modifying the `trust` column in the `crypto_device` database table).
-        verification_levels:
-            # Minimum level for which the bridge should send keys to when bridging messages from Telegram to Matrix.
-            receive: unverified
-            # Minimum level that the bridge should accept for incoming Matrix messages.
-            send: unverified
-            # Minimum level that the bridge should require for accepting key requests.
-            share: cross-signed-tofu
-        # Options for Megolm room key rotation. These options allow you to
-        # configure the m.room.encryption event content. See:
-        # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for
-        # more information about that event.
-        rotation:
-            # Enable custom Megolm room key rotation settings. Note that these
-            # settings will only apply to rooms created after this option is
-            # set.
-            enable_custom: false
-            # The maximum number of milliseconds a session should be used
-            # before changing it. The Matrix spec recommends 604800000 (a week)
-            # as the default.
-            milliseconds: 604800000
-            # The maximum number of messages that should be sent with a given a
-            # session before changing it. The Matrix spec recommends 100 as the
-            # default.
-            messages: 100
-    # Whether or not to explicitly set the avatar and room name for private
-    # chat portal rooms. This will be implicitly enabled if encryption.default is true.
-    private_chat_portal_meta: false
-    # Whether or not the bridge should send a read receipt from the bridge bot when a message has
-    # been sent to Signal. This let's you check manually whether the bridge is receiving your
-    # messages.
-    # Note that this is not related to Signal delivery receipts.
-    delivery_receipts: false
-    # Whether or not delivery errors should be reported as messages in the Matrix room.
-    delivery_error_reports: true
-    # Whether the bridge should send the message status as a custom com.beeper.message_send_status event.
-    message_status_events: false
-    # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run.
-    # This field will automatically be changed back to false after it,
-    # except if the config file is not writable.
-    resend_bridge_info: false
-    # Interval at which to resync contacts (in seconds).
-    periodic_sync: 0
-    # Should leaving the room on Matrix make the user leave on Signal?
-    bridge_matrix_leave: true
-    # Provisioning API part of the web server for automated portal creation and fetching information.
-    # Used by things like mautrix-manager (https://github.com/tulir/mautrix-manager).
-    provisioning:
-        # Whether or not the provisioning API should be enabled.
-        enabled: true
-        # The prefix to use in the provisioning API endpoints.
-        prefix: /_matrix/provision
-        # The shared secret to authorize users of the API.
-        # Set to "generate" to generate and save a new token.
-        shared_secret: generate
-        # Segment API key to enable analytics tracking for web server
-        # endpoints. Set to null to disable.
-        # Currently the only events are login start, QR code scan, and login
-        # success/failure.
-        segment_key: null
+    # {{ "{{.ProfileName}}" }} - The Signal profile name set by the user.
+    # {{ "{{.ContactName}}" }} - The name for the user from your phone's contact list. This is not safe on multi-user instances.
+    # {{ "{{.PhoneNumber}}" }} - The phone number of the user.
+    # {{ "{{.UUID}}" }} - The UUID of the Signal user.
+    # {{ "{{.AboutEmoji}}" }} - The emoji set by the user in their profile.
+    displayname_template: '{{ "{{or .ProfileName .PhoneNumber \"Unknown user\"}}" }}'
+    # Should avatars from the user's contact list be used? This is not safe on multi-user instances.
+    use_contact_avatars: false
+    # Should the bridge request the user's contact list from the phone on startup?
+    sync_contacts_on_startup: true
+    # Should the bridge sync ghost user info even if profile fetching fails? This is not safe on multi-user instances.
+    use_outdated_profiles: false
+    # Should the Signal user's phone number be included in the room topic in private chat portal rooms?
+    number_in_topic: true
+    # Default device name that shows up in the Signal app.
+    device_name: mautrix-signal
+    # Avatar image for the Note to Self room.
+    note_to_self_avatar: mxc://maunium.net/REBIVrqjZwmaWpssCZpBlmlL
+    # Format for generating URLs from location messages for sending to Signal.
+    # Google Maps: 'https://www.google.com/maps/place/%[1]s,%[2]s'
+    # OpenStreetMap: 'https://www.openstreetmap.org/?mlat=%[1]s&mlon=%[2]s'
+    location_format: 'https://www.google.com/maps/place/%[1]s,%[2]s'
+    
+
+# Config options that affect the central bridge module.
+bridge:
    # The prefix for commands. Only required in non-management rooms.
-    command_prefix: "!signal"
-    # Messages sent upon joining a management room.
-    # Markdown is supported. The defaults are listed below.
-    management_room_text:
-        # Sent when joining a room.
-        welcome: "Hello, I'm a Signal bridge bot."
-        # Sent when joining a management room and the user is already logged in.
-        welcome_connected: "Use `help` for help."
-        # Sent when joining a management room and the user is not logged in.
-        welcome_unconnected: "Use `help` for help or `link` to log in."
-        # Optional extra text sent when joining a management room.
-        additional_help: ""
-    # Send each message separately (for readability in some clients)
-    management_room_multiple_messages: false
+    command_prefix: '!signal'
+    # Should the bridge create a space for each login containing the rooms that account is in?
+    personal_filtering_spaces: true
+    # Whether the bridge should set names and avatars explicitly for DM portals.
