http:
  listeners:
  - name: web
    resources:
    - name: discovery
    - name: human
    - name: oauth
    - name: compat
    - name: graphql
    - name: assets
    binds:
    - address: '[::]:8080'
    proxy_protocol: false
  - name: internal
    resources:
    - name: health
    binds:
    - host: localhost
      port: 8081
    proxy_protocol: false
  trusted_proxies:
  - 192.168.0.0/16
  - 172.16.0.0/12
  - 10.0.0.0/10
  - 127.0.0.1/8
  - fd00::/8
  - ::1/128
  public_base: https://mas.freedombox.be/
  issuer: https://mas.freedombox.be/
database:
  uri: postgresql://mas_user:mas_password@db:5432/mas
  max_connections: 10
  min_connections: 0
  connect_timeout: 30
  idle_timeout: 600
  max_lifetime: 1800
email:
  transport: smtp
  hostname: mail.your-server.de
  mode: tls
  port: 587
  username: "no-reply@freedombox.be"
  password: "4vz325j76pwRcDt4"
  from: "Freedombox chatserver <no-reply@freedombox.be>"
  reply_to: "No reply <no-reply@freedombox.be>"

secrets:
  encryption: f405ededd5e23487dd450f0a502a78166ec28f8235a07a34cccd6457fabaecae
  keys:
  - kid: 1bDTx0aeev
    key: |
      -----BEGIN RSA PRIVATE KEY-----
      MIIEowIBAAKCAQEAu7bsSHbbG9vzE+GEet28n67PpGSnvW25xIbeEGlJBZiZRoOb
      /T8YZ+BRY8eso0dGblTy67tEMKZsqHbNa+JEy2hVHJg3cNw4lnm8VQ0athoyoxUY
      lZhslse1xa1+Zy/rBwxlv5yQ/nEMhWAe1xj4wjza4WORHmVqmCqb3pQj0dDlTuTN
      mj+0gh/AQP0FPxj1cgDW7NDtqTTglLFyeSgSY7RvJONjPq/dzBGQfp6kY+dZCcIl
      9oHwI6X/U7HDMKlTBoUf1jWP/Qew0hrbJebWfob76SBzIx8ap+bxjrSJhzvIE0W4
      QFGR42YkNOJjehKv4q2ubgAcWd7ffwudGBNrmQIDAQABAoIBAQCWySWcP/1Zr6Df
      A3SLzbpK+v1IrKIhhBaJS1zuCeTiXeYhwm53S0urhYFbiXWf4w0sa4iG23K3Mbhu
      yp/QXX2tdy2HPq6qNfwuw7MJDvG5/elXHwcUg9AWfm4BUJANC2zbyJWjCX1fJihM
      qx2a4zBPttqL2pMju4uYmAGFFbKAQtCWzZCcs+oayKZNe5gBbvl0xzYMSvsocrl1
      jzr21yYNBoU4tle2rRG2/C0oEm1xxocmjUuhAyGBNA+I5AM3qSQ9Ra4hJzjX5f6w
      SJnG35JW39mzceOsfd7oMlPUhJ+yjpx3eIEPRBbaPHbITBB1LpRzu9N6BsJsLsEg
      l1MJb6tRAoGBANDOCpP+qoO9VNQ3DtTPM8zSwUyXwyd211/Qxx22nXRaFh+RCYMU
      tznjzSxPuD0N6kqMHMLcbgFIRUhnP163AdG7vteW3m7l5cPi0uGuDuHceb3U1iTj
      3f+Y3vKXYxNkiHZtstoOuIwLToPQ4irAJ2BJqfFrQG8M1FJTvHsUn/JXAoGBAOYk
      i4cIZDK9WU0STgThYS+vIwLHHKNDyNiWR2xJO3IdjaZGtXrgIUC+ZgWq558pE0j5
      11PmKwdxIGeTokgE9qw6o9YwpeDYvPDQW1uGdugYK2OuqJxBTwQxeULqXIJB/I7o
      mTnZkxRw2Pf1CUNIRO9hOgL37EHlOSuLtUYmhzuPAoGAPEVNDlzzESXEZ6Eg2dKZ
      TCUFgLtJrImEL3cPEoeUuXILcr8ltL11CfO0VHcKYi0zFKOO5bxE0H/w565Nv2Qp
      1UVRF9/HgtE/WiSN5HCegRln1qCp02omuVGCARorkfxx22Vcu86F/H6DAk94CQkA
      FK4OrM3dgnB8lOrwu8I/TO8CgYA3VUAKxlS48lefNTB28e1Y9qXXTCIxiuGmWXNw
      sKbPSBW/ja6ijXLRSzXiVPX9iXWujQtdi7B6yJM+8/sHj9HzFOJBZE7toY7D44Sj
      m8/I+86q19qIPxeNbYu3L/vwAYeEoJ3+j7ZSKtOvwkVo3N5eI6U8A3nVWhSFyMBb
      znWjNwKBgFKnZwlJcSLoHvGUHp5Bs9Q3Qs39jsgwq3TRPUrmvma70vqkFMwThWYk
      dpbFZbNRpTU/H1HTongPFw4c22gOHvmfzgoBFbIIs9CpnnGdhDWgzbxs1jCse6hn
      E09LOqLbqUVrFYQC08Lfj0IiQziQpPHpY1k/NR23J43+fJWdpZSM
      -----END RSA PRIVATE KEY-----
  - kid: 34hu8Mn90O
    key: |
      -----BEGIN EC PRIVATE KEY-----
      MHcCAQEEIEH4XQmOwkFdubz2axHsjvYiiQbLcaTA6CF3AYp5hWTwoAoGCCqGSM49
      AwEHoUQDQgAEW0/eoSl2W0zS1jNPJ1XxqxYafFHzVGPeXRgonRpyA3+hpEOFBRKc
      o64h5TLV2Gw6M/pKVUS+rPTyb9KUd9THxg==
      -----END EC PRIVATE KEY-----
  - kid: JGjA6uiszJ
    key: |
      -----BEGIN EC PRIVATE KEY-----
      MIGkAgEBBDBbEEBWFsHGnI/fH+LB/JSnAZFWtrDqL7jDnZMiffd6lbS5RY/5q/WC
      r8FhU6cvjbCgBwYFK4EEACKhZANiAARLtvjqlB5bwPYjTJXKQ7UYm+tOlaAW4ZUb
      lwKGF6Cv0NlrY3EqROLsm2OHMjYa3dXkRpO8ujPrEOry/Hik/WNRcIyQ8vjCXP98
      3RxZfmZlqQaQjcZT4VXvyCNxWLikZfI=
      -----END EC PRIVATE KEY-----
  - kid: xuE4SO0Tj2
    key: |
      -----BEGIN EC PRIVATE KEY-----
      MHQCAQEEIOOR2Em2w4Jnmi/Ik0AG2NV2DXh+ApBFYfX9p9llY9daoAcGBSuBBAAK
      oUQDQgAEQM/eB1GpFAIIK4kfq0wFTYtBFswrcgENakPW/dUnklEZrtA0XidCqgWL
      tWqK/Imi5Wwgc6Y3jCgt9x8a9fBSJQ==
      -----END EC PRIVATE KEY-----
passwords:
  enabled: true
  schemes:
  - version: 1
    algorithm: bcrypt
  - version: 2
    algorithm: argon2id
  minimum_complexity: 3
matrix:
  homeserver: "freedombox.be"
  secret: UZTbfInNy2IQ8MCeEzy98Ry2bRNFrckd
  endpoint: "https://freedombox.be"
clients:
  - client_id: 0000000000000000000SYNAPSE 
    client_auth_method: client_secret_basic
    client_secret: "02266962ec3fc4b5e21204f736c37fe91227918f506723522a8aae48fd7f9dfd103fd8c5d1380234ffcb02ba3a90e2aca95156634119c61dc57a70a2d30431e2902f41bf646a9b72829ea8e70ec74af27043a2ba1f89b8acc27ddb8c819eedc2"
    redirect_uris:
      - "https://freedombox.be/_synapse/client/oidc/callback"

