631 Commits (304a1376c2fbe6758b7b0c1987d16fcea5205528)

Author	SHA1	Message	Date
Richard van der Hoff	88d7182ada	Improve startup checks for insecure notary configs (#5392) ... It's not really a problem to trust notary responses signed by the old key so long as we are also doing TLS validation. This commit adds a check to the config parsing code at startup to check that we do not have the insecure matrix.org key without tls validation, and refuses to start without it. This allows us to remove the rather alarming-looking warning which happens at runtime.	6 years ago
Neil Johnson	a11865016e	Set default room version to v4. (#5379) ... Set default room version to v4.	6 years ago
Andrew Morgan	3719680ee4	Add ability to perform password reset via email without trusting the identity server (#5377) ... Sends password reset emails from the homeserver instead of proxying to the identity server. This is now the default behaviour for security reasons. If you wish to continue proxying password reset requests to the identity server you must now enable the email.trust_identity_server_for_password_resets option. This PR is a culmination of 3 smaller PRs which have each been separately reviewed: * #5308 * #5345 * #5368	6 years ago
Richard van der Hoff	9fbb20a531	Stop hardcoding trust of old matrix.org key (#5374) ... There are a few changes going on here: * We make checking the signature on a key server response optional: if no verify_keys are specified, we trust to TLS to validate the connection. * We change the default config so that it does not require responses to be signed by the old key. * We replace the old 'perspectives' config with 'trusted_key_servers', which is also formatted slightly differently. * We emit a warning to the logs every time we trust a key server response signed by the old key.	6 years ago
Richard van der Hoff	f8a45302c9	Fix `federation_custom_ca_list` configuration option. ... Previously, setting this option would cause an exception at startup.	6 years ago
Richard van der Hoff	e2dfb922e1	Validate federation server TLS certificates by default.	6 years ago
Neil Johnson	26713515de	Neilj/mau tracking config explainer (#5284) ... Improve documentation of monthly active user blocking and mau_trial_days	6 years ago
Brendan Abolivier	2f62e1f6ff	Only parse from email if provided	6 years ago
Brendan Abolivier	1cc5fc1f6c	Lint	6 years ago
Brendan Abolivier	ac3cc32367	Make account validity renewal emails work when email notifs are disabled	6 years ago
Brendan Abolivier	4d794dae21	Move delta from +10% to -10%	6 years ago
Brendan Abolivier	0c2362861e	Gah python	6 years ago
Brendan Abolivier	847b9dcd1c	Make max_delta equal to period * 10%	6 years ago
Aaron Raimist	9b6f72663e	Fix docs on resetting the user directory (#5036) ... Signed-off-by: Aaron Raimist <aaron@raim.ist>	6 years ago
Brendan Abolivier	52839886d6	Allow configuring a range for the account validity startup job ... When enabling the account validity feature, Synapse will look at startup for registered account without an expiration date, and will set one equals to 'now + validity_period' for them. On large servers, it can mean that a large number of users will have the same expiration date, which means that they will all be sent a renewal email at the same time, which isn't ideal. In order to mitigate this, this PR allows server admins to define a 'max_delta' so that the expiration date is a random value in the [now + validity_period ; now + validity_period + max_delta] range. This allows renewal emails to be progressively sent over a configured period instead of being sent all in one big batch.	6 years ago
Richard van der Hoff	dba9152d15	Add missing blank line in config (#5249)	6 years ago
Andrew Morgan	6368150a74	Add config option for setting homeserver's default room version (#5223) ... Replaces DEFAULT_ROOM_VERSION constant with a method that first checks the config, then returns a hardcoded value if the option is not present. That hardcoded value is now located in the server.py config file.	6 years ago
Amber Brown	4a30e4acb4	Room Statistics (#4338)	6 years ago
Brendan Abolivier	384122efa8	Doc	6 years ago
Brendan Abolivier	cd32375846	Add option to disable per-room profiles	6 years ago
Erik Johnston	a0603523d2	Add aggregations API	6 years ago
Amber Brown	f1e5b41388	Make all the rate limiting options more consistent (#5181)	6 years ago
Andrew Morgan	5a4b328f52	Add ability to blacklist ip ranges for federation traffic (#5043)	6 years ago
