### Tuwunel Configuration
###
### THIS FILE IS GENERATED. CHANGES/CONTRIBUTIONS IN THE REPO WILL BE
### OVERWRITTEN!
###
### You should rename this file before configuring your server. Changes to
### documentation and defaults can be contributed in source code at
### src/core/config/mod.rs. This file is generated when building.
###
### Any values pre-populated are the default values for said config option.
###
### At the minimum, you MUST edit all the config options to your environment
### that say "YOU NEED TO EDIT THIS".
###
### For more information, see:
### https://tuwunel.chat/configuration.html


[global]

# The server_name is the pretty name of this server. It is used as a
# suffix for user and room IDs/aliases.
#
# See the docs for reverse proxying and delegation:
# https://tuwunel.chat/deploying/generic.html#setting-up-the-reverse-proxy
#
# Also see the `[global.well_known]` config section at the very bottom.
#
# Examples of delegation:
# - https://matrix.org/.well-known/matrix/server
# - https://matrix.org/.well-known/matrix/client
#
# YOU NEED TO EDIT THIS. THIS CANNOT BE CHANGED AFTER WITHOUT A DATABASE
# WIPE.
#
# example: "girlboss.ceo"
#
#server_name =

# This is the only directory where tuwunel will save its data, including
# media. Note: this was previously "/var/lib/matrix-conduit".
#
#database_path = "/var/lib/tuwunel"

# Text which will be added to the end of the user's displayname upon
# registration with a space before the text. In Conduit, this was the
# lightning bolt emoji.
#
# To disable, set this to "" (an empty string).
#
# reloadable: yes
#
#new_user_displayname_suffix = "💕"

# The default address (IPv4 or IPv6) tuwunel will listen on.
#
# If you are using Docker or a container NAT networking setup, this must
# be "0.0.0.0".
#
# To listen on multiple addresses, specify a vector e.g. ["127.0.0.1",
# "::1"]
#
#address = ["127.0.0.1", "::1"]

# The port(s) tuwunel will listen on.
#
# For reverse proxying, see:
# https://tuwunel.chat/deploying/generic.html#setting-up-the-reverse-proxy
#
# If you are using Docker, don't change this, you'll need to map an
# external port to this.
#
# To listen on multiple ports, specify a vector e.g. [8080, 8448]
#
#port = 8008

# The UNIX socket tuwunel will listen on.
#
# Remember to make sure that your reverse proxy has access to this socket
# file, either by adding your reverse proxy to the 'tuwunel' group or
# granting world R/W permissions with `unix_socket_perms` (666 minimum).
#
# example: "/run/tuwunel/tuwunel.sock"
#
#unix_socket_path =

# The default permissions (in octal) to create the UNIX socket with.
#
#unix_socket_perms = 660

# Error on startup if any config option specified is unknown to Tuwunel.
#
# This is false by default to allow easier deprecation or removal of
# config options in the future without breaking existing deployments. The
# default behaviour is to simply warn on startup.
# reloadable: yes
#
#error_on_unknown_config_opts = false

# tuwunel supports online database backups using RocksDB's Backup engine
# API. To use this, set a database backup path that tuwunel can write
# to.
#
# For more information, see:
# https://tuwunel.chat/maintenance.html#backups
#
# reloadable: yes
# example: "/opt/tuwunel-db-backups"
#
#database_backup_path =

# The amount of online RocksDB database backups to keep/retain, if using
# "database_backup_path", before deleting the oldest one. This must be at
# least 1; "backup-database" is an error at 0 or below.
#
# reloadable: yes
#
#database_backups_to_keep = 1

# Set this to any float value to multiply tuwunel's in-memory LRU caches
# with such as "auth_chain_cache_capacity".
#
# May be useful if you have significant memory to spare to increase
# performance.
#
# If you have low memory, reducing this may be viable.
#
# By default, the individual caches such as "auth_chain_cache_capacity"
# are scaled by your CPU core count.
#
#cache_capacity_modifier = 1.0

# Set this to any float value in megabytes for tuwunel to tell the
# database engine that this much memory is available for database read
# caches.
#
# May be useful if you have significant memory to spare to increase
# performance.
#
# Similar to the individual LRU caches, this is scaled up with your CPU
# core count.
#
# This defaults to 128.0 + (64.0 * CPU core count).
#
#db_cache_capacity_mb = varies by system

# Set this to any float value in megabytes for tuwunel to tell the
# database engine that this much memory is available for database write
# caches.
#
# May be useful if you have significant memory to spare to increase
# performance.
#
# Similar to the individual LRU caches, this is scaled up with your CPU
# core count.
#
# This defaults to 48.0 + (4.0 * CPU core count).
#
#db_write_buffer_capacity_mb = varies by system

# This item is undocumented. Please contribute documentation for it.
#
#pdu_cache_capacity = varies by system

# This item is undocumented. Please contribute documentation for it.
#
#auth_chain_cache_capacity = varies by system

# This item is undocumented. Please contribute documentation for it.
#
#shorteventid_cache_capacity = varies by system

# This item is undocumented. Please contribute documentation for it.
#
#eventidshort_cache_capacity = varies by system

# This item is undocumented. Please contribute documentation for it.
#
#eventid_pdu_cache_capacity = varies by system

# This item is undocumented. Please contribute documentation for it.
#
#shortstatekey_cache_capacity = varies by system

# This item is undocumented. Please contribute documentation for it.
#
#statekeyshort_cache_capacity = varies by system

# This item is undocumented. Please contribute documentation for it.
#
#servernameevent_data_cache_capacity = varies by system

# This item is undocumented. Please contribute documentation for it.
#
#stateinfo_cache_capacity = varies by system

# Minimum time-to-live in seconds for room summary entries in the spaces
# cache.
#
# reloadable: yes
#
#spacehierarchy_cache_ttl_min = 10800

# Maximum time-to-live in seconds for room summary entries in the spaces
# cache.
#
# reloadable: yes
#
#spacehierarchy_cache_ttl_max = 64800

# Minimum timeout a client can request for long-polling sync. Requests
# will be clamped up to this value if smaller.
#
# reloadable: yes
#
#client_sync_timeout_min = 5000

# Default timeout for long-polling sync if a client does not request
# another in their query-string.
#
# reloadable: yes
#
#client_sync_timeout_default = 30000

# Maximum timeout a client can request for long-polling sync. Requests
# will be clamped down to this value if larger.
#
# reloadable: yes
#
#client_sync_timeout_max = 90000

# Custom DNS servers to query instead of the operating system's default
# resolvers; when this list is non-empty, `/etc/resolv.conf` is never
# read. Each entry is an IP address with an optional port, defaulting to
# port 53. The servers are assumed to support both UDP and TCP on that
# port; enable `query_over_tcp_only` if any of them is TCP-only.
#
# example: ["127.0.0.53", "1.1.1.1:5353", "[fd00::1]:53"]
#
#dns_servers = []

# Maximum entries stored in DNS memory-cache. The size of an entry may
# vary so please take care if raising this value excessively. Only
# decrease this when using an external DNS cache. Please note that
# systemd-resolved does *not* count as an external cache, even when
# configured to do so.
#
#dns_cache_entries = 32768

# Minimum time-to-live in seconds for entries in the DNS cache. The
# default may appear high to most administrators; this is by design as the
# exotic loads of federating to many other servers require a higher TTL
# than many domains have set. Even when using an external DNS cache the
# problem is shifted to that cache which is ignorant of its role for
# this application and can adhere to many low TTL's increasing its load.
#
#dns_min_ttl = 10800

# Minimum time-to-live in seconds for NXDOMAIN entries in the DNS cache.
# This value is critical for the server to federate efficiently.
# NXDOMAIN's are assumed to not be returning to the federation and
# aggressively cached rather than constantly rechecked.
#
# Defaults to 3 days as these are *very rarely* false negatives.
#
#dns_min_ttl_nxdomain = 259200

# Number of DNS nameserver retries after a timeout or error.
#
#dns_attempts = 10

# The number of seconds to wait for a reply to a DNS query. Please note
# that recursive queries can take up to several seconds for some domains,
# so this value should not be too low, especially on slower hardware or
# resolvers.
#
#dns_timeout = 10

# Fallback to TCP on DNS errors. Set this to false if unsupported by
# nameserver.
#
#dns_tcp_fallback = true

# Enable to query all nameservers until the domain is found. Referred to
# as "trust_negative_responses" in hickory_resolver. This can avoid
# useless DNS queries if the first nameserver responds with NXDOMAIN or
# an empty NOERROR response.
#
#query_all_nameservers = true

# Enable using *only* TCP for querying your specified nameservers instead
# of UDP.
#
# If you are running tuwunel in a container environment, this config
# option may need to be enabled. For more details, see:
# https://tuwunel.chat/troubleshooting.html#potential-dns-issues-when-using-docker
#
#query_over_tcp_only = false

# DNS A/AAAA record lookup strategy
#
# Takes a number of one of the following options:
# 1 - Ipv4Only (Only query for A records, no AAAA/IPv6)
#
# 2 - Ipv6Only (Only query for AAAA records, no A/IPv4)
#
# 3 - Ipv4AndIpv6 (Query for A and AAAA records in parallel, uses whatever
# returns a successful response first)
#
# 4 - Ipv6thenIpv4 (Query for AAAA record, if that fails then query the A
# record)
#
# 5 - Ipv4thenIpv6 (Query for A record, if that fails then query the AAAA
# record)
#
# If you don't have IPv6 networking, then for better DNS performance it
# may be suitable to set this to Ipv4Only (1) as you will never ever use
# the AAAA record contents even if the AAAA record is successful instead
# of the A record.
#
#ip_lookup_strategy = 5

# List of domain patterns resolved via the alternative path without any
# persistent cache, very small memory cache, and no enforced TTL. This
# is intended for internal network and application services which require
# these specific properties. This path does not support federation or
# general purposes.
#
# reloadable: yes
# example: ["*\.dns\.podman$"]
#
#dns_passthru_domains = []

# Whether to resolve appservices via the alternative path; setting this is
# superior to providing domains in `dns_passthru_domains` if all
# appservices intend to be matched anyway. The overhead of matching regex
# and maintaining the list of domains can be avoided.
#
#dns_passthru_appservices = false

# Enable or disable case randomization for DNS queries. This is a security
# mitigation where answer spoofing is prevented by having to exactly match
# the question. Occasional errors seen in logs which may have lead you
# here tend to be from overloading DNS. Nevertheless for servers which
# are truly incapable this can be set to false.
#
# This currently defaults to false due to user reports regarding some
# popular DNS caches which may or may not be patched soon. It may again
# default to true in an upcoming release.
#
#dns_case_randomization = false

# Max request size for file uploads. Accepts an integer byte count or a
# string with SI/IEC suffix such as "24 MiB".
#
#max_request_size = 24 MiB

# Maximum size of a response body buffered from a remote server. Applies
# to federation requests, push gateway and appservice transactions, and
# remote media fetched for URL previews. A peer cannot be trusted to honor
# a requested limit, so this bounds the response held in memory
# regardless, guarding against a remote driving the process out of
# memory. Accepts an integer byte count or a string with SI/IEC suffix
# such as "256 MiB".
#
#max_response_size = 256 MiB

# Maximum number of concurrently pending (asynchronous) media uploads a
# user can have.
#
# reloadable: yes
#
#max_pending_media_uploads = 5

# The time in seconds before an unused pending MXC URI expires and is
# removed.
#
# reloadable: yes
#
#media_create_unused_expiration_time = 86400 (24 hours)

# The maximum number of media create requests per second allowed from a
# single user.
#
# reloadable: yes
#
#media_rc_create_per_second = 10

# The maximum burst count for media create requests from a single user.
#
# reloadable: yes
#
#media_rc_create_burst_count = 50

# This item is undocumented. Please contribute documentation for it.
# reloadable: yes
#
#max_fetch_prev_events = 1024

# Maximum time, in milliseconds, to wait for the missing prev_events of an
# incoming timeline event to arrive on their own before fetching them over
# federation. A gap that closes within this window skips the fetch. The
# wait is event-driven and wakes the instant the events arrive, so this is
# a ceiling on added latency, not a fixed cost. Set to 0 to fetch
# immediately.
#
# reloadable: yes
#
#fetch_prev_wait_ms = 750

# Default/base connection timeout (seconds). This is used only by URL
# previews and update/news endpoint checks.
#
#request_conn_timeout = 10

# Default/base request timeout (seconds). The time waiting to receive more
# data from another server. This is used only by URL previews,
# update/news, and misc endpoint checks.
#
#request_timeout = 35

# Default/base request total timeout (seconds). The time limit for a whole
# request. This is set very high to not cancel healthy requests while
# serving as a backstop. This is used only by URL previews and update/news
# endpoint checks.
#
#request_total_timeout = 320

# Default/base idle connection pool timeout (seconds). This is used only
# by URL previews and update/news endpoint checks.
#
#request_idle_timeout = 5

# Default/base max idle connections per host. This is used only by URL
# previews and update/news endpoint checks. Defaults to 1 as generally the
# same open connection can be re-used.
#
#request_idle_per_host = 1

# Allow the outbound HTTP client to negotiate gzip with other servers:
# advertise it in Accept-Encoding and transparently decompress responses.
# This covers federation, media, and URL preview traffic, and is separate
# from `gzip_compression`, which compresses tuwunel's own responses.
#
# Enabled by default. Set to false to force the client to neither request
# nor decompress gzip. Does nothing unless tuwunel was built with the
# `gzip_compression` feature.
#
#request_gzip = true

# Allow the outbound HTTP client to negotiate brotli with other servers:
# advertise it in Accept-Encoding and transparently decompress responses.
# This covers federation, media, and URL preview traffic, and is separate
# from `brotli_compression`, which compresses tuwunel's own responses.
#
# Enabled by default. Set to false to force the client to neither request
# nor decompress brotli. Does nothing unless tuwunel was built with the
# `brotli_compression` feature.
#
#request_brotli = true

# Allow the outbound HTTP client to negotiate zstd with other servers:
# advertise it in Accept-Encoding and transparently decompress responses.
# This covers federation, media, and URL preview traffic, and is separate
# from `zstd_compression`, which compresses tuwunel's own responses.
#
# Enabled by default. Set to false to force the client to neither request
# nor decompress zstd. Does nothing unless tuwunel was built with the
# `zstd_compression` feature.
#
#request_zstd = true

