feat: add Synapse (Matrix homeserver) template

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-11-10 01:33:12 -06:00 · 2026-07-14 12:12:24 -06:00
10 changed files with 204 additions and 468 deletions
@@ -1,256 +0,0 @@
-# Dify - open-source LLM app development platform
-# Adapted from the official docker/docker-compose.yaml (tag 1.15.0).
-# Minimal functional stack: api + worker + worker_beat + web + postgres
-# (pgvector, reused as the vector store) + redis + sandbox + ssrf_proxy
-# + plugin_daemon, fronted by a lightweight internal nginx gateway that
-# mirrors the upstream path routing (TLS terminates at Traefik).
-
-x-shared-api-env: &shared-api-env
-  LOG_LEVEL: INFO
-  DEPLOY_ENV: PRODUCTION
-  SECRET_KEY: ${SECRET_KEY}
-  MIGRATION_ENABLED: "true"
-  # Public URLs - a single domain, path-routed like the upstream nginx
-  CONSOLE_API_URL: https://${DIFY_DOMAIN}
-  CONSOLE_WEB_URL: https://${DIFY_DOMAIN}
-  SERVICE_API_URL: https://${DIFY_DOMAIN}
-  APP_API_URL: https://${DIFY_DOMAIN}
-  APP_WEB_URL: https://${DIFY_DOMAIN}
-  FILES_URL: https://${DIFY_DOMAIN}
-  INTERNAL_FILES_URL: http://api:5001
-  TRIGGER_URL: https://${DIFY_DOMAIN}
-  ENDPOINT_URL_TEMPLATE: https://${DIFY_DOMAIN}/e/{hook_id}
-  # The dedicated api_websocket collaboration service is not deployed
-  ENABLE_COLLABORATION_MODE: "false"
-  WEB_API_CORS_ALLOW_ORIGINS: "*"
-  CONSOLE_CORS_ALLOW_ORIGINS: "*"
-  # PostgreSQL
-  DB_USERNAME: postgres
-  DB_PASSWORD: ${POSTGRES_PASSWORD}
-  DB_HOST: db
-  DB_PORT: "5432"
-  DB_DATABASE: dify
-  # Redis / Celery
-  REDIS_HOST: redis
-  REDIS_PORT: "6379"
-  REDIS_PASSWORD: ${REDIS_PASSWORD}
-  REDIS_DB: "0"
-  CELERY_BROKER_URL: redis://:${REDIS_PASSWORD}@redis:6379/1
-  # File storage on a local volume
-  STORAGE_TYPE: opendal
-  OPENDAL_SCHEME: fs
-  OPENDAL_FS_ROOT: storage
-  # Vector store: pgvector, reusing the same PostgreSQL instance
-  VECTOR_STORE: pgvector
-  PGVECTOR_HOST: db
-  PGVECTOR_PORT: "5432"
-  PGVECTOR_USER: postgres
-  PGVECTOR_PASSWORD: ${POSTGRES_PASSWORD}
-  PGVECTOR_DATABASE: dify
-  PGVECTOR_MIN_CONNECTION: "1"
-  PGVECTOR_MAX_CONNECTION: "5"
-  # Code execution sandbox
-  CODE_EXECUTION_ENDPOINT: http://sandbox:8194
-  CODE_EXECUTION_API_KEY: ${SANDBOX_API_KEY}
-  # SSRF proxy (squid) for user-triggered outbound requests
-  SSRF_PROXY_HTTP_URL: http://ssrf_proxy:3128
-  SSRF_PROXY_HTTPS_URL: http://ssrf_proxy:3128
-  # Plugin daemon (model providers / tools are plugins since Dify 1.0)
-  PLUGIN_DAEMON_URL: http://plugin_daemon:5002
-  PLUGIN_DAEMON_KEY: ${PLUGIN_DAEMON_KEY}
-  INNER_API_KEY_FOR_PLUGIN: ${PLUGIN_INNER_API_KEY}
-  PLUGIN_MAX_PACKAGE_SIZE: "52428800"
-  PLUGIN_REMOTE_INSTALL_HOST: localhost
-  PLUGIN_REMOTE_INSTALL_PORT: "5003"
-  MARKETPLACE_ENABLED: "true"
-  MARKETPLACE_API_URL: https://marketplace.dify.ai
-
-services:
-  nginx:
-    image: nginx:1.27-alpine
-    restart: always
-    volumes:
-      - ../files/dify-nginx.conf:/etc/nginx/conf.d/default.conf:ro
-    depends_on:
-      api:
-        condition: service_healthy
-      web:
-        condition: service_started
-      plugin_daemon:
-        condition: service_started
-
-  # The dify-api image runs as the non-root user 1001, so the shared
-  # storage volume has to be handed over to it once (same trick as the
-  # upstream init_permissions container).