+    # This is only necessary when using clients that don't support MSC4171.
+    private_chat_portal_meta: false
+
+    # Should leaving Matrix rooms be bridged as leaving groups on the remote network?
+    bridge_matrix_leave: false
+    # Should room tags only be synced when creating the portal? Tags mean things like favorite/pin and archive/low priority.
+    # Tags currently can't be synced back to the remote network, so a continuous sync means tagging from Matrix will be undone.
+    tag_only_on_create: true
+    # Should room mute status only be synced when creating the portal?
+    # Like tags, mutes can't currently be synced back to the remote network.
+    mute_only_on_create: true
+
+    # What should be done to portal rooms when a user logs out or is logged out?
+    # Permitted values:
+    #   nothing - Do nothing, let the user stay in the portals
+    #   kick - Remove the user from the portal rooms, but don't delete them
+    #   unbridge - Remove all ghosts in the room and disassociate it from the remote chat
+    #   delete - Remove all ghosts and users from the room (i.e. delete it)
+    cleanup_on_logout:
+        # Should cleanup on logout be enabled at all?
+        enabled: false
+        # Settings for manual logouts (explicitly initiated by the Matrix user)
+        manual:
+            # Action for private portals which will never be shared with other Matrix users.
+            private: nothing
+            # Action for portals with a relay user configured.
+            relayed: nothing
+            # Action for portals which may be shared, but don't currently have any other Matrix users.
+            shared_no_users: nothing
+            # Action for portals which have other logged-in Matrix users.
+            shared_has_users: nothing
+        # Settings for credentials being invalidated (initiated by the remote network, possibly through user action).
+        # Keys have the same meanings as in the manual section.
+        bad_credentials:
+            private: nothing
+            relayed: nothing
+            shared_no_users: nothing
+            shared_has_users: nothing
+
+    # Settings for relay mode
+    relay:
+        # Whether relay mode should be allowed. If allowed, the set-relay command can be used to turn any
+        # authenticated user into a relaybot for that chat.
+        enabled: true
+        # Should only admins be allowed to set themselves as relay users?
+        # If true, non-admins can only set users listed in default_relays as relays in a room.
+        admin_only: true
+        # List of user login IDs which anyone can set as a relay, as long as the relay user is in the room.
+        default_relays: []
+        # The formats to use when sending messages via the relaybot.
+        # Available variables:
+        #   .Sender.UserID - The Matrix user ID of the sender.
+        #   .Sender.Displayname - The display name of the sender (if set).
+        #   .Sender.RequiresDisambiguation - Whether the sender's name may be confused with the name of another user in the room.
+        #   .Sender.DisambiguatedName - The disambiguated name of the sender. This will be the displayname if set,
+        #                               plus the user ID in parentheses if the displayname is not unique.
+        #                               If the displayname is not set, this is just the user ID.
+        #   .Message - The `formatted_body` field of the message.
+        #   .Caption - The `formatted_body` field of the message, if it's a caption. Otherwise an empty string.
+        #   .FileName - The name of the file being sent.
+        message_formats:
+            m.text: "{{`{{ .Sender.DisambiguatedName }}: {{ .Message }}`}}"
+            m.notice: "{{`{{ .Sender.DisambiguatedName }}: {{ .Message }}`}}"
+            m.emote: "{{`* {{ .Sender.DisambiguatedName }} {{ .Message }}`}}"
+            m.file: "{{`{{ .Sender.DisambiguatedName }} sent a file{{ if .Caption }}: {{ .Caption }}{{ end }}`}}"
+            m.image: "{{`{{ .Sender.DisambiguatedName }} sent an image{{ if .Caption }}: {{ .Caption }}{{ end }}`}}"
+            m.audio: "{{`{{ .Sender.DisambiguatedName }} sent an audio file{{ if .Caption }}: {{ .Caption }}{{ end }}`}}"
+            m.video: "{{`{{ .Sender.DisambiguatedName }} sent a video{{ if .Caption }}: {{ .Caption }}{{ end }}`}}"
+            m.location: "{{`{{ .Sender.DisambiguatedName }} sent a location{{ if .Caption }}: {{ .Caption }}{{ end }}`}}"
+        # For networks that support per-message displaynames (i.e. Slack and Discord), the template for those names.
+        # This has all the Sender variables available under message_formats (but without the .Sender prefix).
+        # Note that you need to manually remove the displayname from message_formats above.
+        displayname_format: "{{`{{ .DisambiguatedName }}`}}"
+
+
    # Permissions for using the bridge.
    # Permitted values:
-    #      relay - Allowed to be relayed through the bridge, no access to commands.
-    #       user - Use the bridge with puppeting.
-    #      admin - Use and administrate the bridge.
+    #    relay - Talk through the relaybot (if enabled), no access otherwise
+    # commands - Access to use commands in the bridge, but not login.
+    #     user - Access to use the bridge with puppeting.
+    #    admin - Full access, user level with some additional administration tools.
    # Permitted keys:
    #        * - All Matrix users
    #   domain - All users on that homeserver
    #     mxid - Specific user
    permissions: {{ env "SIGNAL_BRIDGE_PERMISSIONS" }}

-    relay:
-        # Whether relay mode should be allowed. If allowed, `!signal set-relay` can be used to turn any
-        # authenticated user into a relaybot for that chat.
