# Matrix Synapse Configuration for mischlabs.de
# Vor-konfiguriert für Docker, PostgreSQL und Keycloak SSO

server_name: "mischlabs.de"
public_baseurl: "https://matrix.mischlabs.de/"
report_stats: false

pid_file: /data/homeserver.pid
signing_key_path: "/data/mischlabs.de.signing.key"

# Liste vertrauenswürdiger Key-Server für Föderation
trusted_key_servers:
  - server_name: "matrix.org"

# Listener-Konfiguration für Nginx Proxy Manager (hinter Reverse Proxy)
listeners:
  - port: 8008
    tls: false
    type: http
    x_forwarded: true
    resources:
      - names: [client, federation]
        compress: true

# PostgreSQL Datenbank-Anbindung
database:
  name: psycopg2
  allow_unsafe_locale: true
  args:
    user: synapse
    password: kX9_qL2_zP8_wY4_vT9_mJ7_hQ1_bN3
    database: synapse
    host: synapse_db
    cp_min: 5
    cp_max: 10

# Medienspeicher und Uploads
media_store_path: /data/media_store
max_upload_size: 100M

# Sicherheit & Registrierung (Deaktiviert zugunsten von Keycloak SSO)
enable_registration: false
allow_guest_access: false
password_config:
  enabled: false

# Keycloak SSO (OIDC) Integration
oidc_providers:
  - idp_id: keycloak
    idp_name: "MischLabs Keycloak"
    idp_brand_name: "Keycloak"
    discover: true
    issuer: "https://auth.mischlabs.de/realms/mischlabs"
    client_id: "matrix"
    client_secret: "DEIN_KEYCLOAK_CLIENT_SECRET"
    scopes: ["openid", "profile", "email"]
    user_mapping_provider:
      config:
        localpart_template: "{{ user.preferred_username }}"
        display_name_template: "{{ user.name }}"
        email_template: "{{ user.email }}"

# Föderation aktivieren
federation_domain_whitelist: []