-  init_permissions:
-    image: busybox:1.36
-    command:
-      - sh
-      - -c
-      - |
-        FLAG_FILE="/app/api/storage/.init_permissions"
-        if [ -f "$$FLAG_FILE" ]; then
-          echo "Permissions already initialized."
-          exit 0
-        fi
-        echo "Initializing permissions for /app/api/storage"
-        chown -R 1001:1001 /app/api/storage && touch "$$FLAG_FILE"
-    volumes:
-      - dify-app-storage:/app/api/storage
-    restart: "no"
-
-  api:
-    image: langgenius/dify-api:1.15.0
-    restart: always
-    environment:
-      <<: *shared-api-env
-      MODE: api
-    depends_on:
-      init_permissions:
-        condition: service_completed_successfully
-      db:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    volumes:
-      - dify-app-storage:/app/api/storage
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:5001/health"]
-      interval: 15s
-      timeout: 5s
-      retries: 20
-      start_period: 120s
-
-  worker:
-    image: langgenius/dify-api:1.15.0
-    restart: always
-    environment:
-      <<: *shared-api-env
-      MODE: worker
-    depends_on:
-      init_permissions:
-        condition: service_completed_successfully
-      db:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    volumes:
-      - dify-app-storage:/app/api/storage
-
-  worker_beat:
-    image: langgenius/dify-api:1.15.0
-    restart: always
-    environment:
-      <<: *shared-api-env
-      MODE: beat
-    depends_on:
-      db:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-
-  web:
-    image: langgenius/dify-web:1.15.0
-    restart: always
-    environment:
-      CONSOLE_API_URL: https://${DIFY_DOMAIN}
-      APP_API_URL: https://${DIFY_DOMAIN}
-      SERVER_CONSOLE_API_URL: http://api:5001
-      ENABLE_COLLABORATION_MODE: "false"
-      MARKETPLACE_API_URL: https://marketplace.dify.ai
-      MARKETPLACE_URL: https://marketplace.dify.ai
-      NEXT_TELEMETRY_DISABLED: "1"
-
-  db:
-    image: pgvector/pgvector:pg16
-    restart: always
-    environment:
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: dify
-      PGDATA: /var/lib/postgresql/data/pgdata
-    volumes:
-      - dify-db-data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres -d dify"]
-      interval: 5s
-      timeout: 3s
-      retries: 30
-
-  redis:
-    image: redis:6-alpine
-    restart: always
-    environment:
-      REDISCLI_AUTH: ${REDIS_PASSWORD}
-    command: redis-server --requirepass ${REDIS_PASSWORD}
-    volumes:
-      - dify-redis-data:/data
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep -q PONG"]
-      interval: 5s
-      timeout: 3s
-      retries: 30
-
-  sandbox:
-    image: langgenius/dify-sandbox:0.2.15
-    restart: always
-    environment:
-      API_KEY: ${SANDBOX_API_KEY}
-      GIN_MODE: release
-      WORKER_TIMEOUT: "15"
-      ENABLE_NETWORK: "true"
-      HTTP_PROXY: http://ssrf_proxy:3128
-      HTTPS_PROXY: http://ssrf_proxy:3128
-      SANDBOX_PORT: "8194"
-    volumes:
-      - dify-sandbox-deps:/dependencies
-
-  ssrf_proxy:
-    image: ubuntu/squid:latest
-    restart: always
-    volumes:
-      - ../files/dify-squid.conf:/etc/squid/squid.conf:ro
-
-  plugin_daemon:
-    image: langgenius/dify-plugin-daemon:0.6.3-local
-    restart: always
-    environment:
