72 lines
2.0 KiB
Cheetah
72 lines
2.0 KiB
Cheetah
# Docs: https://element-hq.github.io/matrix-authentication-service/
|
|
|
|
http:
|
|
public_base: https://{{ env "DOMAIN" }}/
|
|
trusted_proxies:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
- 127.0.0.0/8
|
|
- fd00::/8
|
|
- ::1/128
|
|
listeners:
|
|
- name: web
|
|
resources:
|
|
- name: discovery
|
|
- name: human
|
|
- name: oauth
|
|
- name: compat
|
|
- name: graphql
|
|
playground: false
|
|
- name: assets
|
|
binds:
|
|
- address: "[::]:8080"
|
|
|
|
database:
|
|
uri: postgresql://synapse:{{ secret "db_password" }}@{{ env "STACK_NAME" }}_db:5432/mas?sslmode=disable
|
|
|
|
matrix:
|
|
kind: synapse
|
|
homeserver: {{ or (env "SERVER_NAME") (env "DOMAIN") }}
|
|
endpoint: http://{{ env "STACK_NAME" }}_app:8008/
|
|
secret_file: /run/secrets/mas_synapse_shared
|
|
|
|
secrets:
|
|
# Plain hex in file (abra: length=64 charset=hex). See .env.sample modifiers.
|
|
encryption_file: /run/secrets/mas_encryption
|
|
keys:
|
|
- key_file: /run/secrets/mas_signing_rsa
|
|
|
|
passwords:
|
|
enabled: true
|
|
schemes:
|
|
- version: 1
|
|
algorithm: bcrypt
|
|
unicode_normalization: true
|
|
- version: 2
|
|
algorithm: argon2id
|
|
|
|
{{ if env "MAS_UPSTREAM_PROVIDER_ID" }}
|
|
# https://element-hq.github.io/matrix-authentication-service/setup/sso.html
|
|
upstream_oauth2:
|
|
providers:
|
|
- id: {{ env "MAS_UPSTREAM_PROVIDER_ID" }}
|
|
{{ if env "MAS_UPSTREAM_SYNAPSE_IDP_ID" }}synapse_idp_id: {{ env "MAS_UPSTREAM_SYNAPSE_IDP_ID" }}{{ end }}
|
|
human_name: {{ or (env "MAS_UPSTREAM_HUMAN_NAME") "SSO" }}
|
|
issuer: {{ env "MAS_UPSTREAM_ISSUER" }}
|
|
client_id: {{ env "MAS_UPSTREAM_CLIENT_ID" }}
|
|
client_secret_file: /run/secrets/mas_upstream_client_secret
|
|
token_endpoint_auth_method: client_secret_basic
|
|
scope: "openid profile email"
|
|
claims_imports:
|
|
localpart:
|
|
action: require
|
|
template: "{{ "{{ user.preferred_username }}" }}"
|
|
displayname:
|
|
action: suggest
|
|
template: "{{ "{{ user.name }}" }}"
|
|
email:
|
|
action: suggest
|
|
template: "{{ "{{ user.email }}" }}"
|
|
{{ end }}
|