Remove extra docker-compose and .env.exmple files.

docker/matrix/synapse/homeserver.yaml

@@ -1,27 +1,31 @@
 # ==============================================
-# Synapse Homeserver Configuration — Development Only
+# Synapse Homeserver Configuration — Production
 # ==============================================
 #
-# This config is for LOCAL DEVELOPMENT with the Mosaic Stack docker-compose overlay.
-# Do NOT use this in production. See docker-compose.sample.matrix.yml for production.
+# Deploy to /opt/mosaic/synapse/homeserver.yaml on the Docker host.
 #
-# Server name is set to 'localhost' — this is permanent and cannot be changed
-# after the database has been initialized.
+# IMPORTANT: server_name is PERMANENT. It becomes part of every user ID
+# (@user:server_name) and room alias. It cannot be changed after the
+# database has been initialized without losing all data.
+#
+# Before first deploy, replace ALL placeholders marked REPLACE_*.
 #
 # ==============================================
 
-server_name: "localhost"
+# REPLACE with your Matrix domain (e.g. matrix.mosaicstack.dev)
+# This is permanent — cannot be changed after first startup.
+server_name: "REPLACE_MATRIX_DOMAIN"
 pid_file: /data/homeserver.pid
-public_baseurl: "http://localhost:8008/"
+public_baseurl: "https://REPLACE_MATRIX_DOMAIN/"
 
 # ======================
 # Network Listeners
 # ======================
 listeners:
-  # Client API (used by Element Web, Mosaic bridge, etc.)
   - port: 8008
     tls: false
     type: http
+    # Traefik terminates TLS and forwards via X-Forwarded-For
     x_forwarded: true
     bind_addresses: ["0.0.0.0"]
     resources:
@@ -35,9 +39,11 @@ database:
   name: psycopg2
   txn_limit: 10000
   args:
-    user: "synapse"
-    password: "synapse_dev_password"
-    database: "synapse"
+    # Must match SYNAPSE_POSTGRES_USER / SYNAPSE_POSTGRES_PASSWORD
+    # from your Portainer environment variables
+    user: "REPLACE_SYNAPSE_DB_USER"
+    password: "REPLACE_SYNAPSE_DB_PASSWORD"
+    database: "REPLACE_SYNAPSE_DB_NAME"
     host: "postgres"
     port: 5432
     cp_min: 5
@@ -66,20 +72,25 @@ url_preview_ip_range_blacklist:
   - "fec0::/10"
 
 # ======================
-# Registration (Dev Only)
+# Registration
 # ======================
-enable_registration: true
-enable_registration_without_verification: true
+# Public registration disabled. Create accounts via the admin API or CLI:
+#   docker exec -it <container> register_new_matrix_user \
+#     -u username -c /data/homeserver.yaml http://localhost:8008
+enable_registration: false
 
 # ======================
 # Signing Keys
 # ======================
-# Auto-generated on first startup and persisted in the signing_key volume
-signing_key_path: "/data/keys/localhost.signing.key"
+# Auto-generated on first startup and persisted in /opt/mosaic/synapse/keys/
+signing_key_path: "/data/keys/signing.key"
 
-# Suppress warning about trusted key servers in dev
-suppress_key_server_warning: true
-trusted_key_servers: []
+# ======================
+# Trusted Key Servers
+# ======================
+# matrix.org is the default. Set to [] to disable federation key trust.
+trusted_key_servers:
+  - server_name: "matrix.org"
 
 # ======================
 # Room Configuration
@@ -88,44 +99,46 @@ enable_room_list_search: true
 allow_public_rooms_over_federation: false
 
 # ======================
-# Rate Limiting (Relaxed for Dev)
+# Rate Limiting
 # ======================
 rc_message:
-  per_second: 100
-  burst_count: 200
-
-rc_registration:
   per_second: 10
   burst_count: 50
 
+rc_registration:
+  per_second: 1
+  burst_count: 5
+
 rc_login:
   address:
-    per_second: 10
-    burst_count: 50
+    per_second: 3
+    burst_count: 10
   account:
-    per_second: 10
-    burst_count: 50
+    per_second: 3
+    burst_count: 10
 
 # ======================
 # Logging
 # ======================
-log_config: "/data/localhost.log.config"
-
-# Inline log config — write to stdout for docker logs
-# Synapse falls back to a basic console logger if the log_config file is missing,
-# so we leave log_config pointing to a non-existent file intentionally.
-# Override: mount a custom log config file at /data/localhost.log.config
+# Synapse falls back to a basic console logger (stdout) when this file
+# does not exist, which is ideal for Docker log collection.
+log_config: "/data/log.config"
 
 # ======================
-# Miscellaneous
+# Secrets
 # ======================
+# Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'
 report_stats: false
-macaroon_secret_key: "dev-macaroon-secret-change-in-production"
-form_secret: "dev-form-secret-change-in-production"
+macaroon_secret_key: "REPLACE_MACAROON_SECRET"
+form_secret: "REPLACE_FORM_SECRET"
 
-# Enable presence for dev
+# ======================
+# Presence & Retention
+# ======================
 use_presence: true
 
-# Retention policy (optional, keep messages for 180 days in dev)
 retention:
-  enabled: false
+  enabled: true
+  default_policy:
+    min_lifetime: 1d
+    max_lifetime: 365d