-      DB_HOST: db
-      DB_PORT: "5432"
-      DB_USERNAME: postgres
-      DB_PASSWORD: ${POSTGRES_PASSWORD}
-      DB_DATABASE: dify_plugin
-      DB_SSL_MODE: disable
-      REDIS_HOST: redis
-      REDIS_PORT: "6379"
-      REDIS_PASSWORD: ${REDIS_PASSWORD}
-      SERVER_PORT: "5002"
-      SERVER_KEY: ${PLUGIN_DAEMON_KEY}
-      MAX_PLUGIN_PACKAGE_SIZE: "52428800"
-      DIFY_INNER_API_URL: http://api:5001
-      DIFY_INNER_API_KEY: ${PLUGIN_INNER_API_KEY}
-      PLUGIN_REMOTE_INSTALLING_HOST: 0.0.0.0
-      PLUGIN_REMOTE_INSTALLING_PORT: "5003"
-      PLUGIN_WORKING_PATH: /app/storage/cwd
-      FORCE_VERIFYING_SIGNATURE: "true"
-      PYTHON_ENV_INIT_TIMEOUT: "120"
-      PLUGIN_MAX_EXECUTION_TIMEOUT: "600"
-      PLUGIN_STORAGE_TYPE: local
-      PLUGIN_STORAGE_LOCAL_ROOT: /app/storage
-      PLUGIN_INSTALLED_PATH: plugin
-      PLUGIN_PACKAGE_CACHE_PATH: plugin_packages
-      PLUGIN_MEDIA_CACHE_PATH: assets
-    volumes:
-      - dify-plugin-storage:/app/storage
-    depends_on:
-      db:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-
-volumes:
-  dify-app-storage:
-  dify-db-data:
-  dify-redis-data:
-  dify-sandbox-deps:
-  dify-plugin-storage:
@@ -1,15 +0,0 @@
-## Instructions
-
-### First setup
-
- The first boot runs the database migrations, so it can take **2-4 minutes** before the application responds.
- Open your domain: you will be redirected to `/install`, where you create the admin (workspace owner) account.
- After signing in, go to **Settings -> Model Provider** and install a model provider plugin (OpenAI, Anthropic, Ollama, etc.) from the marketplace, then configure your API keys.
-
-### Notes
-
- **HTTPS is required for the console login**: Dify issues `__Host-`/`Secure` session cookies, so make sure the domain has a certificate (e.g. Let's Encrypt in the domain settings). Over plain HTTP the browser will drop the session cookies and login will not persist.
-
- The vector store is **pgvector**, running inside the bundled PostgreSQL instance (no separate Weaviate/Qdrant container needed).
- All routing (`/console/api`, `/api`, `/v1`, `/files`, `/e/`, ...) is handled by the bundled internal nginx gateway, mirroring the upstream deployment, so the Dify service API is available at `https://<your-domain>/v1`.
- Code execution runs in the isolated `sandbox` service, and user-triggered outbound HTTP requests go through the `ssrf_proxy` (squid) service, like in the official deployment.
@@ -1,12 +0,0 @@
-<svg width="48" height="22" viewBox="0 0 48 22" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g id="White=False">
-<g id="if">
-<path d="M21.2002 3.73454C22.5633 3.73454 23.0666 2.89917 23.0666 1.86812C23.0666 0.837081 22.5623 0.00170898 21.2002 0.00170898C19.838 0.00170898 19.3337 0.837081 19.3337 1.86812C19.3337 2.89917 19.838 3.73454 21.2002 3.73454Z" fill="#0033FF"/>
-<path d="M27.7336 4.13435V5.33473H24.6668V8.00171H27.7336V14.6687H22.6668V5.33567H15.9998V8.00265H19.7336V14.6696H15.3337V17.3366H35.3337V14.6696H30.6668V8.00265H35.3337V5.33567H30.6668V2.66869H35.3337V0.00170898H31.8671C29.5877 0.00170898 27.7336 1.8559 27.7336 4.13529V4.13435Z" fill="#0033FF"/>
-</g>
-<g id="Dy">