# Federation well-known resolution connection timeout (seconds).
#
#well_known_conn_timeout = 6

# Federation HTTP well-known resolution request timeout (seconds).
#
#well_known_timeout = 10

# Federation client request timeout (seconds). This applies to each read
# from the remote server rather than to the request as a whole, which
# remains bounded by `request_total_timeout`.
#
#federation_timeout = 25

# Timeout (seconds) for client-initiated federation key lookups, namely
# /keys/query and /keys/claim against remote servers. Should be well
# below `federation_timeout` so an interactive request to an unresponsive
# server does not outlast the requesting client's own send deadline. A
# lookup that exceeds this bound records a transient federation failure
# for that server, so subsequent lookups back off instead of blocking
# again.
#
#federation_keys_timeout = 8

# Federation client idle connection pool timeout (seconds).
#
#federation_idle_timeout = 25

# Federation client max idle connections per host. Defaults to 1 as
# generally the same open connection can be re-used.
#
#federation_idle_per_host = 1

# Federation sender request timeout (seconds). The time it takes for the
# remote server to process sent transactions can take a while.
#
#sender_timeout = 180

# Federation sender idle connection pool timeout (seconds).
#
#sender_idle_timeout = 180

# Federation sender transaction retry backoff limit (seconds).
#
# reloadable: yes
#
#sender_retry_backoff_limit = 86400

# Grace period (seconds) before the first retry of a federation
# destination that has failed exactly once, applied in place of the
# quadratic backoff curve so a single transient failure does not hold
# delivery until the next backoff window. A second consecutive failure
# returns to the backoff curve. Set to 0 to disable the grace and back off
# from the first failure.
#
#sender_retry_grace = 15

# Appservice URL request connection timeout. Defaults to 35 seconds as
# generally appservices are hosted within the same network.
#
#appservice_timeout = 35

# Appservice URL idle connection pool timeout (seconds).
#
#appservice_idle_timeout = 300

# Notification gateway pusher idle connection pool timeout.
#
#pusher_idle_timeout = 15

# Maximum time to receive a request from a client (seconds).
#
#client_receive_timeout = 75

# Maximum time to process a request received from a client (seconds).
#
#client_request_timeout = 240

# Maximum time to transmit a response to a client (seconds)
#
#client_response_timeout = 120

# Grace period for clean shutdown of client requests (seconds).
#
# reloadable: yes
#
#client_shutdown_timeout = 15

# Source of the client IP address for rate limiting, logging, and
# security tooling.
#
# When unset (the default), the `ClientIp` extractor scans common
# proxy headers in leftmost-IP mode (`X-Forwarded-For`, RFC 7239
# `Forwarded`, `X-Real-IP`, `Fly-Client-IP`, `True-Client-IP`,
# `CF-Connecting-IP`, `CloudFront-Viewer-Address`) and falls back
# to the TCP peer address; clients can spoof their address via
# request headers in that mode.
#
# When set, `ClientIp` resolves exclusively from the selected
# source. The rightmost value is used for multi-valued headers;
# only the proxy can append to the right, so this is resistant to
# client spoofing.
#
# Supported values:
# - "connect_info" - TCP peer address only (direct connections)
# - "rightmost_x_forwarded_for" - nginx, Caddy
# - "rightmost_forwarded" - RFC 7239 proxies
# - "x_real_ip" - nginx `X-Real-IP`
# - "cf_connecting_ip" - Cloudflare / cloudflared
# - "true_client_ip" - Akamai, Cloudflare Enterprise
# - "fly_client_ip" - Fly.io
# - "cloudfront_viewer_address" - AWS CloudFront
#
# On Unix-socket deployments, leave this unset rather than setting
# "connect_info"; that source requires a TCP peer address.
#
# WARNING: A header-based value without a trusted reverse proxy in
# front of tuwunel allows clients to forge their IP. Changing this
# value requires a server restart.
#
#ip_source = "connect_info"

# Subnets whose TCP peers are treated as trusted and bypass the
# `ip_source`-based extraction, falling through to the same
# insecure header-scan + `ConnectInfo` fallback used when
# `ip_source` is unset. Each entry is CIDR notation, including
# the prefix length (use `/32` or `/128` to trust a single host).
#
# Loopback (`127.0.0.0/8`, `::1/128`) is always bypassed and
# need not be listed.
#
# Use this when locally attached bridges or other server-side
# clients connect from a private container or VPN subnet that
# cannot carry the configured proxy header (e.g. a user-defined
# Docker bridge network without `network_mode: host`).
#
# NOTE: If you configure an entire subnet here, be sure that it
# does not include the address Tuwunel receives external traffic
# from, i.e. that of your proxy. This would, for example, happen
# if you deployed the proxy in a common bridge network with your
# other components (e.g. in a Compose deployment) and specified
# said network's subnet here. Traffic from the proxy would then
# also have the bypass applied, rendering the `ip_source` option
# effectively useless.
#
# WARNING: Any peer in these subnets can forge the client IP via
# request headers. Only include subnets you control end-to-end.
# Changing this value requires a server restart.
#
#ip_source_trusted_subnets = ["172.18.0.0/16", "fd00::/8"]

# Grace period for clean shutdown of federation requests (seconds).
#
# reloadable: yes
#
#sender_shutdown_timeout = 5

# Enables registration. If set to false, no users can register on this
# server.
#
# If set to true without a token configured, users can register with no
# form of 2nd-step only if you set the following option to true:
# `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
#
# If you would like registration only via token reg, please configure
# `registration_token` or `registration_token_file`.
# reloadable: yes
#
#allow_registration = false

# Enabling this setting opens registration to anyone without restrictions.
# This makes your server vulnerable to abuse
# reloadable: yes
#
#yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = false

# A static registration token that new users will have to provide when
# creating an account. If unset and `allow_registration` is true,
# you must set
# `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
# to true to allow open registration without any conditions.
#
# YOU NEED TO EDIT THIS OR USE registration_token_file.
#
# reloadable: yes
# example: "o&^uCtes4HPf0Vu@F20jQeeWE7"
#
#registration_token =

# Path to a file on the system that gets read for additional registration
# tokens. Multiple tokens can be added if you separate them with
# whitespace
#
# tuwunel must be able to access the file, and it must not be empty
#
# reloadable: yes
# example: "/etc/tuwunel/.reg_token"
#
#registration_token_file =

# A pre-shared secret enabling out-of-band account creation via the
# Synapse-style `/_synapse/admin/v1/register` endpoint. The endpoint is
# only available when this is set. Requests authenticate by HMAC-SHA1
# keyed on this value; UIAA is bypassed.
#
# Use a high-entropy value (at least 32 bytes) and treat it as a
# secret of equivalent power to a server admin's access token.
#
# reloadable: yes
# example: "kZ2hN5pQ8wXyL4mR7tBfCgJxV3aD6sE1u"
#
#registration_shared_secret =

# Path to a file containing the registration shared secret. Trimmed of
# surrounding whitespace on read. Takes precedence over
# `registration_shared_secret` when both are set.
#
# reloadable: yes
# example: "/etc/tuwunel/.reg_shared_secret"
#
#registration_shared_secret_file =

# Shared secret the Matrix Authentication Service (MAS) authenticates its
# provisioning calls with. When set, the `/_synapse/mas/*` endpoints
# accept only requests bearing this exact secret as their bearer token,
# rejecting all others; when unset, those endpoints reject every request.
#
# Use a high-entropy value and keep it identical to the secret configured
# on the MAS side.
#
# reloadable: yes
# example: "kZ2hN5pQ8wXyL4mR7tBfCgJxV3aD6sE1u"
#
#mas_secret =

# Controls whether encrypted rooms and events are allowed.
# reloadable: yes
#
#allow_encryption = true

# Controls whether locally-created rooms should be end-to-end encrypted by
# default. This option is equivalent to the one found in Synapse.
#
# Options:
# - "all": All created rooms are encrypted.
# - "invite": Any room created with `private_chat` or
#   `trusted_private_chat` presets.
# - "none": Explicit value for no effect.
# - Other values default to no effect.
#
# reloadable: yes
#
#encryption_enabled_by_default_for_room_type = "none"

# Controls whether federation is allowed or not. It is not recommended to
# disable this after installation due to potential federation breakage but
# this is technically not a permanent setting.
#
#allow_federation = true

# (EXPERIMENTAL) Resolve the base event of a room context request by
# fetching it from federation when the server never received it.
#
# When a client requests
# `/_matrix/client/v3/rooms/{roomId}/context/{eventId}` for an event
# the server does not hold locally, the server fetches it from a room
# peer and persists it before responding, rather than returning a
# 404. This is gated on `allow_federation`; with federation disabled
# it has no effect. Other on-demand federation fetch sites are gated
# separately.
#
# reloadable: yes
#
#fetch_unreceived_contexts_over_federation = false

# Per-round ceiling on how many servers a federation event fetch contacts
# concurrently. Tightens the built-in fan-out profile of every fetch kind;
# it never widens one. 0 leaves the profiles unchanged.
#
# reloadable: yes
#
#fetch_fanout_max_width = 0

# Ceiling on how many staged rounds a federation event fetch runs before
# giving up. Tightens the built-in round count of every fetch kind; it
# never raises one. 0 leaves the profiles unchanged.
#
# reloadable: yes
#
#fetch_fanout_rounds = 0

# Derive the state at an incoming federation event from locally held
# events when its previous events are stored but not yet resolved,
# instead of requesting /state_ids from the origin server. Only an event
# whose entire unresolved local ancestry is present participates; any
# other case still falls back to the federation state fetch. Disabling
# this restores the previous behavior of always fetching.
#
# reloadable: yes
#
#resolve_state_locally = true

# Ceiling on how many unresolved local events one local state derivation
# may visit before falling back to the federation state fetch. Bounds
# worst-case memory and latency in rooms with a large unresolved
# backlog. 0 disables local derivation entirely.
#
# reloadable: yes
#
#resolve_state_locally_max = 256

# Validation mode for local state derivation: compute the local result,
# then fetch /state_ids anyway, compare the two, and log any divergence
# while the fetched state remains authoritative. Federation load is
# unchanged. For operators soaking resolve_state_locally before trusting
# it. No effect unless resolve_state_locally is enabled.
#
# reloadable: yes
#
#resolve_state_locally_shadow = true

# Soft cap on the number of forward extremities tracked per room. When
# applying an incoming federation event would leave the room's frontier
# larger than this, the least useful leaves are pruned from the tracked
# set until it is back at the cap. Pruned events are not deleted and can
# still be referenced by other servers; this server merely stops citing
# them as frontier tips. Events created by this server are never pruned.
# 0 disables automatic pruning.
#
# reloadable: yes
#
#forward_extremities_max = 60

# Emergency bound on the per-room frontier. A frontier larger than this
# is cut down to it in a single step, ignoring the per-event pruning
# batch limit. Values at or below forward_extremities_max remove the
# pacing entirely, pruning straight to the cap in one step.
#
# reloadable: yes
#
#forward_extremities_emergency_max = 256

# Upper bound on how many forward extremities one incoming event may
# prune while the frontier is between the cap and the emergency bound.
# Spreads convergence across events to bound the work done by any single
# one. 0 stops paced pruning, leaving only the emergency bound.
#
# reloadable: yes
#
#forward_extremities_prune_batch = 32

# Sets the default `m.federate` property for newly created rooms when the
# client does not request one. If `allow_federation` is set to false at
# the same this value is set to false it then always overrides the client
# requested `m.federate` value to false.
#
# Rooms are fixed to the setting at the time of their creation and can
# never be changed; changing this value only affects new rooms.
# reloadable: yes
#
#federate_created_rooms = true

# Allows federation requests to be made to itself
#
# This isn't intended and is very likely a bug if federation requests are
# being sent to yourself. This currently mainly exists for development
# purposes.
# reloadable: yes
#
#federation_loopback = false

# Always calls /forget on behalf of the user if leaving a room. This is a
# part of MSC4267 "Automatically forgetting rooms on leave"
# reloadable: yes
#
#forget_forced_upon_leave = false

# Set this to true to require authentication on the normally
# unauthenticated profile retrieval endpoints (GET)
# "/_matrix/client/v3/profile/{userId}".
#
# This can prevent profile scraping.
# reloadable: yes
#
#require_auth_for_profile_requests = false

# Preserve per-room profile overrides during a global profile update.
#
# When `true` (default), a profile change (displayname or avatar_url)
# arriving via the profile endpoints skips rooms whose current
# `m.room.member` already differs from the user's prior global
# profile. This is the natural behavior users expect after setting a
# per-room nickname or avatar with a client's `/myroomnick`-style
# command: a subsequent global change does not clobber the override.
#
# Set to `false` to always rewrite every joined room's member event
# to match the new global profile. That matches the literal spec
# reading.
#
# MSC4466 lets clients pick this per request via the
# `org.matrix.msc4466.propagate_to` query parameter
# (`all` / `unchanged` / `none`); an explicit value overrides this
# default in either direction.
#
# reloadable: yes
#
#preserve_room_profile_overrides = true

# Set this to true to allow your server's public room directory to be
# federated. Set this to false to protect against /publicRooms spiders,
# but will forbid external users from viewing your server's public room
# directory. If federation is disabled entirely (`allow_federation`), this
# is inherently false.
# reloadable: yes
#
#allow_public_room_directory_over_federation = false

# Set this to true to allow your server's public room directory to be
# queried without client authentication (access token) through the Client
# APIs. Set this to false to protect against /publicRooms spiders.
# reloadable: yes
#
#allow_public_room_directory_without_auth = false

# Allows room directory searches to match on partial room_id's when the
# search term starts with '!'.
#
# reloadable: yes
#
#allow_public_room_search_by_id = true

# Set this to false to limit results of rooms when searching by ID to
# those that would be found by an alias or other query; specifically
# those listed in the public rooms directory. By default this is set to
# true allowing any joinable room to match. This satisfies the Principle
# of Least Expectation when pasting a room_id into a search box with
# intent to join; many rooms simply opt-out of public listings. Therefor
# to prevent this feature from abuse, knowledge of several characters of
# the room_id is required before any results are returned.
#
# reloadable: yes
#
#allow_unlisted_room_search_by_id = true