-        enabled: false
-        # The formats to use when sending messages to Signal via a relay user.
-        #
-        # Available variables:
-        #   $sender_displayname - The display name of the sender (e.g. Example User)
-        #   $sender_username    - The username (Matrix ID localpart) of the sender (e.g. exampleuser)
-        #   $sender_mxid        - The Matrix ID of the sender (e.g. @exampleuser:example.com)
-        #   $message            - The message content
-        message_formats:
-            m.text: '$sender_displayname: $message'
-            m.notice: '$sender_displayname: $message'
-            m.emote: '* $sender_displayname $message'
-            m.file: '$sender_displayname sent a file'
-            m.image: '$sender_displayname sent an image'
-            m.audio: '$sender_displayname sent an audio file'
-            m.video: '$sender_displayname sent a video'
-            m.location: '$sender_displayname sent a location'
-        # Specify a dedicated relay account. Must be a regular matrix account logged into this bridge
-        # and double puppeting working to auto-accept invites. When this user is invited to a room
-        # it will automatically be set as the relay user. May be overridden with `set-relay` or `unset-relay`
-        relaybot: '@relaybot:example.com'
-    # Format for generting URLs from location messages for sending to Signal
-    # Google Maps: 'https://www.google.com/maps/place/{lat},{long}'
-    # OpenStreepMap: 'https://www.openstreetmap.org/?mlat={lat}&mlon={long}'
-    location_format: 'https://www.google.com/maps/place/{lat},{long}'
+# Config for the bridge's database.
+database:
+    # The database type. "sqlite3-fk-wal" and "postgres" are supported.
+    type: postgres
+    # The database URI.
+    #   SQLite: A raw file path is supported, but `file:<path>?_txlock=immediate` is recommended.
+    #           https://github.com/mattn/go-sqlite3#connection-string
+    #   Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable
+    #             To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql
+    uri:  postgres://signalbridge:{{ secret "signal_db_password" }}@signaldb/signalbridge?sslmode=disable
+    # Maximum number of connections.
+    max_open_conns: 5
+    max_idle_conns: 1
+    # Maximum connection idle time and lifetime before they're closed. Disabled if null.
+    # Parsed with https://pkg.go.dev/time#ParseDuration
+    max_conn_idle_time: null
+    max_conn_lifetime: null

-# Python logging configuration.
+# Homeserver details.
+homeserver:
+    # The address that this appservice can use to connect to the homeserver.
+    # Local addresses without HTTPS are generally recommended when the bridge is running on the same machine,
+    # but https also works if they run on different machines.
+    address: {{ env "HOMESERVER_URL" }}
+    # The domain of the homeserver (also known as server_name, used for MXIDs, etc).
+    domain: {{ env "HOMESERVER_DOMAIN" }}
+
+    # What software is the homeserver running?
+    # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here.
+    software: standard
+    # The URL to push real-time bridge status to.
+    # If set, the bridge will make POST requests to this URL whenever a user's remote network connection state changes.
+    # The bridge will use the appservice as_token to authorize requests.
+    status_endpoint: null
+    # Endpoint for reporting per-message status.
+    # If set, the bridge will make POST requests to this URL when processing a message from Matrix.
+    # It will make one request when receiving the message (step BRIDGE), one after decrypting if applicable
+    # (step DECRYPTED) and one after sending to the remote network (step REMOTE). Errors will also be reported.
+    # The bridge will use the appservice as_token to authorize requests.
+    message_send_checkpoint_endpoint:
+    # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246?
+    async_media: false
+
+    # Should the bridge use a websocket for connecting to the homeserver?
+    # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy,
+    # mautrix-asmux (deprecated), and hungryserv (proprietary).
+    websocket: false
+    # How often should the websocket be pinged? Pinging will be disabled if this is zero.
+    ping_interval_seconds: 0
+
+# Application service host/registration related details.
+# Changing these values requires regeneration of the registration (except when noted otherwise)
+appservice:
+    # The address that the homeserver can use to connect to this appservice.
+    address: http://signalbridge:29328
+    # A public address that external services can use to reach this appservice.
+    # This value doesn't affect the registration file.
+    public_address: https://bridge.example.com
+
+    # The hostname and port where this appservice should listen.
+    hostname: 0.0.0.0
+    port: 29328
+
+    # The unique ID of this appservice.
+    id: signal
+    # Appservice bot details.
+    bot:
+        # Username of the appservice bot.
+        username: signalbot
+        # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+        # to leave display name/avatar as-is.
+        displayname: Signal bridge bot
+        avatar: mxc://maunium.net/wPJgTQbZOtpBFmDNkiNEMDUp
+
+    # Whether to receive ephemeral events via appservice transactions.
+    ephemeral_events: true
+    # Should incoming events be handled asynchronously?
+    # This may be necessary for large public instances with lots of messages going through.
+    # However, messages will not be guaranteed to be bridged in the same order they were sent in.
+    # This value doesn't affect the registration file.
+    async_transactions: false
+
+    # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
+    as_token: "{{ secret "signal_as_token" }}"
+    hs_token: "{{ secret "signal_hs_token" }}"
+
+    # Localpart template of MXIDs for remote users.
+    # {{ "{{.}}" }} is replaced with the internal ID of the user.