-<path d="M5.66698 0.000940576H0V17.334H5.66698C12.667 17.334 14.667 13.334 14.667 8.66698C14.667 4 12.667 0 5.66698 0V0.000940576ZM5.73377 14.6679H3.20038V2.66792H5.73377C9.75823 2.66792 11.4666 4.64346 11.4666 8.66792C11.4666 12.6924 9.75823 14.6679 5.73377 14.6679Z" fill="black"/>
-<path d="M44.8335 5.3349L42.1665 14.0019L39.4995 5.3349H36.333L40.2013 16.5466C40.604 17.714 39.9229 18.6679 38.6886 18.6679H37.333V21.3349H39.3255C41.063 21.3349 42.6265 20.2361 43.2145 18.6011L48 5.3349H44.8335Z" fill="black"/>
-</g>
-</g>
-</svg>
@@ -1,17 +0,0 @@
-{
-  "id": "dify",
-  "name": "Dify",
-  "version": "1.15.0",
-  "description": "Dify is an open-source LLM app development platform. Build AI workflows, RAG pipelines, agents and chatbots with a visual interface and publish them as APIs or web apps.",
-  "logo": "logo.svg",
-  "links": {
-    "github": "https://github.com/langgenius/dify",
-    "website": "https://dify.ai/",
-    "docs": "https://docs.dify.ai/"
-  },
-  "tags": [
-    "ai",
-    "llm",
-    "rag"
-  ]
-}
@@ -1,168 +0,0 @@
-[variables]
-main_domain = "${domain}"
-secret_key = "${base64:42}"
-postgres_password = "${password:32}"
-redis_password = "${password:32}"
-sandbox_api_key = "${password:32}"
-plugin_daemon_key = "${base64:42}"
-plugin_inner_api_key = "${base64:42}"
-
-[config]
-env = [
-  "DIFY_DOMAIN=${main_domain}",
-  "SECRET_KEY=${secret_key}",
-  "POSTGRES_PASSWORD=${postgres_password}",
-  "REDIS_PASSWORD=${redis_password}",
-  "SANDBOX_API_KEY=${sandbox_api_key}",
-  "PLUGIN_DAEMON_KEY=${plugin_daemon_key}",
-  "PLUGIN_INNER_API_KEY=${plugin_inner_api_key}",
-]
-
-[[config.domains]]
-serviceName = "nginx"
-port = 80
-host = "${main_domain}"
-
-# Internal nginx gateway replicating the upstream Dify nginx routing
-# (TLS terminates at Traefik, which forwards everything to this nginx).
-[[config.mounts]]
-filePath = "dify-nginx.conf"
-content = '''
-map $http_x_forwarded_proto $dify_forwarded_proto {
-    default $http_x_forwarded_proto;
-    ""      $scheme;
-}
-
-server {
-    listen 80;
-    server_name _;
-
-    client_max_body_size 100M;
-
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $dify_forwarded_proto;
-    proxy_http_version 1.1;
-    proxy_set_header Connection "";
-    proxy_buffering off;
-    proxy_read_timeout 3600s;
-    proxy_send_timeout 3600s;
-
-    location /console/api { proxy_pass http://api:5001; }
-    location /api         { proxy_pass http://api:5001; }
-    location /v1          { proxy_pass http://api:5001; }
-    location /openapi     { proxy_pass http://api:5001; }
-    location /files       { proxy_pass http://api:5001; }
-    location /mcp         { proxy_pass http://api:5001; }
-    location /triggers    { proxy_pass http://api:5001; }
-    location /explore     { proxy_pass http://web:3000; }
-
-    location /e/ {
-        proxy_pass http://plugin_daemon:5002;
-        # nginx drops inherited proxy_set_header directives as soon as a
-        # location defines its own, so the shared ones are repeated here.
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $dify_forwarded_proto;
-        proxy_set_header Connection "";
-        proxy_set_header Dify-Hook-Url $dify_forwarded_proto://$host$request_uri;
-    }
-
-    location / { proxy_pass http://web:3000; }
-}
-'''
-
-# Squid SSRF proxy configuration, rendered from the upstream
-# docker/ssrf_proxy/squid.conf.template with its default values.