account:
  # Whether users are allowed to change their email addresses.
  #
  # Defaults to `true`.
  email_change_allowed: true

  # Whether users are allowed to change their display names
  #
  # Defaults to `true`.
  # This should be in sync with the policy in the homeserver configuration.
  displayname_change_allowed: true

  # Whether to enable self-service password registration
  #
  # Defaults to `false`.
  # This has no effect if password login is disabled.
  password_registration_enabled: false

  # Whether users are allowed to change their passwords
  #
  # Defaults to `true`.
  # This has no effect if password login is disabled.
  password_change_allowed: true

  # Whether email-based password recovery is enabled
  #
  # Defaults to `false`.
  # This has no effect if password login is disabled.
  password_recovery_enabled: false

  # Whether users are allowed to delete their own account
  #
  # Defaults to `true`.
  account_deactivation_allowed: true

  # Whether users can log in with their email address.
  #
  # Defaults to `false`.
  # This has no effect if password login is disabled.
  login_with_email_allowed: false

  # Whether registration tokens are required for password registrations.
  #
  # Defaults to `false`.
  #
  # When enabled, users must provide a valid registration token during password
  # registration. This has no effect if password registration is disabled.
  registration_token_required: false

policy:
  #wasm_module: /usr/local/share/mas-cli/policy.wasm

  # Entrypoints for various checks
  client_registration_entrypoint: client_registration/violation
  register_entrypoint: register/violation
  authorization_grant_entrypoint: authorization_grant/violation
  password_entrypoint: password/violation
  email_entrypoint: email/violation

  data:
    # Allow all usernames (no restrictions)
    registration:
      enabled: true
      allowed_domains: []

    # Allow all email addresses
    emails: {}

    # Allow all client registrations (be permissive at first)
    client_registration:
      allow_host_mismatch: true
      allow_insecure_uris: true
      allow_missing_client_uri: true

    # Don’t block anyone based on IP or User-Agent
    requester: {}

    # Optional: if you want specific admin users
    admin_users: []
    admin_clients: 
      - 0000000000000000000SYNAPSE