# Show all local users in user directory. With this set to false, only
# users in public rooms or those that share a room with the user making
# the search will be shown.
#
# reloadable: yes
#
#show_all_local_users_in_user_directory = false

# Allow guest users to access TURN credentials.
#
# This is the equivalent of Synapse's `turn_allow_guests` config option.
# Setting this to true allows guest users to call the endpoint
# `/_matrix/client/v3/voip/turnServer`.
# reloadable: yes
#
#turn_allow_guests = false

# Set this to true to lock down your server's public room directory and
# only allow admins to publish rooms to the room directory. Unpublishing
# is still allowed by all users with this enabled.
# reloadable: yes
#
#lockdown_public_room_directory = false

# Set this to true to allow federating device display names / allow
# external users to see your device display name. If federation is
# disabled entirely (`allow_federation`), this is inherently false. For
# privacy reasons, this is best left disabled.
# reloadable: yes
#
#allow_device_name_federation = false

# Config option to allow or disallow incoming federation requests that
# obtain the profiles of our local users from
# `/_matrix/federation/v1/query/profile`
#
# Increases privacy of your local user's such as display names, but some
# remote users may get a false "this user does not exist" error when they
# try to invite you to a DM or room. Also can protect against profile
# spiders.
#
# This is inherently false if `allow_federation` is disabled
# reloadable: yes
#
#allow_inbound_profile_lookup_federation_requests = true

# Allow standard users to create rooms. Appservices and admins are always
# allowed to create rooms
# reloadable: yes
#
#allow_room_creation = true

# Set to false to disable users from joining or creating room versions
# that aren't officially supported by tuwunel. Unstable room versions may
# have flawed specifications or our implementation may be non-conforming.
# Correct operation may not be guaranteed, but incorrect operation may be
# tolerable and unnoticed.
#
# tuwunel officially supports room versions 6+. tuwunel has slightly
# experimental (though works fine in practice) support for versions 3 - 5.
#
# reloadable: yes
#
#allow_unstable_room_versions = true

# Set to true to enable experimental room versions.
#
# Unlike unstable room versions these versions are either under
# development, protype spec-changes, or somehow present a serious risk to
# the server's operation or database corruption. This is for developer use
# only.
# reloadable: yes
#
#allow_experimental_room_versions = false

# MSC4284: ask the room's policy server to sign outgoing events. When a
# room has a valid `m.room.policy` state event, the homeserver requests a
# signature from that policy server's federation `/sign` endpoint before
# federating each event. Refusal aborts the local request; network or
# timeout failures fail open with a warn log so a transient policy-server
# outage does not silently take the room offline.
#
# reloadable: yes
#
#enable_policy_servers = false

# MSC4284: timeout (seconds) for requests to a room's policy server.
# Applies to both outbound `/sign` calls and inbound signature-fetches.
#
# reloadable: yes
#
#policy_server_request_timeout = 5

# MSC3925: fold the most recent message edit (an `m.replace` relation)
# into `unsigned.m.relations` on a served event as the full replacement
# event, on the client read endpoints. Off by default: it adds a typed
# index seek per served event and a server-authoritative edit summary that
# most clients reconstruct locally anyway, so it is opt-in.
#
# reloadable: yes
#
#bundle_edit_relations = false

# MSC2675/MSC3267: fold reference relations (`m.reference`) into
# `unsigned.m.relations` on a served event as `{ chunk: [{ event_id },
# ...] }`, on the client read endpoints. Off by default: no surveyed
# client renders reference bundles (references are plumbing for polls,
# beacons, and verification, which clients resolve directly), so most
# deployments gain nothing from the added read-time cost.
#
# reloadable: yes
#
#bundle_reference_relations = false

# Default room version tuwunel will create rooms with.
#
# The default is prescribed by the spec, but may be selected by developer
# recommendation. To prevent stale documentation we no longer list it
# here. It is only advised to override this if you know what you are
# doing, and by doing so, updates with new versions are precluded.
# reloadable: yes
#
#default_room_version =

# Default power-level overrides applied when this homeserver creates a new
# room.
#
# Uses the same top-level shape as the client `/createRoom`
# `power_level_content_override` parameter and is merged before any
# per-request override, so a client can still override it per room. Only
# affects newly created rooms. Top-level keys replace wholesale rather
# than deep-merging (matching the client parameter): setting `users` or
# `events` replaces the entire computed default submap for that key.
#
# reloadable: yes
#
#default_power_level_content_override = { users_default = 50 }

# This item is undocumented. Please contribute documentation for it.
#
#allow_jaeger = false

# This item is undocumented. Please contribute documentation for it.
#
#jaeger_filter = "info"

# If the 'perf_measurements' compile-time feature is enabled, enables
# collecting folded stack trace profile of tracing spans using
# tracing_flame. The resulting profile can be visualized with inferno[1],
# speedscope[2], or a number of other tools.
#
# [1]: https://github.com/jonhoo/inferno
# [2]: www.speedscope.app
#
#tracing_flame = false

# This item is undocumented. Please contribute documentation for it.
#
#tracing_flame_filter = "info"

# This item is undocumented. Please contribute documentation for it.
#
#tracing_flame_output_path = "./tracing.folded"

# Examples:
#
# - No proxy (default):
#
#       proxy = "none"
#
# - For global proxy, create the section at the bottom of this file:
#
#       [global.proxy]
#       global = { url = "socks5h://localhost:9050" }
#
# - To proxy some domains:
#
#       [global.proxy]
#       [[global.proxy.by_domain]]
#       url = "socks5h://localhost:9050"
#       include = ["*.onion", "matrix.myspecial.onion"]
#       exclude = ["*.myspecial.onion"]
#
# Include vs. Exclude:
#
# - If include is an empty list, it is assumed to be `["*"]`.
#
# - If a domain matches both the exclude and include list, the proxy will
#   only be used if it was included because of a more specific rule than
#   it was excluded. In the above example, the proxy would be used for
#   `ordinary.onion`, `matrix.myspecial.onion`, but not
#   `hello.myspecial.onion`.
#
#proxy = "none"

# Servers listed here will be used to gather public keys of other servers
# (notary trusted key servers).
#
# Currently, tuwunel doesn't support inbound batched key requests, so
# this list should only contain other Synapse servers.
#
# reloadable: yes
# example: ["matrix.org", "tchncs.de"]
#
#trusted_servers = ["matrix.org"]

# Whether to query the servers listed in trusted_servers first or query
# the origin server first. For best security, querying the origin server
# first is advised to minimize the exposure to a compromised trusted
# server. For maximum federation/join performance this can be set to true,
# however other options exist to query trusted servers first under
# specific high-load circumstances and should be evaluated before setting
# this to true.
# reloadable: yes
#
#query_trusted_key_servers_first = false

# Whether to query the servers listed in trusted_servers first
# specifically on room joins. This option limits the exposure to a
# compromised trusted server to room joins only. The join operation
# requires gathering keys from many origin servers which can cause
# significant delays. Therefor this defaults to true to mitigate
# unexpected delays out-of-the-box. The security-paranoid or those willing
# to tolerate delays are advised to set this to false. Note that setting
# query_trusted_key_servers_first to true causes this option to be
# ignored.
# reloadable: yes
#
#query_trusted_key_servers_first_on_join = true

# Only query trusted servers for keys and never the origin server. This is
# intended for clusters or custom deployments using their trusted_servers
# as forwarding-agents to cache and deduplicate requests. Notary servers
# do not act as forwarding-agents by default, therefor do not enable this
# unless you know exactly what you are doing.
# reloadable: yes
#
#only_query_trusted_key_servers = false

# Maximum number of keys to request in each trusted server batch query.
#
# reloadable: yes
#
#trusted_server_batch_size = 192

# Maximum number of request batches in flight simultaneously when querying
# a trusted server.
#
# reloadable: yes
#
#trusted_server_batch_concurrency = 2

# Max log level for tuwunel. Allows debug, info, warn, or error.
#
# See also:
# https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#directives
#
# **Caveat**:
# For release builds, the tracing crate is configured to only implement
# levels higher than error to avoid unnecessary overhead in the compiled
# binary from trace macros. For debug builds, this restriction is not
# applied.
#
#log = "info"

# Output logs with ANSI colours.
#
#log_colors = true

# Sets the log format to compact mode.
#
#log_compact = false

# Configures the span events which will be outputted with the log.
#
#log_span_events = "none"

# Configures whether TUWUNEL_LOG EnvFilter matches values using regular
# expressions. See the tracing_subscriber documentation on Directives.
#
#log_filter_regex = true

# Toggles the display of ThreadId in tracing log output.
#
#log_thread_ids = false

# Redirects logging to standard error (stderr). The default is false for
# stdout. For those using our systemd features the redirection to stderr
# occurs as necessary and setting this option should not be required. We
# offer this option for all other users who desire such redirection.
#
#log_to_stderr = false

# Setting to false disables the logging/tracing system at a lower level.
# In contrast to configuring an empty `log` string where the system is
# still operating but muted, when this option is false the system was not
# initialized and is not operating. Changing this option has no effect
# after startup. This option is intended for developers and expert use
# only: configuring an empty log string is preferred over using this.
#
#log_enable = true

# Setting to false disables the logging/tracing system at a lower level
# similar to `log_enable`. In this case the system is configured normally,
# but not registered as the global handler in the final steps. This option
# is for developers and expert use only.
#
#log_global_default = true

# OpenID token expiration/TTL in seconds.
#
# These are the OpenID tokens that are primarily used for Matrix account
# integrations (e.g. Vector Integrations in Element), *not* OIDC/OpenID
# Connect/etc.
#
# reloadable: yes
#
#openid_token_ttl = 3600

# Allow an existing session to mint a login token for another client.
# This requires interactive authentication, but has security ramifications
# as a malicious client could use the mechanism to spawn more than one
# session. Enabled by default.
#
# reloadable: yes
#
#login_via_existing_session = true

# Whether to enable the login token route to accept login tokens at all.
# Login tokens may be generated by the server for authorization flows such
# as SSO; disabling tokens may break such features.
#
# This option is distinct from `login_via_existing_session` and does not
# carry the same security implications; the intent is to leave this
# enabled while disabling the former to prevent clients from commanding
# login token creation but without preventing the server from doing so.
#
# reloadable: yes
#
#login_via_token = true

# Whether to enable login using traditional user/password authorization
# flow.
#
# Set this option to false if you intend to allow logging in only using
# other mechanisms, such as SSO.
#
# reloadable: yes
#
#login_with_password = true

# Login token expiration/TTL in milliseconds.
#
# These are short-lived tokens for the m.login.token endpoint.
# This is used to allow existing sessions to create new sessions.
# see login_via_existing_session.
#
# reloadable: yes
#
#login_token_ttl = 120000

# Access token TTL in seconds.
#
# For clients that support refresh-tokens, the access-token provided on
# login will be invalidated after this amount of time and the client will
# be soft-logged-out until refreshing it.
#
# reloadable: yes
#
#access_token_ttl = 604800

# Refresh token TTL in seconds.
#
# Refresh tokens are rejected once this lifetime elapses. Whether the
# deadline slides forward on each use or stays fixed at issuance is
# controlled by `refresh_token_idle_only`. The default of `0` disables
# refresh-token expiry entirely; a typical enabled value is `259200`
# (three days).
#
# reloadable: yes
#
#refresh_token_ttl = 0

# Whether `refresh_token_ttl` acts as an idle timeout or an absolute
# session lifetime.
#
# When `true` (default), each successful refresh resets the deadline to
# `now + refresh_token_ttl`. A session in continuous use never expires.
# When `false`, the deadline is fixed at first issuance and rotation
# carries it forward, forcing re-auth after `refresh_token_ttl`
# regardless of activity.
#
# reloadable: yes
#
#refresh_token_idle_only = true

# Whether refresh-token expiry triggers a hard logout instead of a soft
# one.
#
# When `false` (default), an expired refresh token is rejected with
# `M_UNKNOWN_TOKEN` carrying `soft_logout: true`. The client can preserve
# E2EE keys and local state, then re-authenticate to resume the same
# device.
#
# When `true`, the device is removed entirely on expiry: the access
# token is invalidated, the device record is deleted, and the client is
# signalled with `soft_logout: false`. The next session is a brand-new
# device, so the client cannot recover E2EE history from local state
# alone; this is the CWE-613 stance and trades usability for that
# guarantee.
#
# reloadable: yes
#
#refresh_token_hard_logout = false

# Grace window in seconds for a benign refresh-token double-submit.
#
# After a refresh token rotates, the spent token is retained for one
# generation so a later reuse is detectable. If that spent token is
# presented again within this window while its successor is still the
# device's current refresh token, the request is treated as a client that
# lost the rotated response: a fresh access token is issued for the
# unchanged refresh token rather than revoking the device. Outside the
# window, or once the chain has advanced, a replayed refresh token revokes
# the device as a suspected compromise. Set to `0` to treat every reuse as
# a compromise.
#
# reloadable: yes
#
#refresh_token_reuse_grace = 15

# Whether a detected refresh-token reuse revokes the device.
#
# When true (default), presenting a refresh token that was already rotated
# (outside the `refresh_token_reuse_grace` window) removes the device, the
# RFC 6819 stance that treats reuse as a compromised session. When false,
# the replayed request is rejected but the device is left intact, the
# laxer behaviour an operator fronting another OAuth client may prefer.
#
# reloadable: yes
#
#refresh_token_reuse_revoke = true

# Enable native registration and login on the built-in OIDC provider
# (next-gen auth), authenticating Matrix clients against this server's own
# accounts without a third-party `identity_provider`.
#
# When false (default), the OIDC server runs only to broker for a
# configured `identity_provider`, redirecting users to that upstream IdP.
# When true, an authorization request that selects no provider is served a
# native login or registration page checked against local accounts;
# `well_known.client` must be set. Native and external providers coexist;
# a configured `identity_provider` still brokers as before. Registration
# here honors `allow_registration`, the registration token, and
# `registration_terms` exactly as the client registration endpoint does.
#
# reloadable: yes
#
#oidc_native_auth = false

# Require OIDC clients (next-gen auth) to request an MSC2967 device scope.
#
# When false, a client that omits the `urn:matrix:client:device:<id>`
# scope is assigned a server-generated device id, which is echoed back in
# the granted scope. When true, the authorization-code grant is rejected
# unless the client supplies a device scope, per the MSC2967 expectation
# that the client owns its device id.
#
# reloadable: yes
#
#oidc_require_device_scope = false

