Thore Cimbal
3935f359f9
Decision sorb. Measured basis rather than preference: four months of operation with zero destinations, zero remote users and zero rooms with outside participation, while the federation API answered publicly - the delegation routes it over 443, so 8448 being shut never mattered. An empty list federates with nobody and one entry opens it for exactly that domain, so the capability stays one line away rather than gone. The comment records what must not be done instead, because it is not obvious and it would look correct: blocking /_matrix/federation at the edge. lk-jwt-service verifies OpenID tokens through /_matrix/federation/v1/openid/userinfo and reaches it over the public name - no hostAliases, ClusterFirst DNS - so a path-level block kills group calls. Synapse serves that endpoint without an X-Matrix signature, so the whitelist does not touch it. Caught while validating: the first version of this edit split the auto_join block, moving auto_join_rooms_for_guests under federation. Functionally identical after the fragments merge, wrong to read, and fixed before pushing - the diff is now 20 added lines and nothing moved.
106 lines
3.8 KiB
YAML
106 lines
3.8 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: ess-synapse-custom
|
|
namespace: matrix
|
|
data:
|
|
values.yaml: |
|
|
synapse:
|
|
logging:
|
|
rootLevel: INFO
|
|
levelOverrides:
|
|
synapse.media.url_previewer: DEBUG
|
|
# ClamAV media scanning module (Issue #19) - mounted read-only from a ConfigMap
|
|
# (synapse-clamav-module) since the container runs with a read-only root filesystem
|
|
# and we avoid a custom Synapse image; PYTHONPATH picks it up for the `modules:`
|
|
# block below.
|
|
extraVolumes:
|
|
- name: clamav-spam-checker
|
|
configMap:
|
|
name: synapse-clamav-module
|
|
extraVolumeMounts:
|
|
- name: clamav-spam-checker
|
|
mountPath: /extra-modules/clamav_spam_checker.py
|
|
subPath: clamav_spam_checker.py
|
|
readOnly: true
|
|
extraEnv:
|
|
- name: PYTHONPATH
|
|
value: /extra-modules
|
|
additional:
|
|
url-previews:
|
|
config: |
|
|
url_preview_enabled: true
|
|
url_preview_ip_range_blacklist:
|
|
- '127.0.0.0/8'
|
|
- '10.0.0.0/8'
|
|
- '172.16.0.0/12'
|
|
- '192.168.0.0/16'
|
|
- '::1/128'
|
|
- 'fe80::/10'
|
|
- 'fc00::/7'
|
|
max_spider_size: 10M
|
|
retention:
|
|
config: |
|
|
retention:
|
|
enabled: true
|
|
default_policy:
|
|
min_lifetime: 1d
|
|
max_lifetime: 1y
|
|
allowed_lifetime_min: 1d
|
|
allowed_lifetime_max: 2y
|
|
purge_jobs:
|
|
- longest_max_lifetime: 3d
|
|
interval: 12h
|
|
- shortest_max_lifetime: 3d
|
|
longest_max_lifetime: 1w
|
|
interval: 1d
|
|
- shortest_max_lifetime: 1w
|
|
interval: 2d
|
|
|
|
media_retention:
|
|
local_media_lifetime: 365d
|
|
remote_media_lifetime: 90d
|
|
|
|
redaction_retention_period: 7d
|
|
forgotten_room_retention_period: 28d
|
|
user_ips_max_age: 90d
|
|
auto_join:
|
|
config: |
|
|
auto_join_rooms:
|
|
- "#onboarding:axion1337.chat"
|
|
auto_join_rooms_for_guests: false
|
|
# Foederation geschlossen (Entscheidung sorb 2026-08-19, management #0060,
|
|
# ADR-0021). Leere Liste = mit KEINEM Server foederieren; ein Eintrag hier
|
|
# oeffnet gezielt fuer diese eine Domain.
|
|
#
|
|
# Grundlage war eine Messung, keine Meinung: in vier Monaten Betrieb null
|
|
# Eintraege in `destinations`, null fremde Nutzer, null Raeume mit fremder
|
|
# Beteiligung - bei gleichzeitig oeffentlich erreichbarer Foederations-API
|
|
# (die Delegation fuehrt sie ueber 443, 8448 ist ohnehin zu).
|
|
#
|
|
# ⚠️ NICHT betroffen und darf es auch nicht sein:
|
|
# /_matrix/federation/v1/openid/userinfo. Ueber diesen Endpunkt prueft der
|
|
# MatrixRTC-Authorisation-Service (lk-jwt-service) die OpenID-Tokens, und er
|
|
# ruft ihn ueber den OEFFENTLICHEN Namen auf - das Deployment hat keine
|
|
# hostAliases und ClusterFirst-DNS. Synapse bedient ihn ohne
|
|
# X-Matrix-Signatur (REQUIRE_AUTH=False), die Whitelist greift dort also
|
|
# nicht. Wer hier auf Pfad-Ebene sperrt statt ueber diese Liste, legt die
|
|
# Gruppen-Calls lahm - genau der mrtc-Ausfall, nur mit anderer Ursache.
|
|
federation:
|
|
config: |
|
|
federation_domain_whitelist: []
|
|
room_publish:
|
|
config: |
|
|
room_list_publication_rules:
|
|
- user_id: "*"
|
|
action: allow
|
|
oembed:
|
|
config: |
|
|
oembed_enabled: true
|
|
clamav-module:
|
|
config: |
|
|
modules:
|
|
- module: clamav_spam_checker.ClamAVSpamChecker
|
|
config:
|
|
clamd_host: "clamav.matrix.svc.cluster.local"
|
|
clamd_port: 3310 |