# ============================================================================
# homeserver.dev.yaml.tpl — Synapse DEV homeserver config (RFC-002 Mode B)
# ============================================================================
#
#   *** DEV-ONLY. NOT FOR PRODUCTION. ***
#
# This is the RFC-001 P1 (presence) single-instance homeserver. It is
# RFC-002 "Mode B — single-domain" (server_name == homeserver host), with
# federation OFF (standalone), which is all P1 needs (RFC-002 §9 P1 row).
#
# NOTHING here is a production value. Every topology fact is a variable
# rendered by dev-up.sh from the environment; there is no baked-in fleet
# domain (RFC-002 G2 "zero hardcoded topology"). The secrets below are
# throwaway DEV placeholders rendered at bring-up — never reuse them.
#
# Rendered by:  infra/matrix/dev-up.sh   (envsubst -> .data/homeserver.yaml)
# Variables:    MATRIX_SERVER_NAME, MOSAIC_AS_ID (+ dev secrets)
# ----------------------------------------------------------------------------

server_name: "${MATRIX_SERVER_NAME}"
pid_file: /data/homeserver.pid
report_stats: false
suppress_key_server_warning: true

# --- Listeners -------------------------------------------------------------
# 8008: plain HTTP (client + federation) for in-container/local tooling.
# 8448: TLS (self-signed in DEV) — satisfies A1 "reachable over TLS".
listeners:
  - port: 8008
    type: http
    tls: false
    bind_addresses: ['0.0.0.0']
    x_forwarded: true
    resources:
      - names: [client, federation]
        compress: false

  - port: 8448
    type: http
    tls: true
    bind_addresses: ['0.0.0.0']
    resources:
      - names: [client, federation]
        compress: false

# --- DEV TLS (self-signed; generated by dev-up.sh) -------------------------
tls_certificate_path: "/data/dev-cert.pem"
tls_private_key_path: "/data/dev-key.pem"

# --- Store: sqlite is the simplest dev store (RFC-002 §1 allows it) --------
database:
  name: sqlite3
  args:
    database: /data/homeserver.db

log_config: "/data/log.config"
media_store_path: /data/media_store
signing_key_path: "/data/${MATRIX_SERVER_NAME}.signing.key"

# --- Hardening (RFC-001 §8 / RFC-002 §8.5), rendered so a dev gets it ------
# Registration is OFF: agents come ONLY via the appservice (A1). AS user
# registration bypasses this flag, which is exactly the design.
enable_registration: false
enable_registration_without_verification: false
registration_shared_secret: "${SYNAPSE_REG_SHARED_SECRET}"
macaroon_secret_key: "${SYNAPSE_MACAROON_SECRET}"
form_secret: "${SYNAPSE_FORM_SECRET}"

# Presence EDUs ON so Element shows the native dot for humans (RFC-001 §4.5);
# the AUTHORITATIVE liveness is still the mosaic.presence heartbeat.
presence:
  enabled: true

# --- Federation: OFF for P1 (standalone). Empty whitelist = federate with
# nobody (RFC-002 §2.4 / NG5). No public-network federation. ----------------
federation_domain_whitelist: []
trusted_key_servers: []

# --- Appservice registration wired in (A1). The file is rendered next to
# this one by dev-up.sh. -----------------------------------------------------
app_service_config_files:
  - "/data/${MOSAIC_AS_ID}.yaml"

# Keep default rate-limiting ON (RFC-001 §8). No overrides here.