# Require PKCE (RFC 7636) with the S256 method on the OIDC
# authorization-code grant.
#
# When true, the authorize endpoint rejects a request that carries no
# `code_challenge`, as MSC2964 mandates for public clients. A present
# challenge must always use S256; the `plain` method is rejected
# regardless of this setting. Set to false only as a transition escape
# hatch for a legacy client that cannot send a challenge.
#
# reloadable: yes
#
#oidc_require_pkce = true

# Reject an OIDC authorization-code grant that requests a scope this
# server does not recognise, instead of narrowing the granted scope down
# to the recognised tokens.
#
# When false (default), an unrecognised scope token is dropped and the
# narrowed `scope` is echoed back to the client per RFC 6749. When true,
# an unrecognised scope is rejected. `openid` and the MSC2967 device and
# api scopes (both spellings) are always recognised.
#
# reloadable: yes
#
#oidc_strict_scope = false

# Initial access token required to register an OIDC client dynamically
# (RFC 7591).
#
# When set, the registration endpoint requires the caller to present this
# token as an `Authorization: Bearer` credential. The default (empty)
# leaves dynamic client registration open.
#
# reloadable: yes
#
#oidc_registration_access_token =

# Allowlist of hostnames permitted in a dynamically-registered OIDC
# client's redirect_uris.
#
# When non-empty, every redirect_uri presented at registration must have a
# host in this list or the registration is rejected. The default (empty)
# imposes no host restriction.
#
# reloadable: yes
#
#oidc_registration_allowed_redirect_hosts = []

# Require a `client_uri` in dynamic client registration requests
# (RFC 7591 / MSC2966).
#
# When false (default), `client_uri` is optional; a client that supplies
# one still has it validated (https, host, no userinfo) and the other URLs
# in the request must share its host or a subdomain. When true, a
# registration without an https `client_uri` is rejected with
# `invalid_client_metadata`, enforcing the MSC2966 common-base model on
# every client.
#
# reloadable: yes
#
#oidc_registration_require_client_uri = false

# Token-bucket refill rate (requests per second) for the OIDC endpoints.
#
# Applies a shared per-client-IP throttle across the authorize, token,
# dynamic-registration and device-grant endpoints. The default of `0`
# disables the throttle, preserving open
# access; raise it together with `oidc_rc_burst_count` to protect a server
# exposed to a hostile network. The key is the client IP, so a rate low
# enough to bite a brute-force attempt can also throttle many users behind
# one NAT; size the burst accordingly.
#
# reloadable: yes
#
#oidc_rc_per_second = 0

# Token-bucket depth (burst size) for the OIDC endpoint throttle.
#
# The number of requests a single client IP may make in a burst before the
# `oidc_rc_per_second` refill rate governs. Ignored while
# `oidc_rc_per_second` is `0`.
#
# reloadable: yes
#
#oidc_rc_burst_count = 0

# Static TURN username to provide the client if not using a shared secret
# ("turn_secret"), It is recommended to use a shared secret over static
# credentials.
# reloadable: yes
#
#turn_username = false

# Static TURN password to provide the client if not using a shared secret
# ("turn_secret"). It is recommended to use a shared secret over static
# credentials.
#
# reloadable: yes
#
#turn_password = false

# Vector list of TURN URIs/servers to use.
#
# Replace "example.turn.uri" with your TURN domain, such as the coturn
# "realm" config option. If using TURN over TLS, replace the URI prefix
# "turn:" with "turns:".
#
# reloadable: yes
# example: ["turn:example.turn.uri?transport=udp",
# "turn:example.turn.uri?transport=tcp"]
#
#turn_uris = []

# TURN secret to use for generating the HMAC-SHA1 hash apart of username
# and password generation.
#
# This is more secure, but if needed you can use traditional static
# username/password credentials.
#
#turn_secret = false

# TURN secret to use that's read from the file path specified.
#
# This takes priority over "turn_secret" first, and falls back to
# "turn_secret" if invalid or failed to open.
#
# example: "/etc/tuwunel/.turn_secret"
#
#turn_secret_file =

# TURN TTL, in seconds.
#
# reloadable: yes
#
#turn_ttl = 86400

# List/vector of room IDs or room aliases that tuwunel will make newly
# registered users join. The rooms specified must be rooms that you have
# joined at least once on the server, and must be public.
#
# reloadable: yes
# example: ["#tuwunel:grin.hu",
# "!l2xV0sd51lraysuRcsWVECge4NULaH3g-ou95vgDgiM"]
#
#auto_join_rooms = []

# Config option to automatically deactivate the account of any user who
# attempts to join a:
# - banned room
# - forbidden room alias
# - room alias or ID with a forbidden server name
#
# This may be useful if all your banned lists consist of toxic rooms or
# servers that no good faith user would ever attempt to join, and
# to automatically remediate the problem without any admin user
# intervention.
#
# This will also make the user leave all rooms. Federation (e.g. remote
# room invites) are ignored here.
#
# Defaults to false as rooms can be banned for non-moderation-related
# reasons and this performs a full user deactivation.
# reloadable: yes
#
#auto_deactivate_banned_room_attempts = false

# RocksDB log level. This is not the same as tuwunel's log level. This
# is the log level for the RocksDB engine/library which show up in your
# database folder/path as `LOG` files. tuwunel will log RocksDB errors
# as normal through tracing or panics if severe for safety.
#
#rocksdb_log_level = "error"

# This item is undocumented. Please contribute documentation for it.
#
#rocksdb_log_stderr = false

# Max RocksDB `LOG` file size before rotating. Accepts an integer byte
# count or a string with SI/IEC suffix such as "4 MiB".
#
#rocksdb_max_log_file_size = 4194304

# Time in seconds before RocksDB will forcibly rotate logs.
#
#rocksdb_log_time_to_roll = 0

# Use RocksDB tunings tailored to spinning disks (HDDs). On NVMe or SSD
# storage, leave this disabled.
#
# When enabled, RocksDB skips compaction readahead and parallel file-open
# threads at startup. This option does not affect Direct IO; for that, see
# `rocksdb_direct_io`.
#
#rocksdb_optimize_for_spinning_disks = false

# Enables direct-io to increase database performance via unbuffered I/O.
#
# For more details about direct I/O and RockDB, see:
# https://github.com/facebook/rocksdb/wiki/Direct-IO
#
# Set this option to false if the database resides on a filesystem which
# does not support direct-io like FUSE, or any form of complex filesystem
# setup such as possibly ZFS.
#
#rocksdb_direct_io = true

# Amount of threads that RocksDB will use for parallelism on database
# operations such as cleanup, sync, flush, compaction, etc. Set to 0 to
# use all your logical threads. Defaults to your CPU logical thread count.
#
#rocksdb_parallelism_threads = varies by system

# Maximum number of LOG files RocksDB will keep. This must *not* be set to
# 0. It must be at least 1. Defaults to 3 as these are not very useful
# unless troubleshooting/debugging a RocksDB bug.
#
#rocksdb_max_log_files = 3

# Type of RocksDB database compression to use.
#
# Available options are "zstd", "bz2", "lz4", or "none".
#
# It is best to use ZSTD as an overall good balance between
# speed/performance, storage, IO amplification, and CPU usage. For more
# performance but less compression (more storage used) and less CPU usage,
# use LZ4.
#
# For more details, see:
# https://github.com/facebook/rocksdb/wiki/Compression
#
# "none" will disable compression.
#
#rocksdb_compression_algo = "zstd"

# Level of compression the specified compression algorithm for RocksDB to
# use.
#
# Default is 32767, which is internally read by RocksDB as the default
# magic number and translated to the library's default compression level
# as they all differ. See their `kDefaultCompressionLevel`.
#
# Note when using the default value we may override it with a setting
# tailored specifically tuwunel.
#
#rocksdb_compression_level = 32767

# Level of compression the specified compression algorithm for the
# bottommost level/data for RocksDB to use. Default is 32767, which is
# internally read by RocksDB as the default magic number and translated to
# the library's default compression level as they all differ. See their
# `kDefaultCompressionLevel`.
#
# Since this is the bottommost level (generally old and least used data),
# it may be desirable to have a very high compression level here as it's
# less likely for this data to be used. Research your chosen compression
# algorithm.
#
# Note when using the default value we may override it with a setting
# tailored specifically tuwunel.
#
#rocksdb_bottommost_compression_level = 32767

# Whether to enable RocksDB's "bottommost_compression".
#
# At the expense of more CPU usage, this will further compress the
# database to reduce more storage. It is recommended to use ZSTD
# compression with this for best compression results. This may be useful
# if you're trying to reduce storage usage from the database.
#
# See https://github.com/facebook/rocksdb/wiki/Compression for more details.
#
#rocksdb_bottommost_compression = true

# Database recovery mode (for RocksDB WAL corruption).
#
# Use this option when the server reports corruption and refuses to start.
# Set mode 2 (PointInTime) to cleanly recover from this corruption. The
# server will continue from the last good state, several seconds or
# minutes prior to the crash. Clients may have to run "clear-cache &
# reload" to account for the rollback. Upon success, you may reset the
# mode back to default and restart again. Please note in some cases the
# corruption error may not be cleared for at least 30 minutes of operation
# in PointInTime mode.
#
# As a very last ditch effort, if PointInTime does not fix or resolve
# anything, you can try mode 3 (SkipAnyCorruptedRecord) but this will
# leave the server in a potentially inconsistent state.
#
# The default mode 1 (TolerateCorruptedTailRecords) will automatically
# drop the last entry in the database if corrupted during shutdown, but
# nothing more. It is extraordinarily unlikely this will desynchronize
# clients. To disable any form of silent rollback set mode 0
# (AbsoluteConsistency).
#
# The options are:
# 0 = AbsoluteConsistency
# 1 = TolerateCorruptedTailRecords (default)
# 2 = PointInTime (use me if trying to recover)
# 3 = SkipAnyCorruptedRecord (you now voided your tuwunel warranty)
#
# For more information on these modes, see:
# https://github.com/facebook/rocksdb/wiki/WAL-Recovery-Modes
#
# For more details on recovering a corrupt database, see:
# https://tuwunel.chat/troubleshooting.html#database-corruption
#
#rocksdb_recovery_mode = 1

# Enables or disables paranoid SST file checks. This can improve RocksDB
# database consistency at a potential performance impact due to further
# safety checks ran.
#
# For more information, see:
# https://github.com/facebook/rocksdb/wiki/Online-Verification#columnfamilyoptionsparanoid_file_checks
#
#rocksdb_paranoid_file_checks = false

# Enables or disables checksum verification in rocksdb at runtime.
# Checksums are usually hardware accelerated with low overhead; they are
# enabled in rocksdb by default. Older or slower platforms may see gains
# from disabling.
#
#rocksdb_checksums = true

# Enables the "atomic flush" mode in rocksdb. This option is not intended
# for users. It may be removed or ignored in future versions. Atomic flush
# may be enabled by the paranoid to possibly improve database integrity at
# the cost of performance.
#
#rocksdb_atomic_flush = false

# Database repair mode (for RocksDB SST corruption).
#
# Use this option when the server reports corruption while running or
# panics. If the server refuses to start use the recovery mode options
# first. Corruption errors containing the acronym 'SST' which occur after
# startup will likely require this option.
#
# - Backing up your database directory is recommended prior to running the
#   repair.
#
# - Disabling repair mode and restarting the server is recommended after
#   running the repair.
#
# See https://tuwunel.chat/troubleshooting.html#database-corruption for more details on recovering a corrupt database.
#
#rocksdb_repair = false

# This item is undocumented. Please contribute documentation for it.
#
#rocksdb_read_only = false

# This item is undocumented. Please contribute documentation for it.
#
#rocksdb_secondary = false

# Enables idle CPU priority for compaction thread. This is not enabled by
# default to prevent compaction from falling too far behind on busy
# systems.
#
#rocksdb_compaction_prio_idle = false

# Enables idle IO priority for compaction thread. This prevents any
# unexpected lag in the server's operation and is usually a good idea.
# Enabled by default.
#
#rocksdb_compaction_ioprio_idle = true

# Enables RocksDB compaction. You should never ever have to set this
# option to false. If you for some reason find yourself needing to use
# this option as part of troubleshooting or a bug, please reach out to us
# in the tuwunel Matrix room with information and details.
#
# Disabling compaction will lead to a significantly bloated and
# explosively large database, gradually poor performance, unnecessarily
# excessive disk read/writes, and slower shutdowns and startups.
#
#rocksdb_compaction = true

# Level of statistics collection. Some admin commands to display database
# statistics may require this option to be set. Database performance may
# be impacted by higher settings.
#
# Option is a number ranging from 0 to 6:
# 0 = No statistics.
# 1 = No statistics in release mode (default).
# 2 to 3 = Statistics with no performance impact.
# 3 to 5 = Statistics with possible performance impact.
# 6 = All statistics.
#
#rocksdb_stats_level = 1

# Ignores the list of dropped columns set by developers.
#
# This should be set to true when knowingly moving between versions in
# ways which are not recommended or otherwise forbidden, or for
# diagnostic and development purposes; requiring preservation across such
# movements.
#
# The developer's list of dropped columns is meant to safely reduce space
# by erasing data no longer in use. If this is set to true that storage
# will not be reclaimed as intended.
#
#rocksdb_never_drop_columns = false

# Configures RocksDB to not preallocate WAL logs.
#
# Normally, RocksDB allocates certain types of files by calling
# fallocate, writing the file contents, then truncating the logs to the
# proper size. This causes pathological disk space usage on btrfs due to
# how it interacts with its Copy-on-Write implementation. On ZFS,
# fallocate(2) for preallocation is unsupported and returns EOPNOTSUPP;
# only `FALLOC_FL_PUNCH_HOLE` and `FALLOC_FL_ZERO_RANGE` are implemented.
#
# Set this to false if you run the server on btrfs or ZFS, and do not
# touch it otherwise.
#
#rocksdb_allow_fallocate = true

# This is a password that can be configured that will let you login to the
# server bot account (currently `@conduit`) for emergency troubleshooting
# purposes such as recovering/recreating your admin room, or inviting
# yourself back.
#
# See https://tuwunel.chat/troubleshooting.html#lost-access-to-admin-room
# for other ways to get back into your admin room.
#
# Once this password is unset, all sessions will be logged out for
# security purposes.
#
# example: "F670$2CP@Hw8mG7RY1$%!#Ic7YA"
#
#emergency_password =