+    username_template: signal_{{ "{{.}}" }}
+
+# Config options that affect the Matrix connector of the bridge.
+matrix:
+    # Whether the bridge should send the message status as a custom com.beeper.message_send_status event.
+    message_status_events: false
+    # Whether the bridge should send a read receipt after successfully bridging a message.
+    delivery_receipts: false
+    # Whether the bridge should send error notices via m.notice events when a message fails to bridge.
+    message_error_notices: true
+    # Whether the bridge should update the m.direct account data event when double puppeting is enabled.
+    sync_direct_chat_list: false
+    # Whether created rooms should have federation enabled. If false, created portal rooms
+    # will never be federated. Changing this option requires recreating rooms.
+    federate_rooms: true
+
+# Settings for provisioning API
+provisioning:
+    # Prefix for the provisioning API paths.
+    prefix: /_matrix/provision
+    # Shared secret for authentication. If set to "generate" or null, a random secret will be generated,
+    # or if set to "disable", the provisioning API will be disabled.
+    shared_secret: generate
+    # Whether to allow provisioning API requests to be authed using Matrix access tokens.
+    # This follows the same rules as double puppeting to determine which server to contact to check the token,
+    # which means that by default, it only works for users on the same server as the bridge.
+    allow_matrix_auth: true
+    # Enable debug API at /debug with provisioning authentication.
+    debug_endpoints: false
+
+# Some networks require publicly accessible media download links (e.g. for user avatars when using Discord webhooks).
+# These settings control whether the bridge will provide such public media access.
+public_media:
+    # Should public media be enabled at all?
+    # The public_address field under the appservice section MUST be set when enabling public media.
+    enabled: false
+    # A key for signing public media URLs.
+    # If set to "generate", a random key will be generated.
+    signing_key: generate
+    # Number of seconds that public media URLs are valid for.
+    # If set to 0, URLs will never expire.
+    expiry: 0
+    # Length of hash to use for public media URLs. Must be between 0 and 32.
+    hash_length: 32
+
+# Settings for converting remote media to custom mxc:// URIs instead of reuploading.
+# More details can be found at https://docs.mau.fi/bridges/go/discord/direct-media.html
+direct_media:
+    # Should custom mxc:// URIs be used instead of reuploading media?
+    enabled: false
+    # The server name to use for the custom mxc:// URIs.
+    # This server name will effectively be a real Matrix server, it just won't implement anything other than media.
+    # You must either set up .well-known delegation from this domain to the bridge, or proxy the domain directly to the bridge.
+    server_name: discord-media.example.com
+    # Optionally a custom .well-known response. This defaults to `server_name:443`
+    well_known_response:
+    # Optionally specify a custom prefix for the media ID part of the MXC URI.
+    media_id_prefix:
+    # If the remote network supports media downloads over HTTP, then the bridge will use MSC3860/MSC3916
+    # media download redirects if the requester supports it. Optionally, you can force redirects
+    # and not allow proxying at all by setting this to false.
+    # This option does nothing if the remote network does not support media downloads over HTTP.
+    allow_proxy: true
+    # Matrix server signing key to make the federation tester pass, same format as synapse's .signing.key file.
+    # This key is also used to sign the mxc:// URIs to ensure only the bridge can generate them.
+    server_key: generate
+
+# Settings for backfilling messages.
+# Note that the exact way settings are applied depends on the network connector.
+# See https://docs.mau.fi/bridges/general/backfill.html for more details.
+backfill:
+    # Whether to do backfilling at all.
+    enabled: false
+    # Maximum number of messages to backfill in empty rooms.
+    max_initial_messages: 50
+    # Maximum number of missed messages to backfill after bridge restarts.
+    max_catchup_messages: 500
+    # If a backfilled chat is older than this number of hours,
+    # mark it as read even if it's unread on the remote network.
+    unread_hours_threshold: 720
+    # Settings for backfilling threads within other backfills.
+    threads:
+        # Maximum number of messages to backfill in a new thread.
+        max_initial_messages: 50
+    # Settings for the backwards backfill queue. This only applies when connecting to
+    # Beeper as standard Matrix servers don't support inserting messages into history.
+    queue:
+        # Should the backfill queue be enabled?
+        enabled: false
+        # Number of messages to backfill in one batch.
+        batch_size: 100
+        # Delay between batches in seconds.
+        batch_delay: 20
+        # Maximum number of batches to backfill per portal.
+        # If set to -1, all available messages will be backfilled.
+        max_batches: -1
+        # Optional network-specific overrides for max batches.
+        # Interpretation of this field depends on the network connector.
+        max_batches_override: {}
+
+# Settings for enabling double puppeting
+double_puppet:
+    # Servers to always allow double puppeting from.
+    # This is only for other servers and should NOT contain the server the bridge is on.
+    servers:
+        {{ env "HOMESERVER_DOMAIN" }}: {{ env "HOMESERVER_URL" }}
+    # Whether to allow client API URL discovery for other servers. When using this option,
+    # users on other servers can use double puppeting even if their server URLs aren't
+    # explicitly added to the servers map above.
+    allow_discovery: false
+    # Shared secrets for automatic double puppeting.
+    # See https://docs.mau.fi/bridges/general/double-puppeting.html for instructions.