-[[config.mounts]]
-filePath = "dify-squid.conf"
-content = '''
-acl client_localnet src 0.0.0.1-0.255.255.255
-acl client_localnet src 10.0.0.0/8
-acl client_localnet src 100.64.0.0/10
-acl client_localnet src 169.254.0.0/16
-acl client_localnet src 172.16.0.0/12
-acl client_localnet src 192.168.0.0/16
-acl client_localnet src fc00::/7
-acl client_localnet src fe80::/10
-acl to_private_networks dst 0.0.0.0/8
-acl to_private_networks dst 10.0.0.0/8
-acl to_private_networks dst 100.64.0.0/10
-acl to_private_networks dst 127.0.0.0/8
-acl to_private_networks dst 169.254.0.0/16
-acl to_private_networks dst 172.16.0.0/12
-acl to_private_networks dst 192.168.0.0/16
-acl to_private_networks dst 224.0.0.0/4
-acl to_private_networks dst 240.0.0.0/4
-acl to_private_networks dst ::/128
-acl to_private_networks dst ::1/128
-acl to_private_networks dst ::ffff:0:0/96
-acl to_private_networks dst ::/96
-acl to_private_networks dst fc00::/7
-acl to_private_networks dst fe80::/10
-acl SSL_ports port 443
-acl Safe_ports port 80
-acl Safe_ports port 21
-acl Safe_ports port 443
-acl Safe_ports port 70
-acl Safe_ports port 210
-acl Safe_ports port 1025-65535
-acl Safe_ports port 280
-acl Safe_ports port 488
-acl Safe_ports port 591
-acl Safe_ports port 777
-acl CONNECT method CONNECT
-acl allowed_domains dstdomain .marketplace.dify.ai
-
-http_port 3128
-
-http_access deny !Safe_ports
-http_access deny CONNECT !SSL_ports
-http_access allow localhost manager
-http_access deny manager
-http_access deny to_private_networks
-http_access allow allowed_domains
-http_access allow client_localnet
-http_access allow localhost
-http_access deny all
-tcp_outgoing_address 0.0.0.0
-
-coredump_dir /var/spool/squid
-refresh_pattern ^ftp: 1440 20% 10080
-refresh_pattern ^gopher: 1440 0% 1440
-refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
-refresh_pattern . 0 20% 4320
-
-client_request_buffer_max_size 100 MB
-max_filedescriptors 65536
-
-connect_timeout 30 seconds
-request_timeout 2 minutes
-read_timeout 2 minutes
-client_lifetime 5 minutes
-shutdown_lifetime 30 seconds
-
-server_persistent_connections on
-client_persistent_connections on
-persistent_request_timeout 30 seconds
-pconn_timeout 1 minute
-
-client_db on
-server_idle_pconn_timeout 2 minutes
-client_idle_pconn_timeout 2 minutes
-
-quick_abort_min 16 KB
-quick_abort_max 16 MB
-quick_abort_pct 95
-
-memory_cache_mode disk
-cache_mem 256 MB
-maximum_object_size_in_memory 512 KB
-
-dns_timeout 30 seconds
-dns_retransmit_interval 5 seconds
-
-logformat dify_log %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt
-access_log daemon:/var/log/squid/access.log dify_log
-logfile_rotate 10
-'''
@@ -0,0 +1,51 @@
+services:
+  synapse:
+    image: matrixdotorg/synapse:v1.156.0
+    restart: unless-stopped
+    # The stock entrypoint (/start.py) does not generate the signing key when a
+    # config file is provided, so generate any missing keys on first boot and
+    # make sure the data volume is owned by the synapse user (991) before
+    # handing over to the regular entrypoint.
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        python -m synapse.app.homeserver --config-path /config/homeserver.yaml --keys-directory /data --generate-keys
+        chown -R 991:991 /data
+        exec /start.py
+    environment:
+      SYNAPSE_CONFIG_PATH: /config/homeserver.yaml
+    volumes:
+      - synapse-data:/data
+      - ../files/homeserver.yaml:/config/homeserver.yaml:ro
+      - ../files/log.config:/config/log.config:ro
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:8008/health || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 90s
+
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: synapse
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: synapse
+      # Synapse requires a database with C collation
+      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U synapse -d synapse"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  synapse-data:
+  postgres-data:
@@ -0,0 +1,39 @@
+## Instructions
+
+Synapse is deployed with public registration disabled, so you need to create the
+first user (your admin account) from the command line.
+
+### Create the first user
+
+Open a terminal on the server running Dokploy (or use the container terminal in
+the Dokploy UI) and run the following inside the `synapse` service container:
+
+```bash
+docker exec -it $(docker ps -qf "name=synapse" | head -n 1) \
+  register_new_matrix_user http://localhost:8008 -c /config/homeserver.yaml
+```
+
+The tool prompts for a username and password, and asks whether the user should
+be an admin. It authenticates against the server using the
+`registration_shared_secret` that was generated for this deployment (stored in
+the mounted `homeserver.yaml`), so no registration needs to be enabled.