# This item is undocumented. Please contribute documentation for it.
# reloadable: yes
#
#notification_push_path = "/_matrix/push/v1/notify"

# For compatibility and special purpose use only. Setting this option to
# true will not filter messages sent to pushers based on rules or actions.
# Everything will be sent to the pusher. This option is offered for
# several reasons, but should not be necessary:
# - Bypass to workaround bugs or outdated server-side ruleset support.
# - Allow clients to evaluate pushrules themselves (due to the above).
# - Hosting or companies which have custom pushers and internal needs.
#
# Note that setting this option to true will not affect the record of
# notifications found in the notifications pane.
# reloadable: yes
#
#push_everything = false

# Setting to false disables the heroes calculation made by sliding and
# legacy client sync. The heroes calculation is mandated by the Matrix
# specification and your client may not operate properly unless this
# option is set to true.
#
# This option is intended for custom software deployments seeking purely
# to minimize unused resources; the overall savings are otherwise
# negligible.
# reloadable: yes
#
#calculate_heroes = true

# Allow local (your server only) presence updates/requests.
#
# Note that presence on tuwunel is very fast unlike Synapse's. If using
# outgoing presence, this MUST be enabled.
# reloadable: yes
#
#allow_local_presence = true

# Allow incoming federated presence updates/requests.
#
# This option receives presence updates from other servers, but does not
# send any unless `allow_outgoing_presence` is true. Note that presence on
# tuwunel is very fast unlike Synapse's.
# reloadable: yes
#
#allow_incoming_presence = true

# Allow outgoing presence updates/requests.
#
# This option sends presence updates to other servers, but does not
# receive any unless `allow_incoming_presence` is true. Note that presence
# on tuwunel is very fast unlike Synapse's. If using outgoing presence,
# you MUST enable `allow_local_presence` as well.
# reloadable: yes
#
#allow_outgoing_presence = true

# How many seconds without presence updates before you become idle.
# Defaults to 5 minutes.
#
#presence_idle_timeout_s = 300

# How many seconds without presence updates before you become offline.
# Defaults to 30 minutes.
#
#presence_offline_timeout_s = 1800

# Enable the presence idle timer for remote users.
#
# Disabling is offered as an optimization for servers participating in
# many large rooms or when resources are limited. Disabling it may cause
# incorrect presence states (i.e. stuck online) to be seen for some remote
# users.
#
#presence_timeout_remote_users = true

# Suppresses push notifications for users marked as active. (Experimental)
#
# When enabled, users with `Online` presence and recent activity
# (based on presence state and sync activity) won’t receive push
# notifications, reducing duplicate alerts while they're active
# on another client.
#
# Disabled by default to preserve legacy behavior.
# reloadable: yes
#
#suppress_push_when_active = false

# Allow receiving incoming read receipts from remote servers.
# reloadable: yes
#
#allow_incoming_read_receipts = true

# Allow sending read receipts to remote servers.
# reloadable: yes
#
#allow_outgoing_read_receipts = true

# Allow outgoing typing updates to federation.
# reloadable: yes
#
#allow_outgoing_typing = true

# Allow incoming typing updates from federation.
# reloadable: yes
#
#allow_incoming_typing = true

# Maximum time federation user can indicate typing.
#
# reloadable: yes
#
#typing_federation_timeout_s = 30

# Minimum time local client can indicate typing. This does not override a
# client's request to stop typing. It only enforces a minimum value in
# case of no stop request.
#
# reloadable: yes
#
#typing_client_timeout_min_s = 15

# Maximum time local client can indicate typing.
#
# reloadable: yes
#
#typing_client_timeout_max_s = 45

# Set this to true for tuwunel to compress HTTP response bodies using
# zstd. This option does nothing if tuwunel was not built with
# `zstd_compression` feature. Please be aware that enabling HTTP
# compression may weaken TLS. Most users should not need to enable this.
# See https://breachattack.com/ and https://wikipedia.org/wiki/BREACH
# before deciding to enable this.
#
#zstd_compression = false

# Set this to true for tuwunel to compress HTTP response bodies using
# gzip. This option does nothing if tuwunel was not built with
# `gzip_compression` feature. Please be aware that enabling HTTP
# compression may weaken TLS. Most users should not need to enable this.
# See https://breachattack.com/ and https://wikipedia.org/wiki/BREACH before
# deciding to enable this.
#
# If you are in a large amount of rooms, you may find that enabling this
# is necessary to reduce the significantly large response bodies.
#
#gzip_compression = false

# Set this to true for tuwunel to compress HTTP response bodies using
# brotli. This option does nothing if tuwunel was not built with
# `brotli_compression` feature. Please be aware that enabling HTTP
# compression may weaken TLS. Most users should not need to enable this.
# See https://breachattack.com/ and https://wikipedia.org/wiki/BREACH
# before deciding to enable this.
#
#brotli_compression = false

# Set to true to allow user type "guest" registrations. Some clients like
# Element attempt to register guest users automatically.
# reloadable: yes
#
#allow_guest_registration = false

# Set to true to log guest registrations in the admin room. Note that
# these may be noisy or unnecessary if you're a public homeserver.
# reloadable: yes
#
#log_guest_registrations = false

# Set to true to allow guest registrations/users to auto join any rooms
# specified in `auto_join_rooms`.
# reloadable: yes
#
#allow_guests_auto_join_rooms = false

# Enable the legacy unauthenticated Matrix media repository endpoints.
# These endpoints consist of:
# - /_matrix/media/*/config
# - /_matrix/media/*/upload
# - /_matrix/media/*/preview_url
# - /_matrix/media/*/download/*
# - /_matrix/media/*/thumbnail/*
#
# The authenticated equivalent endpoints are always enabled.
#
# Defaults to false.
#
#allow_legacy_media = false

# Fallback to requesting legacy unauthenticated media from remote servers.
# Unauthenticated media was removed in ~2024Q3; enabling this adds
# considerable federation requests which are unlikely to succeed.
# reloadable: yes
#
#request_legacy_media = false

# This item is undocumented. Please contribute documentation for it.
# reloadable: yes
#
#freeze_legacy_media = true

# Check consistency of the media directory at startup:
# 1. When `media_compat_file_link` is enabled, this check will upgrade
#    media when switching back and forth between Conduit and tuwunel. Both
#    options must be enabled to handle this.
# 2. When media is deleted from the directory, this check will also delete
#    its database entry.
#
# If none of these checks apply to your use cases, and your media
# directory is significantly large setting this to false may reduce
# startup time.
#
#media_startup_check = true

# Enable backward-compatibility with Conduit's media directory by creating
# symlinks of media.
#
# This option is only necessary if you plan on using Conduit again.
# Otherwise setting this to false reduces filesystem clutter and overhead
# for managing these symlinks in the directory. This is now disabled by
# default. You may still return to upstream Conduit but you have to run
# tuwunel at least once with this set to true and allow the
# media_startup_check to take place before shutting down to return to
# Conduit.
#
#media_compat_file_link = false

# Prune missing media from the database as part of the media startup
# checks.
#
# This means if you delete files from the media directory the
# corresponding entries will be removed from the database. This is
# disabled by default because if the media directory is accidentally moved
# or inaccessible, the metadata entries in the database will be lost with
# sadness.
#
#prune_missing_media = false

# List of storage providers to use for media. Providers can be configured
# below in respective sections designated by
# `global.storage_provider.<NAME>.<brand>` where `NAME` can be listed
# here.
#
# For advanced features and future extensions involving multiple providers
# the list may contain multiple entries. You MUST take note of other
# configuration options when listing multiple providers or resource
# duplication costs and poor performance can result.
#
# The list defaults to `["media"]` which is an implicit storage provider
# representing the media directory on the local filesystem. It can be
# altered by configuring `global.storage_provider.media.local` explicitly
# or disabled by omitting it from this list entirely. Users with existing
# deployments are advised to continue listing "media" as a fallback along
# with their new provider.
#
# reloadable: yes
#
#media_storage_providers = ["media"]

# List of configured storage providers where new media will be sent. When
# this list is not explicitly configured all entries in
# `media_storage_providers` are used as default.
#
# This list is important for users passively migrating to a new media
# storage provider by only writing to one while querying the other as a
# fallback.
#
# For example:
#
# `media_storage_providers = ["media", "media_on_s3"]`
# `store_media_on_providers = ["media_on_s3"]`
#
# Entries in this list must also be listed in `media_storage_providers`.
#
# reloadable: yes
#
#store_media_on_providers = []

# Redirect local media downloads to a presigned object-store URL when the
# client sends `allow_redirect=true` (MSC3860). When a configured storage
# provider can presign the object (S3), the download responds with a 307
# to a short-lived URL instead of proxying the bytes. Media held only on
# the local filesystem is always served directly.
#
# reloadable: yes
#
#media_allow_redirect = false

# Vector list of regex patterns of server names that tuwunel will refuse
# to download remote media from.
#
# reloadable: yes
# example: ["badserver\.tld$", "badphrase", "19dollarfortnitecards"]
#
#prevent_media_downloads_from = []

# List of forbidden server names via regex patterns that we will block
# incoming AND outgoing federation with, and block client room joins /
# remote user invites.
#
# This check is applied on the room ID, room alias, sender server name,
# sender user's server name, inbound federation X-Matrix origin, and
# outbound federation handler.
#
# Basically "global" ACLs.
#
# The server's own name is always permitted and is never subject to this
# list.
#
# reloadable: yes
# example: ["badserver\.tld$", "badphrase", "19dollarfortnitecards"]
#
#forbidden_remote_server_names = []

# (EXPERIMENTAL) The behavior of this option will change; the
# _experimental suffix will be removed for that change in an upcoming
# release.
#
# List of allowed server names via regex patterns. This is an allow-list
# rather than a deny-list with all the same details as its counterpart in
# `forbidden_remote_server_names`.
#
# This feature becomes active when this list has one or more entries;
# everything not matching is denied. By default it is empty and inactive.
#
# The server's own name is always permitted and is never subject to this
# list.
#
# Entries in `forbidden_remote_server_names` are still applied after
# this is applied. This allows you to match e.g. "*\.example\.com" here
# while still singling out "bad\.example\.com" for exclusion.
#
# reloadable: yes
# example: ["badserver\.tld$", "badphrase", "19dollarfortnitecards"]
#
#allowed_remote_server_names_experimental = []

# List of forbidden server names via regex patterns that we will block all
# outgoing federated room directory requests for. Useful for preventing
# our users from wandering into bad servers or spaces.
#
# reloadable: yes
# example: ["badserver\.tld$", "badphrase", "19dollarfortnitecards"]
#
#forbidden_remote_room_directory_server_names = []

# Vector list of IPv4 and IPv6 CIDR ranges / subnets *in quotes* that you
# do not want tuwunel to send outbound requests to. Defaults to
# RFC1918, unroutable, loopback, multicast, and testnet addresses for
# security.
#
# Please be aware that this is *not* a guarantee. You should be using a
# firewall with zones as doing this on the application layer may have
# bypasses.
#
# Currently this does not account for proxies in use like Synapse does.
#
# To disable, set this to be an empty vector (`[]`).
#
# Defaults to:
# ["127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12",
# "192.168.0.0/16", "100.64.0.0/10", "192.0.0.0/24", "169.254.0.0/16",
# "192.88.99.0/24", "198.18.0.0/15", "192.0.2.0/24", "198.51.100.0/24",
# "203.0.113.0/24", "224.0.0.0/4", "::1/128", "fe80::/10", "fc00::/7",
# "2001:db8::/32", "ff00::/8", "fec0::/10"]
#
#ip_range_denylist =

# Optional IP address or network interface-name to bind as the source of
# URL preview requests. If not set, it will not bind to a specific
# address or interface.
#
# Interface names only supported on Linux, Android, and Fuchsia platforms;
# all other platforms can specify the IP address. To list the interfaces
# on your system, use the command `ip link show`.
#
# example: `"eth0"` or `"1.2.3.4"`
#
#url_preview_bound_interface =

# Vector list of domains allowed to send requests to for URL previews.
#
# This is a *contains* match, not an explicit match. Putting "google.com"
# will match "https://google.com" and
# "http://mymaliciousdomainexamplegoogle.com" Setting this to "*" will
# allow all URL previews. Please note that this opens up significant
# attack surface to your server, you are expected to be aware of the risks
# by doing so.
#
# reloadable: yes
#
#url_preview_domain_contains_allowlist = []

# Vector list of explicit domains allowed to send requests to for URL
# previews.
#
# This is an *explicit* match, not a contains match. Putting "google.com"
# will match "https://google.com", "http://google.com", but not
# "https://mymaliciousdomainexamplegoogle.com". Setting this to "*" will
# allow all URL previews. Please note that this opens up significant
# attack surface to your server, you are expected to be aware of the risks
# by doing so.
#
# reloadable: yes
#
#url_preview_domain_explicit_allowlist = []

# Vector list of explicit domains not allowed to send requests to for URL
# previews.
#
# This is an *explicit* match, not a contains match. Putting "google.com"
# will match "https://google.com", "http://google.com", but not
# "https://mymaliciousdomainexamplegoogle.com". The denylist is checked
# first before allowlist. Setting this to "*" will not do anything.
#
# reloadable: yes
#
#url_preview_domain_explicit_denylist = []

# Vector list of URLs allowed to send requests to for URL previews.
#
# Note that this is a *contains* match, not an explicit match. Putting
# "google.com" will match "https://google.com/",
# "https://google.com/url?q=https://mymaliciousdomainexample.com", and
# "https://mymaliciousdomainexample.com/hi/google.com" Setting this to "*"
# will allow all URL previews. Please note that this opens up significant
# attack surface to your server, you are expected to be aware of the risks
# by doing so.
#
# reloadable: yes
#
#url_preview_url_contains_allowlist = []

# Maximum body size allowed when spidering a URL for previews. Accepts an
# integer byte count or a string with SI/IEC suffix such as "256 KB".
#
# reloadable: yes
#
#url_preview_max_spider_size = 256000

# Maximum size of a single media item fetched or relayed for a URL
# preview: the og:image measurement fetch and the lazy-media relay.
# Media whose advertised length exceeds this is not registered, and a
# relay that would exceed it is refused. Accepts an integer byte count
# or a string with SI/IEC suffix such as "50 MiB".
#
# reloadable: yes
#
#url_preview_max_media_size = 50 MiB