+    secrets:
+        {{ env "HOMESERVER_DOMAIN" }}: {{ secret "shared_secret_auth" }}
+
+# End-to-bridge encryption support options.
 #
-# See section 16.7.2 of the Python documentation for more info:
-# https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema
+# See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.
+encryption:
+    # Whether to enable encryption at all. If false, the bridge will not function in encrypted rooms.
+    allow: {{ env "SIGNAL_ENABLE_ENCRYPTION" }}
+    # Whether to force-enable encryption in all bridged rooms.
+    default: {{ env "SIGNAL_DEFAULT_ENCRYPTION" }}
+    # Whether to require all messages to be encrypted and drop any unencrypted messages.
+    require: false
+    # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data.
+    # This option is not yet compatible with standard Matrix servers like Synapse and should not be used.
+    appservice: false
+    # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
+    # You must use a client that supports requesting keys from other users to use this feature.
+    allow_key_sharing: false
+    # Pickle key for encrypting encryption keys in the bridge database.
+    # If set to generate, a random key will be generated.
+    pickle_key: {{ secret "signal_pickle_key" }}
+    # Options for deleting megolm sessions from the bridge.
+    delete_keys:
+        # Beeper-specific: delete outbound sessions when hungryserv confirms
+        # that the user has uploaded the key to key backup.
+        delete_outbound_on_ack: false
+        # Don't store outbound sessions in the inbound table.
+        dont_store_outbound: false
+        # Ratchet megolm sessions forward after decrypting messages.
+        ratchet_on_decrypt: false
+        # Delete fully used keys (index >= max_messages) after decrypting messages.
+        delete_fully_used_on_decrypt: false
+        # Delete previous megolm sessions from same device when receiving a new one.
+        delete_prev_on_new_session: false
+        # Delete megolm sessions received from a device when the device is deleted.
+        delete_on_device_delete: false
+        # Periodically delete megolm sessions when 2x max_age has passed since receiving the session.
+        periodically_delete_expired: false
+        # Delete inbound megolm sessions that don't have the received_at field used for
+        # automatic ratcheting and expired session deletion. This is meant as a migration
+        # to delete old keys prior to the bridge update.
+        delete_outdated_inbound: false
+    # What level of device verification should be required from users?
+    #
+    # Valid levels:
+    #   unverified - Send keys to all device in the room.
+    #   cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys.
+    #   cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes).
+    #   cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot.
+    #                           Note that creating user signatures from the bridge bot is not currently possible.
+    #   verified - Require manual per-device verification
+    #              (currently only possible by modifying the `trust` column in the `crypto_device` database table).
+    verification_levels:
+        # Minimum level for which the bridge should send keys to when bridging messages from the remote network to Matrix.
+        receive: unverified
+        # Minimum level that the bridge should accept for incoming Matrix messages.
+        send: unverified
+        # Minimum level that the bridge should require for accepting key requests.
+        share: cross-signed-tofu
+    # Options for Megolm room key rotation. These options allow you to configure the m.room.encryption event content.
+    # See https://spec.matrix.org/v1.10/client-server-api/#mroomencryption for more information about that event.
+    rotation:
+        # Enable custom Megolm room key rotation settings. Note that these
+        # settings will only apply to rooms created after this option is set.
+        enable_custom: false
+        # The maximum number of milliseconds a session should be used
+        # before changing it. The Matrix spec recommends 604800000 (a week)
+        # as the default.
+        milliseconds: 604800000
+        # The maximum number of messages that should be sent with a given a
+        # session before changing it. The Matrix spec recommends 100 as the
+        # default.
+        messages: 100
+        # Disable rotating keys when a user's devices change?
+        # You should not enable this option unless you understand all the implications.
+        disable_device_change_key_rotation: false
+
+# Logging config. See https://github.com/tulir/zeroconfig for details.