Matthew Hodgson	c0e0740bef	add options to require an access_token to GET /profile and /publicRooms on CS API (#5083) ... This commit adds two config options: * `restrict_public_rooms_to_local_users` Requires auth to fetch the public rooms directory through the CS API and disables fetching it through the federation API. * `require_auth_for_profile_requests` When set to `true`, requires that requests to `/profile` over the CS API are authenticated, and only returns the user's profile if the requester shares a room with the profile's owner, as per MSC1301. MSC1301 also specifies a behaviour for federation (only returning the profile if the server asking for it shares a room with the profile's owner), but that's currently really non-trivial to do in a not too expensive way. Next step is writing down a MSC that allows a HS to specify which user sent the profile query. In this implementation, Synapse won't send a profile query over federation if it doesn't believe it already shares a room with the profile's owner, though. Groups have been intentionally omitted from this commit.	6 years ago
Richard van der Hoff	1565ebec2c	more config comment updates	6 years ago
Richard van der Hoff	1a7104fde3	Blacklist 0.0.0.0 and :: by default for URL previews	6 years ago
Brendan Abolivier	84196cb231	Add some limitations to alias creation	6 years ago
Richard van der Hoff	8e9ca83537	Move admin API to a new prefix	6 years ago
Andrew Morgan	6824ddd93d	Config option for verifying federation certificates (MSC 1711) (#4967)	6 years ago
Brendan Abolivier	f8826d31cd	Don't crash on lack of expiry templates	6 years ago
Brendan Abolivier	20f0617e87	Send out emails with links to extend an account's validity period	6 years ago
Andrew Morgan	caa76e6021	Remove periods from copyright headers (#5046)	6 years ago
Brendan Abolivier	747aa9f8ca	Add account expiration feature	6 years ago
Neil Johnson	b25e387c0d	add context to phonehome stats (#5020) ... add context to phonehome stats	6 years ago
Brendan Abolivier	8e85493b0c	Add config option to block users from looking up 3PIDs (#5010)	6 years ago
Richard van der Hoff	8530090b16	Add config.signing_key_path. (#4974) ... As requested by @andrewshadura	6 years ago
Erik Johnston	3677548a82	Use yaml safe_load	6 years ago
Richard van der Hoff	cdb8036161	Add a config option for torture-testing worker replication. (#4902) ... Setting this to 50 or so makes a bunch of sytests fail in worker mode.	6 years ago
Richard van der Hoff	a902d13180	Batch up outgoing read-receipts to reduce federation traffic. (#4890) ... Rate-limit outgoing read-receipts as per #4730.	6 years ago
Erik Johnston	cd8c5b91ad	Fix up sample config	6 years ago
Richard van der Hoff	ab20f85c59	Update synapse/config/user_directory.py ... Co-Authored-By: erikjohnston <erikj@jki.re>	6 years ago
Erik Johnston	926f29ea6d	Fix up config comments	6 years ago
Erik Johnston	213c98c00a	Add option to disable search room lists ... This disables both local and remote room list searching.	6 years ago
Erik Johnston	320667a479	Add option to disable searching in the user dir ... We still populate it, as it can still be accessed via the admin API.	6 years ago
Richard van der Hoff	13bc1e0746	Use a regular HomeServerConfig object for unit tests ... Rather than using a Mock for the homeserver config, use a genuine HomeServerConfig object. This makes for a more realistic test, and means that we don't have to keep remembering to add things to the mock config every time we add a new config setting.	6 years ago
Richard van der Hoff	fd463b4f5d	Comment out most options in the generated config. (#4863) ... Make it so that most options in the config are optional, and commented out in the generated config. The reasons this is a good thing are as follows: * If we decide that we should change the default for an option, we can do so, and only those admins that have deliberately chosen to override that option will be stuck on the old setting. * It moves us towards a point where we can get rid of the super-surprising feature of synapse where the default settings for the config come from the generated yaml. * It makes setting up a test config for unit testing an order of magnitude easier (see forthcoming PR). * It makes the generated config more consistent, and hopefully easier for users to understand.	6 years ago
Brendan Abolivier	651ad8bc96	Add ratelimiting on failed login attempts (#4865)	6 years ago
Brendan Abolivier	899e523d6d	Add ratelimiting on login (#4821) ... Add two ratelimiters on login (per-IP address and per-userID).	6 years ago
Erik Johnston	9ad448c1e5	Correctly handle all command line options	6 years ago
Erik Johnston	72bfaf746d	Allow passing --daemonize to workers	6 years ago