# Option to decide whether you would like to run the domain allowlist
# checks (contains and explicit) on the root domain or not. Does not apply
# to URL contains allowlist. Defaults to false.
#
# Example usecase: If this is enabled and you have "wikipedia.org" allowed
# in the explicit and/or contains domain allowlist, it will allow all
# subdomains under "wikipedia.org" such as "en.m.wikipedia.org" as the
# root domain is checked and matched. Useful if the domain contains
# allowlist is still too broad for you but you still want to allow all the
# subdomains under a root domain.
# reloadable: yes
#
#url_preview_check_root_domain = false

# User-Agent header the URL preview client sends when fetching pages
# to extract their OpenGraph tags. When unset, the versioned server
# User-Agent is used followed by "preview", e.g. "Tuwunel/1.8.1
# preview".
#
#url_preview_user_agent =

# User-Agent header sent when fetching and relaying URL preview media
# files themselves (og:image, og:video, og:audio, and direct links),
# as opposed to the pages they appear on. When unset, falls back to
# `url_preview_user_agent`, then to the versioned server User-Agent.
#
#url_preview_media_user_agent =

# List of forbidden room aliases and room IDs as strings of regex
# patterns.
#
# Regex can be used or explicit contains matches can be done by just
# specifying the words (see example).
#
# This is checked upon room alias creation, custom room ID creation if
# used, and startup as warnings if any room aliases in your database have
# a forbidden room alias/ID.
#
# reloadable: yes
# example: ["19dollarfortnitecards", "b[4a]droom", "badphrase"]
#
#forbidden_alias_names = []

# List of forbidden username patterns/strings.
#
# Regex can be used or explicit contains matches can be done by just
# specifying the words (see example).
#
# This is checked upon username availability check, registration, and
# startup as warnings if any local users in your database have a forbidden
# username.
#
# reloadable: yes
# example: ["administrator", "b[a4]dusernam[3e]", "badphrase"]
#
#forbidden_usernames = []

# List of server names to deprioritize joining through.
#
# If a client requests a join through one of these servers,
# they will be tried last.
#
# Useful for preventing failed joins due to timeouts
# from a certain homeserver.
#
# reloadable: yes
#
#deprioritize_joins_through_servers = ["matrix\.org"]

# Maximum make_join requests to attempt within each join attempt. Each
# attempt tries a different server, as each server is only tried once;
# though retries can occur when the join request as a whole is retried.
#
# reloadable: yes
#
#max_make_join_attempts_per_join_attempt = 48

# Maximum join attempts to conduct per client join request. Each join
# attempt consists of one or more make_join requests limited above, and a
# single send_join request. This value allows for additional servers to
# act as the join-server prior to reporting the last error back to the
# client, which can be frustrating for users. Therefor the default value
# is greater than one, but less than excessively exceeding the client's
# request timeout, though that may not be avoidable in some cases.
#
# reloadable: yes
#
#max_join_attempts_per_join_request = 3

# Retry failed and incomplete messages to remote servers immediately upon
# startup. This is called bursting. If this is disabled, said messages may
# not be delivered until more messages are queued for that server. Do not
# change this option unless server resources are extremely limited or the
# scale of the server's deployment is huge. Do not disable this unless you
# know what you are doing.
#
#startup_netburst = true

# Messages are dropped and not reattempted. The `startup_netburst` option
# must be enabled for this value to have any effect. Do not change this
# value unless you know what you are doing. Set this value to -1 to
# reattempt every message without trimming the queues; this may consume
# significant disk. Set this value to 0 to drop all messages without any
# attempt at redelivery.
#
#startup_netburst_keep = 50

# Block non-admin local users from sending room invites (local and
# remote), and block non-admin users from receiving remote room invites.
#
# Admins are always allowed to send and receive all room invites.
# reloadable: yes
#
#block_non_admin_invites = false

# Enforce MSC4311 validation of the create event in federated invite and
# knock stripped state. When enabled, an invite whose m.room.create event
# is missing, not a full PDU, bound to a different room, or fails
# signature checks is rejected, and such events are dropped from knock
# stripped state. When disabled (the default), failures are logged but
# tolerated to preserve interoperability during ecosystem migration; a
# create event that is present as a full PDU but cryptographically bound
# to a different room is always rejected for room version 12 and above
# regardless of this setting.
#
# reloadable: yes
#
#enforce_stripped_state_pdu_validation = false

# Allow admins to enter commands in rooms other than "#admins" (admin
# room) by prefixing your message with "\!admin" or "\\!admin" followed up
# a normal tuwunel admin command. The reply will be publicly visible to
# the room, originating from the sender.
#
# reloadable: yes
# example: \\!admin debug ping puppygock.gay
#
#admin_escape_commands = true

# Automatically activate the tuwunel admin room console / CLI on
# startup. This option can also be enabled with `--console` tuwunel
# argument.
#
#admin_console_automatic = false

# List of admin commands to execute on startup.
#
# This option can also be configured with the `--execute` tuwunel
# argument and can take standard shell commands and environment variables
#
# For example: `./tuwunel --execute "server admin-notice tuwunel has
# started up at $(date)"`
#
# example: admin_execute = ["debug ping puppygock.gay", "debug echo hi"]`
#
#admin_execute = []

# Ignore errors in startup commands.
#
# If false, tuwunel will error and fail to start if an admin execute
# command (`--execute` / `admin_execute`) fails.
# reloadable: yes
#
#admin_execute_errors_ignore = false

# List of admin commands to execute on SIGUSR2.
#
# Similar to admin_execute, but these commands are executed when the
# server receives SIGUSR2 on supporting platforms.
#
# reloadable: yes
#
#admin_signal_execute = []

# Controls the max log level for admin command log captures (logs
# generated from running admin commands). Defaults to "info" on release
# builds, else "debug" on debug builds.
#
# reloadable: yes
#
#admin_log_capture = "info"

# The default room tag to apply on the admin room.
#
# On some clients like Element, the room tag "m.server_notice" is a
# special pinned room at the very bottom of your room list. The tuwunel
# admin room can be pinned here so you always have an easy-to-access
# shortcut dedicated to your admin room.
#
# reloadable: yes
#
#admin_room_tag = "m.server_notice"

# The room that user, room, and event reports are posted to, instead of
# the admin room. Accepts a room ID or room alias; the server user must be
# joined with permission to post there. Reports fall back to the admin
# room when this is unset, cannot be resolved, or the server user is not a
# member.
#
# reloadable: yes
#
#report_room = (none)

# Whether to grant the first user to register admin privileges by joining
# them to the admin room. Note that technically the next user to register
# when the admin room is empty (or only contains the server-user) is
# granted, and only when the admin room is enabled.
#
# reloadable: yes
#
#grant_admin_to_first_user = true

# Whether the admin room is created on first startup. Users should not set
# this to false. Developers can set this to false during integration tests
# to reduce activity and output.
#
#create_admin_room = true

# Whether to enable federation on the admin room. This cannot be changed
# after the admin room is created.
#
#federate_admin_room = true

# Sentry.io crash/panic reporting, performance monitoring/metrics, etc.
# This is NOT enabled by default. tuwunel's default Sentry reporting
# endpoint domain is `o4509498990067712.ingest.us.sentry.io`.
#
#sentry = false

# Sentry reporting URL, if a custom one is desired.
#
#sentry_endpoint = ""

# Report your tuwunel server_name in Sentry.io crash reports and
# metrics.
#
#sentry_send_server_name = false

# Performance monitoring/tracing sample rate for Sentry.io.
#
# Note that too high values may impact performance, and can be disabled by
# setting it to 0.0 (0%) This value is read as a percentage to Sentry,
# represented as a decimal. Defaults to 15% of traces (0.15)
#
#sentry_traces_sample_rate = 0.15

# Whether to attach a stacktrace to Sentry reports.
#
#sentry_attach_stacktrace = false

# Send panics to Sentry. This is true by default, but Sentry has to be
# enabled. The global `sentry` config option must be enabled to send any
# data.
#
#sentry_send_panic = true

# Send errors to sentry. This is true by default, but sentry has to be
# enabled. This option is only effective in release-mode; forced to false
# in debug-mode.
#
#sentry_send_error = true

# Controls the tracing log level for Sentry to send things like
# breadcrumbs and transactions
#
#sentry_filter = "info"

# Enable the tokio-console. This option is only relevant to developers.
#
#	For more information, see:
# https://tuwunel.chat/development.html#debugging-with-tokio-console
#
#tokio_console = false

# Arbitrary argument vector for integration testing. Functionality in the
# server is altered or informed for the requirements of integration tests.
# - "smoke" performs a shutdown after startup admin commands rather than
#   hanging on client handling.
#
#test = false

# Indicates the server has started in maintenance mode. Historically
# maintenance mode has been enabled by the command line argument
# `--maintenance` which then sets various configuration items such as
# `listening=false` among others. That is still the case. This option was
# only added as a single source of truth that `--maintenance` mode is
# active.
#
# This option must never be set manually.
#
#maintenance = false

# Controls whether admin room notices like account registrations, password
# changes, account deactivations, room directory publications, etc will be
# sent to the admin room. Update notices and normal admin command
# responses will still be sent.
# reloadable: yes
#
#admin_room_notices = true

# Maximum number of message events an admin command's output may be split
# across as replies in the admin room. Output needing more events than
# this is uploaded to the media repository instead and returned as a text
# file attachment replying to the command. When 1, output which fits in a
# single event is posted as a single reply and anything larger becomes an
# attachment. When 0, output is always posted as an attachment regardless
# of size.
#
# reloadable: yes
#
#admin_output_max_events = 1

# Post admin command output into a thread on the command event rather than
# as replies. Output split across multiple events per
# `admin_output_max_events` is contained in a single thread; attachment
# outputs are posted into the thread as well.
#
# reloadable: yes
#
#admin_output_threads = false

# Save original events before applying redaction to them.
#
# They can be retrieved with `admin debug get-retained-pdu` or MSC2815.
#
# reloadable: yes
#
#save_unredacted_events = true

# Redaction retention period in seconds.
#
# By default the unredacted events are stored for 60 days.
#
# reloadable: yes
#
#redaction_retention_seconds = 5184000

# Allows users with `redact` power level to request unredacted events with
# MSC2815.
#
# Server admins can request unredacted events regardless of the value of
# this option.
#
# reloadable: yes
#
#allow_room_admins_to_request_unredacted_events = true

# Prevents local users from sending redactions.
#
# This check does not apply to server admins.
# reloadable: yes
#
#disable_local_redactions = false

# Serve erased senders' events as pruned copies over federation
# (MSC4025). A requesting server retains the unredacted view only when
# one of its users was joined in the room state at the event; join
# handshakes are not gated.
#
# reloadable: yes
#
#enforce_erasure_over_federation = true

# Enable database pool affinity support. On supporting systems, block
# device queue topologies are detected and the request pool is optimized
# for the hardware; db_pool_workers is determined automatically.
#
#db_pool_affinity = true

# Sets the number of worker threads in the frontend-pool of the database.
# This number should reflect the I/O capabilities of the system,
# such as the queue-depth or the number of simultaneous requests in
# flight. Defaults to 32 times the number of CPU cores.
#
# Note: This value is only used if db_pool_affinity is disabled or not
# detected on the system, otherwise it is determined automatically.
#
#db_pool_workers = 32

# When db_pool_affinity is enabled and detected, the size of any worker
# group will not exceed the determined value. This is necessary when
# thread-pooling approach does not scale to the full capabilities of
# high-end hardware; using detected values without limitation could
# degrade performance.
#
# The value is multiplied by the number of cores which share a device
# queue, since group workers can be scheduled on any of those cores.
#
#db_pool_workers_limit = 64

# Limits the total number of workers across all worker groups. When the
# sum of all groups exceeds this value the worker counts are reduced until
# this constraint is satisfied.
#
# By default this value is only effective on larger systems (e.g. 16+
# cores) where it will tamper the overall thread-count. The thread-pool
# model will never achieve hardware capacity but this value can be raised
# on huge systems if the scheduling overhead is determined to not
# bottleneck and the worker groups are divided too small.
#
#db_pool_max_workers = 2048

# Determines the size of the queues feeding the database's frontend-pool.
# The size of the queue is determined by multiplying this value with the
# number of pool workers. When this queue is full, tokio tasks conducting
# requests will yield until space is available; this is good for
# flow-control by avoiding buffer-bloat, but can inhibit throughput if
# too low.
#
#db_pool_queue_mult = 4

# Sets the initial value for the concurrency of streams. This value simply
# allows overriding the default in the code. The default is 32, which is
# the same as the default in the code. Note this value is itself
# overridden by the computed stream_width_scale, unless that is disabled;
# this value can serve as a fixed-width instead.
#
#stream_width_default = 32

# Scales the stream width starting from a base value detected for the
# specific system. The base value is the database pool worker count
# determined from the hardware queue size (e.g. 32 for SSD or 64 or 128+
# for NVMe). This float allows scaling the width up or down by multiplying
# it (e.g. 1.5, 2.0, etc). The maximum result can be the size of the pool
# queue (see: db_pool_queue_mult) as any larger value will stall the tokio
# task. The value can also be scaled down (e.g. 0.5)  to improve
# responsiveness for many users at the cost of throughput for each.
#
# Setting this value to 0.0 causes the stream width to be fixed at the
# value of stream_width_default. The default scale is 1.0 to match the
# capabilities detected for the system.
#
#stream_width_scale = 1.0

# Sets the initial amplification factor. This controls batch sizes of
# requests made by each pool worker, multiplying the throughput of each
# stream. This value is somewhat abstract from specific hardware
# characteristics and can be significantly larger than any thread count or
# queue size. This is because each database query may require several
# index lookups, thus many database queries in a batch may make progress
# independently while also sharing index and data blocks which may or may
# not be cached. It is worthwhile to submit huge batches to reduce
# complexity. The maximum value is 32768, though sufficient hardware is
# still advised for that.
#
#stream_amplification = 1024

# Number of sender task workers; determines sender parallelism. Default is
# '0' which means the value is determined internally, likely matching the
# number of tokio worker-threads or number of cores, etc. Override by
# setting a non-zero value.
#
#sender_workers = 0