 logging:
-    version: 1
-    formatters:
-        colored:
-            (): mautrix_signal.util.ColorFormatter
-            format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s"
-        normal:
-            format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s"
-    handlers:
-        console:
-            class: logging.StreamHandler
-            formatter: colored
-    loggers:
-        mau:
-            level: ERROR
-        aiohttp:
-            level: ERROR
-    root:
-        level: ERROR
-        handlers: [console]
+    min_level: debug
+    writers:
+        - type: stdout
+          format: pretty-colored
+        - type: file
+          format: json
+          filename: ./logs/bridge.log
+          max_size: 100
+          max_backups: 10
+          compress: false
--- a/well_known_client.conf.tmpl
+++ b/well_known_client.conf.tmpl
@ -1,5 +1,8 @@
 {
  "m.homeserver": {
    "base_url": "https://{{ env "DOMAIN" }}"
-  }
+  }{{ if eq (env "MAS_ENABLED") "1" }},
+  "org.matrix.msc2965.authentication": {
+    "issuer": "https://{{ env "DOMAIN" }}/"
+  }{{ end }}
 }
Author	SHA1	Message	Date
notplants	74f1adaccb	Merge pull request 'Add documentation for matrix federation + traefik labels for federation via port 8448 on matrix-federation entrypoint' (#62 ) from compress-and-federate into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/62 Reviewed-by: 3wordchant <3wordchant@noreply.git.coopcloud.tech>	2026-06-08 18:17:34 +00:00
notplants	17a399ba25	Merge pull request 'Add compression to recipe' (#61 ) from compress into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/61	2026-06-08 18:17:11 +00:00
notplants	b63dde1275	Merge remote-tracking branch 'origin/main' into compress # Conflicts: # homeserver.yaml.tmpl	2026-06-08 18:13:25 +00:00
notplants	f836c74386	improvements to readme	2026-06-08 14:03:16 -04:00
notplants	e257349b37	improve documentation of federation	2026-06-04 14:30:29 -04:00
3wordchant	5b21a6b4f9	Merge pull request 'chore: Configure Renovate' (#56 ) from renovate/configure into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/56	2026-05-28 17:11:13 +00:00
notplants	b730cadb06	docs: document the three federation setup options	2026-05-25 13:05:11 -04:00
notplants	59ad89cfb4	add traefik labels for matrix-federation entrypoint Adds a second Traefik router on the web (nginx) service that listens on the `matrix-federation` entrypoint (host port 8448 via the traefik recipe's compose.matrix.yml) and uses Host(${SERVER_NAME}). Lets remote homeservers reach this server's federation/key endpoints via the standard `<server_name>:8448` fallback when no .well-known or SRV delegation exists for SERVER_NAME — useful when SERVER_NAME differs from DOMAIN and no external service serves /.well-known/matrix/server. Requires MATRIX_FEDERATION_ENABLED=1 on the traefik stack.	2026-05-25 15:52:16 +00:00
Simon	d75ca4f11f	chore: publish 7.1.1+v1.149.1 release Co-authored-by: Cursor <cursoragent@cursor.com>	2026-05-12 23:52:32 +02:00
Simon	cff6cfb001	fix minor bugs with mas integration	2026-05-12 21:46:13 +02:00
Simon	d82d539424	docs: update mad readme	2026-05-11 13:51:33 +02:00
simon	b4c3db38c3	Merge pull request 'add matrix authentication service incl migration #57 ' (#58 ) from add-matrix-authentication-service into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/58	2026-05-11 11:25:53 +00:00
Simon	3f488167bc	chore: publish 7.1.0+v1.149.1 release	2026-05-11 13:19:17 +02:00
notplants	f66bfef727	working on configurable room complexity limits	2026-04-30 15:06:54 -04:00
notplants	a809333dcb	comments	2026-04-29 15:18:13 -04:00
notplants	b39c60d594	add run_compressor command	2026-04-29 15:01:50 -04:00
notplants	4830b0596c	adding many abra commands	2026-04-29 14:47:51 -04:00
notplants	43d68aefb4	use vacuum full	2026-04-29 13:44:55 -04:00
notplants	91efd92d31	add abra command for vacuum full	2026-04-29 13:40:41 -04:00
notplants	3fab725957	Add optional compose for rust-synapse-compress-state	2026-04-29 13:14:49 -04:00
Simon	c71dc162cb	readd cleanup trap to mas migration script	2026-04-09 11:51:39 +02:00
Simon	625b0381f8	readd cleanup trap to mas migration script	2026-04-09 11:48:25 +02:00
Simon	7492e8bd4e	add mas healthcheck	2026-04-09 10:54:51 +02:00
Simon	60bd8b1b49	provide readme for mas setup and migration	2026-04-08 14:06:10 +02:00
Simon	6f47fca73b	add script to perform mas migration compatibility check	2026-04-08 13:18:28 +02:00
Simon	dd92cd4bd7	add config for upstream oidc provider for mas	2026-04-08 13:02:22 +02:00
Simon	cf30cebf8e	add function to init mas database	2026-04-07 16:20:34 +02:00