+
+### Log in
+
+Point any Matrix client (for example Element Web at https://app.element.io) at
+your homeserver URL `https://your-domain` and log in with the user you just
+created. You can verify the server is up with:
+
+```bash
+curl https://your-domain/_matrix/client/versions
+```
+
+### Notes
+
+- Data (signing keys, media uploads) is stored in the `synapse-data` volume and
+  the database in the `postgres-data` volume.
+- Federation with other Matrix servers works through `.well-known` delegation
+  over HTTPS (port 443). The dedicated federation port 8448 is not exposed.
+- To allow open registration instead, edit `enable_registration` in the mounted
+  `homeserver.yaml` (see Synapse docs for the required spam-check options such
+  as CAPTCHA or email verification).
@@ -0,0 +1,16 @@
+{
+  "id": "synapse",
+  "name": "Synapse",
+  "version": "v1.156.0",
+  "description": "Synapse is the reference homeserver implementation for Matrix, an open standard for secure, decentralised, real-time communication.",
+  "logo": "synapse.svg",
+  "links": {
+    "github": "https://github.com/element-hq/synapse",
+    "website": "https://element-hq.github.io/synapse/latest/",
+    "docs": "https://element-hq.github.io/synapse/latest/setup/installation.html"
+  },
+  "tags": [
+    "matrix",
+    "communication"
+  ]
+}
@@ -0,0 +1,5 @@
+<svg width="75" height="32" xmlns="http://www.w3.org/2000/svg">
+  <g fill="#000000" fill-rule="nonzero">
+    <path d="M.936.732V31.25H3.13v.732H.095V0h3.034v.732zM9.386 10.407v1.544h.044a4.461 4.461 0 0 1 1.487-1.368c.58-.323 1.245-.485 1.993-.485.72 0 1.377.14 1.972.42.595.279 1.047.771 1.355 1.477.338-.5.796-.941 1.377-1.323.58-.383 1.266-.574 2.06-.574.602 0 1.16.074 1.674.22.514.148.954.383 1.322.707.366.323.653.746.859 1.268.205.522.308 1.15.308 1.887v7.633H20.71v-6.464c0-.383-.015-.743-.044-1.082a2.305 2.305 0 0 0-.242-.882 1.473 1.473 0 0 0-.584-.596c-.257-.146-.606-.22-1.047-.22-.44 0-.796.085-1.068.253-.272.17-.485.39-.639.662a2.654 2.654 0 0 0-.308.927 7.074 7.074 0 0 0-.078 1.048v6.354h-3.128v-6.398c0-.338-.007-.673-.021-1.004a2.825 2.825 0 0 0-.188-.916 1.411 1.411 0 0 0-.55-.673c-.258-.168-.636-.253-1.135-.253a2.33 2.33 0 0 0-.584.1 1.94 1.94 0 0 0-.705.374c-.228.184-.422.449-.584.794-.161.346-.242.798-.242 1.357v6.619H6.434V10.407h2.952zM25.842 12.084a3.751 3.751 0 0 1 1.233-1.17 5.37 5.37 0 0 1 1.685-.629 9.579 9.579 0 0 1 1.884-.187c.573 0 1.153.04 1.74.121.588.081 1.124.24 1.609.475.484.235.88.562 1.19.981.308.42.462.975.462 1.666v5.934c0 .516.03 1.008.088 1.478.058.471.161.824.308 1.06H32.87a4.435 4.435 0 0 1-.22-1.104c-.5.515-1.087.876-1.762 1.081a7.084 7.084 0 0 1-2.071.31c-.544 0-1.05-.067-1.52-.2a3.472 3.472 0 0 1-1.234-.617 2.87 2.87 0 0 1-.826-1.059c-.199-.426-.298-.934-.298-1.522 0-.647.114-1.18.342-1.6.227-.419.52-.753.881-1.004.36-.25.771-.437 1.234-.562.462-.125.929-.224 1.399-.298.47-.073.932-.132 1.387-.176.456-.044.86-.11 1.212-.199.353-.088.631-.217.837-.386.206-.169.301-.415.287-.74 0-.337-.055-.606-.166-.804a1.217 1.217 0 0 0-.44-.464 1.737 1.737 0 0 0-.639-.22 5.292 5.292 0 0 0-.782-.055c-.617 0-1.101.132-1.454.397-.352.264-.558.706-.617 1.323h-3.128c.044-.735.227-1.345.55-1.83zm6.179 4.423a5.095 5.095 0 0 1-.639.165 9.68 9.68 0 0 1-.716.11c-.25.03-.5.067-.749.11a5.616 5.616 0 