# Enables listener sockets; can be set to false to disable listening. This
# option is intended for developer/diagnostic purposes only.
#
#listening = true

# Enables configuration reload when the server receives SIGUSR1 on
# supporting platforms.
#
# reloadable: yes
#
#config_reload_signal = true

# Sets the `Access-Control-Allow-Origin` header included by this server in
# all responses. A list of multiple values can be specified. The default
# is an empty list. The actual header defaults to `*` upon an empty list.
#
# There is no reason to configure this without specific intent. Incorrect
# values may degrade or disrupt clients.
#
#access_control_allow_origin = []

# Backport state-reset security fixes to all room versions.
#
# This option applies the State Resolution 2.1 mitigation developed during
# project Hydra for room version 12 to all prior State Resolution 2.0 room
# versions (all room versions supported by this server). These mitigations
# increase resilience to state-resets without any new definition of
# correctness; therefor it is safe to set this to true for existing rooms.
#
# Furthermore, state-reset attacks are not consistent as they result in
# rooms without any single consensus, therefor it is unnecessary to set
# this to false to match other servers which set this to false or simply
# lack support; even if replicating the post-reset state suffered by other
# servers is somehow desired.
#
# This option exists for developer and debug use, and as a failsafe in
# lieu of hardcoding it.
# reloadable: yes
#
#hydra_backports = true

# Delete rooms when the last user from this server leaves. This feature is
# experimental and for the purpose of least-surprise is not enabled by
# default but can be enabled for deployments interested in conserving
# space. It may eventually default to true in a future release.
#
# Note that not all pathways which can remove the last local user
# currently invoke this operation, so in some cases you may find the room
# still exists.
#
# reloadable: yes
#
#delete_rooms_after_leave = false

# Limits the number of One Time Keys per device (not per-algorithm). The
# reference implementation maintains 50 OTK's at any given time, therefor
# our default is at least five times that. There is no known reason for an
# administrator to adjust this value; it is provided here rather than
# hardcoding it.
#
# reloadable: yes
#
#one_time_key_limit = 256

# (EXPERIMENTAL) Setting this option to true replaces the list of identity
# providers displayed on a client's login page with a single button "Sign
# in with single sign-on" linking to the URL
# `/_matrix/client/v3/login/sso/redirect`. All configured providers are
# attempted for authorization. All authorizations associate with the same
# Matrix user. NOTE: All authorizations must succeed, as there is no
# reliable way to skip a provider.
#
# This option is disabled by default, allowing the client to list
# configured providers and permitting privacy-conscious users to authorize
# only their choice.
#
# Note that fluffychat always displays a single button anyway. You do not
# need to enable this to use fluffychat; instead we offer a
# default-provider option, see `default` in the provider config section.
# reloadable: yes
#
#single_sso = false

# Setting this option to true replaces the list of identity providers on
# the client's login screen with a single button "Sign in with single
# sign-on" linking to the URL `/_matrix/client/v3/login/sso/redirect`. The
# deployment is expected to intercept this URL with their reverse-proxy to
# provide a custom webpage listing providers; each entry linking or
# redirecting back to one of the configured identity providers at
# /_matrix/client/v3/login/sso/redirect/<client_id>`.
#
# This option defaults to false, allowing the client to generate the list
# of providers or hide all SSO-related options when none configured.
# reloadable: yes
#
#sso_custom_providers_page = false

# From MSC3824:
# > If the client finds oauth_aware_preferred to be true then, assuming it
# > supports that auth type, it should present this as the only
# > login/registration method available to the user.
# reloadable: yes
#
#oidc_aware_preferred = false

# Directory containing appservice yaml registration files.
#
#appservice_dir = ""

# Skip database migration on startup. This option is intended for
# developer debugging and testing only. Never set this option to false
# unless you have been instructed to do so. Setting this option to false
# may cause permanent damage and permanent loss of data.
#
# Any new database migrations will not be applied on startup, and the
# database schema version will not be adjusted. These migrations and
# schema changes may be expected by the current codebase but may not be
# available when this option is set to false.
#
# Setting this option to false will have no effect if no new migrations
# are to be applied. New migrations are applied once during any execution
# where this option is set to true (which is the default).
#
#database_migrations = true

# Open a database whose schema version is newer than this build supports.
#
# A database reporting a higher schema version than this build is normally
# refused, since opening it stamps the schema down to this build's version
# and may permanently lose data written by the newer build. Setting this
# to true overrides that refusal: the database opens, one-time migrations
# run, and the schema is stamped down to this build's version.
#
# It has no effect when the discovered version is at or below this build's
# version, where migrations apply normally either way. It is also not
# needed to import a Conduit database or a fork of conduwuit; those are
# recognized by lineage and open without it.
#
# This option is extremely dangerous and intended for developer debugging
# and testing only. Never set it unless you have been instructed to do so;
# it may cause permanent damage and permanent loss of data.
#
#force_migration = false

# When importing a Conduit database in place, the filesystem path to
# Conduit's media directory. Leave unset to use `<database_path>/media`,
# which is Conduit's own default location.
#
# example: "/var/lib/matrix-conduit/media"
#
#conduit_source_media_path =

# When importing a Conduit database, the sharding depth of Conduit's media
# directory (0 for a flat directory). Must match the importing Conduit's
# `media.directory_structure`; the default matches Conduit's own default
# of `Deep { length = 2, depth = 2 }`.
#
#conduit_media_directory_depth = 2

# When importing a Conduit database, the shard-segment length of Conduit's
# media directory. Paired with `conduit_media_directory_depth`.
#
#conduit_media_directory_length = 2

# When importing a Conduit database whose media lived in an S3 bucket
# rather than on disk, the name of a `[global.storage_provider.<name>]`
# entry to read the source originals from. Leave unset to read from the
# filesystem at `conduit_source_media_path`. Define the named provider
# with Conduit's own S3 credentials and set its `base_path` to Conduit's
# `media.path` prefix; the importer reads each content-addressed object
# using `conduit_media_directory_depth`/`length` for the key sharding.
#
# Scope `media_storage_providers` to your destination provider only (e.g.
# `["media"]`) so the import writes solely there; otherwise media is also
# copied back into the read-only source bucket.
#
# example: "conduit_source"
#
#conduit_source_media_provider =

# Set this to true for excluding unencrypted rooms from the common-rooms
# calculation deciding the receivers of device list updates.
#
# Setting this to true can help performance on very large homeservers,
# but it may not be spec compliant and risky for client expectations.
# reloadable: yes
#
#device_key_update_encrypted_rooms_only = false



#[global.tls]

# Path to a valid TLS certificate file.
#
# example: "/path/to/my/certificate.crt"
#
#certs =

# Path to a valid TLS certificate private key.
#
# example: "/path/to/my/certificate.key"
#
#key =

# Whether to listen and allow for HTTP and HTTPS connections (insecure!)
#
#dual_protocol = false



#[global.well_known]

# The server URL that the client well-known file will serve. This should
# not contain a port, and should just be a valid HTTPS URL.
#
# example: "https://matrix.example.com"
#
#client =

# The server base domain of the URL with a specific port that the server
# well-known file will serve. This should contain a port at the end, and
# should not be a URL.
#
# reloadable: yes
# example: "matrix.example.com:443"
#
#server =

# LiveKit JWT endpoint.
# Required for Element Call / MatrixRTC (MSC4143).
#
# Note: You must also set `client` above to your homeserver URL.
#
# reloadable: yes
#
#livekit_url = ""

# Custom MatrixRTC transports.
#
# If you're looking to setup Element Call / MatrixRTC with Livekit,
# you should not use this option and instead set `livekit_url`.
# This is only required if you want to configure a non-livekit MatrixRTC
# transport. There are no known client implementations that support any
# other transport types.
#
# This option was previously the only way to configure a Livekit
# transport. It has been superseded by `livekit_url`.
#
# Example:
# ```toml
# [global.well_known]
# client = "https://matrix.yourdomain.com"
#
# [[global.well_known.rtc_transports]]
# type = "livekit"
# livekit_service_url = "https://livekit.yourdomain.com"
# ```
#
# reloadable: yes
#
#rtc_transports = []



#[global.well_known.support_policy.<ID>]

# Version string of the policy document.
#
# example: "v6.7"
# reloadable: yes
#
#version =



#[global.well_known.support_policy.<ID>.policy_translation.<LANG>]

# User friendly name of the policy document.
#
# example: "Privacy Policy"
# reloadable: yes
#
#name =

# Link to the test of the policy document. A valid URL must be specified.
#
# example: "https://website.local/privacy-policy"
# reloadable: yes
#
#url =



#[global.registration_terms.<ID>]

# Version of this policy document, presented to the client. Configuring
# any `[global.registration_terms.<ID>]` block makes registration
# require an `m.login.terms` stage listing every such document; the
# `<ID>` is the policy id sent to clients.
#
# example: "1.2"
# reloadable: yes
#
#version =



#[global.registration_terms.<ID>.translations.<LANG>]

# User friendly name of the policy document in this language.
#
# example: "Terms of Service"
# reloadable: yes
#
#name =

# Link to the text of the policy document. Must be a valid http(s) URL.
#
# example: "https://example.org/terms-1.2-en.html"
# reloadable: yes
#
#url =



#[global.well_known.support_contact.<ID>]

# The name of the support role.
#
# example: "m.role.admin"
#
#role =

# The email address for the above support role.
#
# example: "admin@example.com"
#
#email_address =

# The Matrix User ID for the above support role.
#
# example "@admin:example.com"
#
#matrix_id =

# The PGP key (i.e. OpenPGP) that one may use for encrypted communications
# for the above support role. The value must be a URI. Use a web URL
# pointing to the key (for example "https://example.com/key.asc"), an
# OPENPGPKEY DNS record ("dns:..."), or a fingerprint carried with the
# "openpgp4fpr:" scheme. A bare fingerprint without a scheme, or raw
# inlined key material, is rejected at startup.
#
# As this is a spec proposal (MSC4439), the identifier/prefix for this
# field is currently "dev.zirco.msc4439.pgp_key"
#
# example: "openpgp4fpr:8B77919975EAFA5E2456EE03665FE73077489DB0"
#
#pgp_key =



#[global.ldap]

# Whether to enable LDAP login.
#
# reloadable: yes
# example: "true"
#
#enable = false

# URI of the LDAP server.
#
# reloadable: yes
# example: "ldap://ldap.example.com:389"
#
#uri =

# Root of the searches.
#
# reloadable: yes
# example: "ou=users,dc=example,dc=org"
#
#base_dn =

# Bind DN if anonymous search is not enabled.
#
# You can use the variable `{username}` that will be replaced by the
# entered username. In such case, the password used to bind will be the
# one provided for the login and not the one given by
# `bind_password_file`. Beware: automatically granting admin rights will
# not work if you use this direct bind instead of a LDAP search.
#
# reloadable: yes
# example: "cn=ldap-reader,dc=example,dc=org" or
# "cn={username},ou=users,dc=example,dc=org"
#
#bind_dn = ""

# Path to a file on the system that contains the password for the
# `bind_dn`.
#
# The server must be able to access the file, and it must not be empty.
#
# reloadable: yes
#
#bind_password_file = ""

# Search filter to limit user searches.
#
# You can use the variable `{username}` that will be replaced by the
# entered username for more complex filters.
#
# reloadable: yes
# example: "(&(objectClass=person)(memberOf=matrix))"
#
#filter = "(objectClass=*)"

# Attribute to use to uniquely identify the user.
#
# reloadable: yes
# example: "uid" or "cn"
#
#uid_attribute = "uid"

# Attribute containing the distinguished name of the user.
#
# reloadable: yes
# example: "givenName" or "sn"
#
#name_attribute = "givenName"

# Root of the searches for admin users.
#
# Defaults to `base_dn` if empty.
#
# reloadable: yes
# example: "ou=admins,dc=example,dc=org"
#
#admin_base_dn =

# The LDAP search filter to find administrative users for tuwunel.
#
# If left blank, administrative state must be configured manually for each
# user.
#
# You can use the variable `{username}` that will be replaced by the
# entered username for more complex filters.
#
# reloadable: yes
# example: "(objectClass=tuwunelAdmin)" or "(uid={username})"
#
#admin_filter =



#[global.jwt]

# Enable JWT logins
#
# reloadable: yes
#
#enable = false

# Validation key, also called 'secret' in Synapse config. The type of key
# can be configured in 'format', but defaults to the common HMAC which
# is a plaintext shared-secret, so you should keep this value private.
#
# reloadable: yes
#
#key =

# Format of the 'key'. Only HMAC, ECDSA, and B64HMAC are supported
# Binary keys cannot be pasted into this config, so B64HMAC is an
# alternative to HMAC for properly random secret strings.
# - HMAC is a plaintext shared-secret private-key.
# - B64HMAC is a base64-encoded version of HMAC.
# - ECDSA is a PEM-encoded public-key.
# - EDDSA is a PEM-encoded Ed25519 public-key.
#
# reloadable: yes
#
#format = "HMAC"

# Automatically create new user from a valid claim, otherwise access is
# denied for an unknown even with an authentic token.
#
# reloadable: yes
#
#register_user = true

# JWT algorithm
#
# reloadable: yes
#
#algorithm = "HS256"

# Optional audience claim list. The token must claim one or more values
# from this list when set.
#
# reloadable: yes
#
#audience = []

# Optional issuer claim list. The token must claim one or more values
# from this list when set.
#
# reloadable: yes
#
#issuer = []

# Require expiration claim in the token. This defaults to false for
# synapse migration compatibility.
#
# reloadable: yes
#
#require_exp = false

# Require not-before claim in the token. This defaults to false for
# synapse migration compatibility.
#
# reloadable: yes
#
#require_nbf = false

# Validate expiration time of the token when present. Whether or not it is
# required depends on require_exp, but when present this ensures the token
# is not used after a time.
#
# reloadable: yes
#
#validate_exp = true

# Validate not-before time of the token when present. Whether or not it is
# required depends on require_nbf, but when present this ensures the token
# is not used before a time.
#
# reloadable: yes
#
#validate_nbf = true

# Bypass validation for diagnostic/debug use only.
#
# reloadable: yes
#
#validate_signature = true



#[global.smtp]