Simon	5481b7e31c	add initial mas setup	2026-04-07 14:59:19 +02:00
Simon	8a7978b388	add docs for breaking share secret authenticator	2026-03-31 15:17:29 +02:00
Simon	d0d5cfb1bc	chore: publish 7.0.2+v1.149.1 release	2026-03-31 14:55:43 +02:00
Simon	3d13505330	bumb python version for shared secret authenticator	2026-03-31 14:53:32 +02:00
Moritz	68fd515297	chore: publish 7.0.1+v1.149.1 release	2026-03-30 13:04:48 +02:00
Moritz	01e3feb1cf	fix: healthchecks and restart_policy for web container	2026-03-30 13:02:27 +02:00
Moritz	c51120c41a	chore: publish 7.0.0+v1.149.1 release	2026-03-25 01:20:30 +01:00
Moritz	b81fecdd23	chore: replace depricated traefik.docker.* with traefik.swarm.*	2026-03-17 17:26:54 +01:00
Renovate Bot	a5a3a1938d	Add renovate.json	2026-03-10 19:22:42 +00:00
knoflook	18b658c452	chore: publish 6.8.3+v1.139.2 release	2026-03-05 14:49:59 +01:00
knoflook	553fee0e9d	feat: compress db dumps	2026-03-05 14:49:11 +01:00
val	61f357b49e	new patch version of recipe	2026-01-15 16:58:40 +01:00
val	0e55594727	Merge pull request 'revert to recipe state of v6.8.0' (#55 ) from revert-changes into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/55	2026-01-15 15:48:56 +00:00
val	460f5a969c	revert to recipe state of v6.8.0	2026-01-15 11:13:51 +01:00
Moritz	8640abbe79	increase healthcheck retries	2025-12-23 13:26:48 +01:00
val	3e0c9063c4	Merge branch '6.8.1fix'	2025-10-29 13:55:54 +01:00
val	db6440b317	fixed MAX_UPLOAD_SIZE and AUTO_JOIN_ROOM_LIST config	2025-10-29 13:49:02 +01:00
vdietrich	24f7e0cb35	chore: publish 6.8.1+v1.139.2 release	2025-10-28 17:17:22 +01:00
lambdabundesverband	6d1397562b	Merge pull request 'added env to configure several auto_join_rooms' (#52 ) from auto_join_room_list into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/52	2025-10-28 16:14:38 +00:00
lambdabundesverband	e0c0861c16	Merge branch 'main' into auto_join_room_list	2025-10-28 16:14:13 +00:00
vdietrich	41fdcafaa0	added env to configure several auto_join_rooms	2025-10-28 17:12:33 +01:00
Cassowary	730dbc4569	Merge pull request 'Expose max_upload_size as a configurable option' (#51 ) from cas_expose_maxupload into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/51 Reviewed-by: decentral1se <decentral1se@noreply.git.coopcloud.tech>	2025-10-17 17:05:30 +00:00
Simon	809055dadb	chore: publish 6.8.0+v1.139.2 release	2025-10-08 16:43:20 +02:00
Cassowary	7703bbbce7	Bump config versions	2025-10-03 11:20:39 -07:00
Cassowary	e3df032bda	Expose max_upload_size as a configurable option	2025-10-02 11:40:51 -07:00
Moritz	0cf9d0a244	chore: publish 6.7.1+v1.133.0 release	2025-09-07 11:49:20 +02:00
Moritz	86a44afd19	fix nginx	2025-09-07 11:27:17 +02:00
carla	cf47a9c1b0	chore: publish 6.7.0+v1.133.0 release	2025-07-07 16:11:13 +02:00
val	aaa59a7718	chore: publish 6.6.3+v1.124.0 release	2025-06-12 22:28:18 +02:00
val	e072cf0766	Merge pull request 'old-signing-key - anyone an idea how to escape so it's only one env var?' (#50 ) from old-signing-key into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/50 Reviewed-by: 3wordchant <3wordchant@noreply.git.coopcloud.tech>	2025-06-12 20:23:56 +00:00
val	22cc356a56	Merge branch 'main' into old-signing-key	2025-06-12 20:23:13 +00:00
Moritz	160b0eb2cf	fix: remove full env name "ADMIN_INTERFACE_ENABLED" from comment to allow autouncomment	2025-06-11 14:48:43 +02:00
val	af7f7eca2f	typos	2025-06-10 18:47:38 +02:00
val	5808fef48d	add env	2025-06-08 12:20:46 +02:00
vdietrich	a8483dccf9	chore: publish 6.6.2+v1.124.0 release	2025-06-05 11:04:16 +02:00
lambdabundesverband	8e82c16e3d	Merge pull request 'added-env-vars' (#49 ) from added-env-vars into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/49	2025-06-05 08:58:39 +00:00
vdietrich	dafb17aace	added some privacy related optional env-vars	2025-06-04 18:12:01 +02:00
vdietrich	237e2c832b	user directory env vars	2025-06-04 16:59:58 +02:00
Moritz	bf4de0df97	Set healthcheck interval higher for slow systems	2025-05-15 11:06:21 +02:00
vdietrich	61222baaa0	chore: publish 6.6.1+v1.124.0 release	2025-05-14 17:01:58 +02:00
marlon	32721ace23	Merge pull request 'Add `REGISTRATION_REQUIRES_TOKEN` to matrix config' (#46 ) from FunPecan/matrix-synapse:add-registration-token into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/46 Reviewed-by: decentral1se <decentral1se@noreply.git.coopcloud.tech>	2025-04-15 21:47:06 +00:00
Jeremy Blanchard	5a7b7f04ed	Bump homeserver version	2025-04-15 08:45:05 -07:00
Jeremy Blanchard	8809f25ab1	Add regsitration token	2025-04-14 16:49:58 -07:00