0 0-.694.177 2.057 2.057 0 0 0-.594.298c-.17.125-.305.284-.408.474-.103.192-.154.434-.154.728 0 .28.051.515.154.706.103.192.242.342.419.453.176.11.381.187.617.231.234.044.477.066.726.066.617 0 1.094-.102 1.432-.309.338-.205.587-.452.75-.739.16-.286.26-.576.297-.87.036-.295.055-.53.055-.707v-1.17a1.4 1.4 0 0 1-.496.277zM43.884 10.407v2.096h-2.291v5.647c0 .53.088.883.264 1.059.176.177.529.265 1.057.265.177 0 .345-.007.507-.022.161-.015.316-.037.463-.066v2.426a7.49 7.49 0 0 1-.882.089 21.67 21.67 0 0 1-.947.022c-.484 0-.944-.034-1.377-.1a3.233 3.233 0 0 1-1.145-.386 2.04 2.04 0 0 1-.782-.816c-.191-.353-.287-.816-.287-1.39v-6.728H36.57v-2.096h1.894v-3.42h3.129v3.42h2.29zM48.355 10.407v2.118h.044a3.907 3.907 0 0 1 1.454-1.754 4.213 4.213 0 0 1 1.036-.497 3.734 3.734 0 0 1 1.145-.176c.206 0 .433.037.683.11v2.912a5.862 5.862 0 0 0-.528-.077 5.566 5.566 0 0 0-.595-.033c-.573 0-1.058.096-1.454.287a2.52 2.52 0 0 0-.958.783 3.143 3.143 0 0 0-.518 1.158 6.32 6.32 0 0 0-.154 1.434v5.14h-3.128V10.407h2.973zM54.039 8.642V6.06h3.128v2.582H54.04zm3.128 1.765v11.405H54.04V10.407h3.128zM58.797 10.407h3.569l2.005 2.978 1.982-2.978h3.459l-3.745 5.339 4.208 6.067h-3.57l-2.378-3.596-2.38 3.596h-3.502l4.097-6.001zM74.094 31.25V.732H71.9V0h3.035v31.982H71.9v-.732z"/>
+  </g>
+</svg>
@@ -0,0 +1,93 @@
+[variables]
+main_domain = "${domain}"
+postgres_password = "${password:32}"
+registration_shared_secret = "${password:32}"
+macaroon_secret_key = "${password:32}"
+form_secret = "${password:32}"
+
+[config]
+env = [
+    "POSTGRES_PASSWORD=${postgres_password}",
+]
+
+[[config.domains]]
+serviceName = "synapse"
+port = 8008
+host = "${main_domain}"
+
+[[config.mounts]]
+filePath = "homeserver.yaml"
+content = """
+# Synapse homeserver configuration
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
+
+server_name: "${main_domain}"
+public_baseurl: "https://${main_domain}/"
+pid_file: /data/homeserver.pid
+signing_key_path: "/data/signing.key"
+log_config: "/config/log.config"
+media_store_path: /data/media_store
+report_stats: false
+
+# Serve /.well-known/matrix/server so other homeservers can federate with
+# this server over port 443 (the dedicated federation port 8448 is not exposed).
+serve_server_wellknown: true
+
+listeners:
+  - port: 8008
+    tls: false
+    type: http
+    x_forwarded: true
+    bind_addresses: ['0.0.0.0']
+    resources:
+      - names: [client, federation]
+        compress: false
+
+database:
+  name: psycopg2
+  args:
+    user: synapse
+    password: "${postgres_password}"
+    database: synapse
+    host: postgres
+    port: 5432
+    cp_min: 5
+    cp_max: 10
+
+# Public registration is disabled. Create users with the
+# register_new_matrix_user tool (see the template instructions).
+enable_registration: false
+registration_shared_secret: "${registration_shared_secret}"
+
+macaroon_secret_key: "${macaroon_secret_key}"
+form_secret: "${form_secret}"
+
+trusted_key_servers:
+  - server_name: "matrix.org"
+suppress_key_server_warning: true
+"""
+
+[[config.mounts]]
+filePath = "log.config"
+content = """
+version: 1
+
+formatters:
+  precise:
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+loggers:
+  synapse.storage.SQL:
+    level: INFO
+
+root:
+  level: INFO
+  handlers: [console]
+
+disable_existing_loggers: false
+"""