# Connection URL for the outbound SMTP relay used to send email
# verification messages. Setting this enables the email subsystem;
# without it no mail is sent.
#
# Use a `smtp://` URL for an unencrypted or STARTTLS connection and a
# `smtps://` URL for implicit TLS. Credentials and the host go inline:
# `smtps://user:pass@host:port`. The port defaults per scheme when
# omitted.
#
# The userinfo component is URL-encoded, so an `@` inside the username
# must be written as `%40` (for example a login of `bot@example.com`
# becomes `smtps://bot%40example.com:pass@host:465`). Other reserved
# characters in the username or password are percent-encoded the same
# way.
#
# example: "smtps://user:pass@mail.example.com:465"
#
#connection_uri =

# The mailbox that outbound verification messages are sent from. Accepts
# either a bare address or a display-name form.
#
# example: "Example <noreply@example.com>"
#
#sender =

# Require a verified email address to complete registration. When set,
# the registration flow does not finish until the user proves control of
# an email address.
#
#require_email_for_registration = false

# Require a verified email address when registering with a registration
# token. When set, token-based registration also demands a verified
# email address.
#
#require_email_for_token_registration = false



#[[global.identity_provider]]

# The brand-name of the service (e.g. Apple, Facebook, GitHub, GitLab,
# Google) or the software (e.g. keycloak, MAS) providing the identity.
# When a brand is recognized we apply certain defaults to this config
# for your convenience. For certain brands we apply essential internal
# workarounds specific to that provider; it is important to configure this
# field properly when a provider needs to be recognized (like GitHub for
# example).
#
# Several configured providers can share the same brand name. It is not
# case-sensitive. As a convenience for common simple deployments we can
# identify this provider by brand in addition to the unique `client_id` if
# and only if there is a single provider for the brand; see notes for
# `client_id`.
#
#brand =

# The ID of your OAuth application which the provider generates upon
# registration. This ID then uniquely identifies this configuration
# instance itself, becoming the identity provider's ID and must be unique
# and remain unchanged.
#
# As a convenience we also identify this config by `brand` if and only if
# there is a single provider configured for a `brand`. Note carefully that
# multiple providers configured with the same `brand` is not an error and
# this provider will simply not be found when querying by `brand`.
#
#client_id =

# Secret key the provider generated for you along with the `client_id`
# above. Unlike the `client_id`, the `client_secret` can be changed here
# whenever the provider regenerates one for you.
#
#client_secret =

# Secret key to use, read from the file path specified.
#
# Alternative to `client_secret` for deployments that prefer to keep the
# secret outside the config file. When both are configured `client_secret`
# is used and this field is ignored. The file is read at startup and on
# each OAuth exchange, must exist and must be non-empty; leading and
# trailing whitespace is trimmed. Under systemd the path must be visible
# to the service after sandboxing (`ReadWritePaths` / `ProtectHome`),
# typically by placing the file under `/etc/tuwunel/`.
#
# example: "/etc/tuwunel/.client_secret"
#
#client_secret_file =

# Issuer URL the provider publishes for you. We have pre-supplied default
# values for some of the canonical public providers, making this field
# optional based on the `brand` set above. Otherwise it is required to
# find self-hosted providers. It must be identical to what is configured
# and expected by the provider and must never change because we associate
# identities to it. If the `/.well-known/openid-configuration` is not
# found behind this URL see `base_path` below as a workaround.
#
#issuer_url =

# The callback URL configured when registering the OAuth application with
# the provider. Tuwunel's callback URL must be strictly formatted exactly
# as instructed. The URL host must point directly at the matrix server and
# use the following path:
# `/_matrix/client/unstable/login/sso/callback/<client_id>` where
# `<client_id>` is the same one configured for this provider above.
#
#callback_url =

# When more than one identity_provider has been configured and
# `single_sso` is false and `sso_custom_providers_page` is false this will
# determine the behavior of the `/_matrix/client/v3/login/sso/redirect`
# endpoint (note the url lacks a trailing `client_id`).
#
# When only one identity_provider is configured it will be interpreted
# as the default and this does not need to be set. Otherwise a default
# *must* be selected for some clients (e.g. fluffychat) to work properly
# when the above conditions require it. To operate out-of-the-box we
# default to one configured provider if none are explicitly default; a
# warning will be logged on startup for this condition.
#
# (EXPERIMENTAL) Multiple providers can be set to default. All providers
# configured with this option set to `true` will associate with the same
# Matrix account when a client flows through
# `/_matrix/client/v3/login/sso/redirect`.
#
# When a user authorizes any provider configured default, the flow will
# include all other providers configured default as well for association.
# NOTE: authorization must succeed for ALL default providers.
#
#default = false

# Optional display-name for this provider instance seen on the login page
# by users. It defaults to `brand`. When configuring multiple providers
# using the same `brand` this can be set to distinguish them.
#
#name =

# Optional icon for the provider. The canonical providers have a default
# icon based on the `brand` supplied above when this is not supplied. Note
# that it uses an MXC url which is curious in the auth-media era and may
# not be reliable.
#
#icon =

# Optional list of scopes to authorize. An empty array does not impose any
# restrictions from here, effectively defaulting to all scopes you
# configured for the OAuth application at the provider. This setting
# allows for restricting to a subset of those scopes for this instance.
# Note the user can further restrict scopes during their authorization.
#
#scope = []

# Optional list of userinfo claims which shape and restrict the way we
# compute a Matrix UserId for new registrations. Reviewing Tuwunel's
# documentation will be necessary for a complete description in detail. An
# empty array imposes no restriction here, avoiding generated fallbacks as
# much as possible.
#
# For simplicity we reserve a claim called "unique" which can be listed
# alone to ensure *only* generated ID's are used for registrations.
#
# Note that listing the claim "sub" has special significance and will take
# precedence over all other claims, listed or unlisted. "sub" is not
# normally used to determine a UserId unless explicitly listed here.
#
# As of now arbitrary claims cannot be listed here, we only recognize
# specific hard-coded claims.
#
#userid_claims = []

# Trusted providers can cause username conflicts (i.e. account hijacking)
# but this is precisely how an existing matrix account can be associated
# with a provider. When this option is set to true, the way we compute a
# Matrix UserId from userinfo claims is inverted: we find the first
# matching user and grant access to it. Whereas by default, when set to
# false, we skip matching users and register the first available username;
# falling-back to random characters to avoid conflicts.
#
# Only set this option to true for providers you self-host and control.
# Never set this option to true for the public providers such as GitHub,
# GitLab, etc.
#
# Note that associating an existing user with an untrusted provider is
# still possible but only with the command '!admin query oauth associate'.
#
#trusted = false

# Setting this option to false will inhibit unique ID's from being
# generated as a last-resort when determining a UserId from a provider's
# claims. In the case of untrusted providers, when all provided claims
# conflict with existing user accounts, a unique fallback ID needs
# to be generated for registration to not be denied with an error.
#
# Set this option to false if you operate a private server or a trusted
# identity provider where random UserId's are undesirable; the result of a
# misconfiguration or other issue where an error is warranted.
#
# This option should be set to true for public servers or some users may
# never be able to register.
#
#unique_id_fallbacks = true

# Controls whether new user registration is possible from this provider.
# When this option is set to false, authorizations from this provider
# only affect existing users and will never result in a new registration
# when the claims fail to match any existing user (in the case of trusted
# providers) or an available username is found (in the case of untrusted
# providers).
#
# When LDAP is enabled, a user found in the LDAP directory counts as an
# existing user and is still provisioned on first login, since the
# directory is the authoritative account store.
#
# Setting this option to false is generally not useful unless there is
# an explicit reason to do so.
#
#registration = true

# Optional extra path components after the issuer_url leading to the
# location of the `.well-known` directory used for discovery. If the path
# starts with a slash it will be treated as absolute, meaning overwriting
# any path in the issuer_url. The path needs to end with a slash. This
# will be empty for specification-compliant providers.
#
#base_path =

# Overrides the `.well-known` location where the provider's openid
# configuration is found. It is very unlikely you will need to set this;
# available for developers or special purposes only.
#
#discovery_url =

# Overrides the authorize URL requested during the grant phase. This is
# generally discovered or derived automatically, but may be required as a
# workaround for any non-standard or undiscoverable provider.
#
#authorization_url =

# Overrides the access token URL; the same caveats apply as with the other
# URL overrides.
#
#token_url =

# Overrides the revocation URL; the same caveats apply as with the other
# URL overrides.
#
#revocation_url =

# Overrides the introspection URL; the same caveats apply as with the
# other URL overrides.
#
#introspection_url =

# Overrides the userinfo URL; the same caveats apply as with the other URL
# overrides.
#
#userinfo_url =

# Whether to perform discovery and adjust this provider's configuration
# accordingly. This defaults to true. When true, it is an error when
# discovery fails and authorizations will not be attempted to the
# provider.
#
#discovery = true

# The duration in seconds before a grant authorization session expires.
#
#grant_session_duration = 300

# Whether to check the redirect cookie during the callback. This is a
# security feature and should remain enabled. This is available for
# developers or deployments which cannot tolerate cookies and are willing
# to tolerate the risks.
#
#check_cookie = true

# Extra query parameters appended to every authorization request sent to
# the identity provider.
#
# E.g. to force re-authentication even if IdP cookies are present:
# ```toml
# [[global.identity_provider]]
# extra_authorization_parameters = { prompt = "login" }
# ```
#
#extra_authorization_parameters = {}

# Forward the MSC3824 `action` query parameter from the SSO redirect
# endpoints to this provider as an OpenID Connect `prompt` value.
#
# When a client appends `action=register` to a `/login/sso/redirect`
# request the upstream authorization request carries `prompt=create`
# (the OpenID Connect "Initiating User Registration" extension) so the
# provider can present its registration screen. `action=login` is left
# unforwarded to avoid forcing a re-authentication, and a `prompt` set in
# `extra_authorization_parameters` still applies in that case. An
# action-derived `prompt` takes precedence over one configured there.
#
# Leave this disabled unless the provider supports the `prompt=create`
# registration extension; a provider that does not may reject or ignore
# the request.
#
#forward_action_prompt = false



#[global.storage_provider.<ID>.local]

# Absolute path to this local filesystem storage provider. Technically the
# provider exists at the filesystem root, and the base_path is prefixed to
# all objects.
#
#base_path =

# Creates the directory on the local filesystem if missing. This is not
# recommended to prevent misconfigured environments and missing mounts
# from silently succeeding.
#
#create_if_missing = false

# Toggles the preservation of a directory after its last file contents are
# removed.
#
#delete_empty_directories = true

# Enables checks performed at startup determining the usability of the
# local directory. Failures will abort the server's startup.
#
#startup_check = true



#[global.storage_provider.<ID>.s3]

# Supply an s3 URL e.g. "s3://bucket/path". These URLs may contain one
# or all of `bucket`, `region`, and `path` . When not supplied, such
# additional items can be supplied below individually.
#
#url =

# The name of the S3 bucket. e.g. "bucketname-123456789-us-west-2-an".
#
#bucket =

# The region of the S3 bucket. e.g. "us-west-2".
#
#region = "us-east-1"

# Your amazon IAM Key ID with access granted to this bucket.
# e.g. "ABCDEFG1X1ZZYYXXWWVV"
#
#key =

# The secret key component which is approx 40 characters of base64.
#
#secret =

# Optional path prefix within the bucket where all our operations will
# take place.
#
#base_path =

# (expert use) Override the location of s3 applied after components of the
# parsed `url` (or when none set).
#
#endpoint =

# (expert use) Override this property useful for some self-hosted
# environments. By default it is derived when parsing the primary `url`.
#
#use_vhost_request = false

# (expert use) Alternative session-token authentication method.
#
#token =

# (expert use) Associated SSE-KMS key material.
#
#kms =

# (expert use) When configured for the bucket it should be reflected here.
#
#use_bucket_key =

# (expert use) Threshold size for switching to Multi-part uploads. This is
# a quirk of the S3 protocol which requires us to use a different approach
# for "large" uploads. This value determines what a "large" upload is. The
# default value should be sufficient for most providers. The value is a
# parsed string allowing SI or IEC units for convenience.
#
#multipart_threshold = 100 MiB

# (expert use) Size of each individual part within a Multi-part upload.
# Once an upload exceeds `multipart_threshold` the payload is split into
# parts of this size, each sent as a separate HTTP PUT. Smaller values
# keep individual requests under per-request timeouts on slow uplinks at
# the cost of more round-trips. S3 requires every part except the last
# to be at least 5 MiB. The value is a parsed string allowing SI or IEC
# units for convenience.
#
#multipart_part_size = 10 MiB

# (developer use) Allows relaxing default requirement forcing HTTPS.
#
#use_https = true

# (developer_use) Allows skipping request header signatures (will be
# reejected by AWS).
#
#use_signatures = true

# (developer_use) Allows disabling request payload signatures.
#
#use_payload_signatures = true

# (developer use) Enables checks performed at startup such as pinging the
# provider. Failures are considered critical startup errors which abort
# startup. When set to false, faulty providers are only discovered with
# first use and will not be fatal errors.
#
# Only set this to false if you expect a provider to be down at startup or
# for development/testing purposes; checks are disabled when the server
# is started in '--maintenance' mode.
#
#startup_check = true



#[global.appservice.<ID>]

# The URL for the application service.
#
# Optionally set to `null` if no traffic is required.
#
#url =

# A unique token for application services to use to authenticate requests
# to Homeservers.
#
#as_token =

# A unique token for Homeservers to use to authenticate requests to
# application services.
#
#hs_token =

# The localpart of the user associated with the application service.
#
#sender_localpart =

# Whether requests from masqueraded users are rate-limited.
#
# The sender is excluded.
#
#rate_limited = false

# The external protocols which the application service provides (e.g.
# IRC).
#
#protocols = []

# Whether the application service wants to receive ephemeral data.
#
#receive_ephemeral = false

# Whether the application service wants to do device management, as part
# of MSC4190.
#
#device_management = false

# Whether the application service wants MSC3202 transaction extensions
# (device lists, one-time-key counts, and unused fallback key types).
#
# The registration-file key is `org.matrix.msc3202`; this inline-config
# key is `msc3202_transaction_extensions`.
#
#msc3202_transaction_extensions = false



#[[global.appservice.<ID>.<users|rooms|aliases>]]

# Whether this application service has exclusive access to events within
# this namespace.
#
#exclusive = false

# A regular expression defining which values this namespace includes.
#
#regex =