Moritz	0645a9f487	chore: publish 6.6.0+v1.124.0 release	2025-02-11 19:02:04 +01:00
Moritz	a1d7fdad2d	bump python version in shared_secret_authenticator module	2025-02-11 19:01:59 +01:00
Moritz	a90ccaa65b	add synapse-admin	2025-01-28 17:42:07 +01:00
Simon	7c0e822940	fix bridge token extraction	2025-01-17 20:13:09 +01:00
Simon	d6178fd380	improve set_bridge_tokens	2025-01-17 17:45:18 +01:00
Simon	2a18291f48	add script to setup bridge tokens	2025-01-17 15:43:47 +01:00
vdietrich	943ed58db4	new version of signal bridge conf	2025-01-16 15:53:46 +01:00
lambdabundesverband	09b60947ee	Merge pull request 'updated signal bridge to 0.7.5 and added env var for default encry bridge2server' (#44 ) from addtional-env-vars into main Reviewed-on: https://git.coopcloud.tech/coop-cloud/matrix-synapse/pulls/44 Reviewed-by: decentral1se <decentral1se@noreply.git.coopcloud.tech>	2025-01-16 14:00:16 +00:00
vdietrich	bff6fe9b09	updated signal bridge to 0.7.5 and added env var for default encry bridge2server	2025-01-16 14:15:04 +01:00
Cassowary	6f4efd64e8	Update .drone.yml	2025-01-08 10:09:13 -08:00
Moritz	202af642cf	chore: publish 6.5.0+v1.117.0 release	2024-10-29 15:34:42 +01:00
Moritz	29f31e0a7b	fix drone runner	2024-10-24 14:41:32 +02:00
Moritz	5c6985596e	update backupbot label	2024-10-24 14:30:32 +02:00
3wc	dfe893160f	chore: publish 6.4.0+v1.116.0 release	2024-10-02 15:14:01 -04:00
Simon	99bce91794	chore: publish 6.3.0+v1.113.0 release	2024-09-19 14:59:56 +02:00
Simon	599a219a5f	Merge branch 'update-signalbot'	2024-09-19 14:58:13 +02:00
Simon	0498d8006f	finalize signal bot upgrade	2024-09-19 14:57:49 +02:00
Simon	28ccd46ef1	enable relay mode	2024-09-11 16:24:08 +02:00
Simon	8c60f7e5d5	add server_name to .env	2024-09-11 14:51:23 +02:00
Simon	77ffb17f86	Update Bridge Readme	2024-08-29 13:32:13 +02:00
Simon	eae5c82d88	update signalbot and fix configs	2024-08-29 13:30:25 +02:00
Javielico	68ff2b64da	chore: publish 6.2.0+v1.113.0 release	2024-08-26 18:27:52 +01:00
Javielico	ef6e35ba3a	chore: publish 6.1.4+v1.112.0 release	2024-08-26 18:26:37 +01:00
Javielico	8c4d88b20c	chore: publish 6.1.3+v1.111.1 release	2024-08-26 18:25:45 +01:00
Javielico	6bd2f0b779	chore: publish 6.1.2+v1.111.0 release	2024-08-26 18:22:58 +01:00
Simon	8f9c66e95d	Update Bridge Readme	2024-08-21 18:37:06 +02:00
Moritz	e2bec9e4b4	README: create user	2024-08-13 11:47:11 +02:00
Moritz	da95b5c70d	chore: publish 6.1.1+v1.110.0 release	2024-07-26 14:09:19 +02:00
Moritz	f13856b14c	add web_client_location	2024-07-26 14:09:12 +02:00
Moritz	2c8dc7c960	chore: publish 6.1.0+v1.110.0 release	2024-07-16 15:30:01 +02:00
Moritz	c36c147dff	add alakazam integration file alaconnect.yml	2024-05-13 17:37:27 +02:00
Moritz	8a37984e15	chore: publish 6.0.2+v1.100.0 release	2024-04-17 16:40:04 +02:00
Moritz	63a1abb2c0	fix backup label	2024-04-17 16:37:26 +02:00
3wc	86106b6b6f	chore: publish 6.0.1+v1.100.0 release	2024-04-13 11:05:40 -03:00
3wc	8250916051	Update release notes [ci skip]	2024-04-13 11:05:21 -03:00
3wc	e007bda255	chore: publish 6.0.0+v1.100.0 release	2024-04-12 12:31:50 -03:00
3wc	951fc56434	app → web, synapse → app Fixes #42	2024-04-12 12:30:05 -03:00
Moritz	6fe14edef7	chore: publish 5.0.5+v1.100.0 release	2024-04-09 10:10:07 +02:00
Moritz	a0a9c2b863	Revert "chore: publish 5.0.5+1.25.3 release" This reverts commit `bdf8e11dc5`.	2024-04-09 10:08:22 +02:00
3wc	bdf8e11dc5	chore: publish 5.0.5+1.25.3 release	2024-03-27 00:45:39 -03:00
3wc	2658fed366	Fix permissions on generated files	2024-03-27 00:38:39 -03:00
Simon	72b59ce4ad	chore: publish 5.0.4+v1.100.0 release	2024-03-13 14:18:51 +01:00
Moritz	dfed1e54da	chore: publish 5.0.4+v1.100.0 release	2024-02-19 13:55:03 +01:00
3wc	d4ccb3588b	chore: publish 5.0.3+v1.100.0 release	2024-02-08 14:59:48 -03:00
3wc	11f70b7878	chore: publish 5.1.0+1.25.3 release	2024-02-08 14:47:50 -03:00
Moritz	fd601c23f3	chore: publish 5.0.2+v1.93.0 release	2023-11-09 13:01:48 +01:00
knoflook	b9097c1f94	fix: don't break when logging in with keycloak	2023-10-23 20:19:17 +02:00
				`@ -0,0 +1 @@`
				If you are upgrading from verison 5.y.z of this recipe, you will need to `undeploy` then `deploy`, because of a service rename which was reverted.
				`@ -0,0 +1 @@`
				`new optional env vars for user_directory and privacy options`
				`@ -0,0 +1 @@`
				`This patch contains a critical nginx fix, to allow resolving docker internal hosts.`
				`@ -0,0 +1 @@`
				`this patch is a reset to the state of the last known deploying version 6.8.0 – so better skip 6.8.1`
				`@ -0,0 +1 @@`
				`added matrix-authentication-service as opt-in to the recipe, see readme for details`