jason.woltje
2698ddb7b5
Co-authored-by: jason.woltje <jason@diversecanvas.com> Co-committed-by: jason.woltje <jason@diversecanvas.com>
54 lines
2.8 KiB
Markdown
54 lines
2.8 KiB
Markdown
# infra/matrix — DEV Synapse for RFC-001 P1 (presence)
|
|
|
|
> **DEV-ONLY. LOCAL SANDBOX.** This stack is for local presence validation. It
|
|
> must **never** be pointed at, or run alongside, a live/production homeserver.
|
|
> It is single-instance, federation-OFF, self-signed TLS — the smallest slice
|
|
> RFC-002 §9 says P1 needs (Mode B single-domain, no federation, no IP-only, no
|
|
> secret-rotation story).
|
|
|
|
## What this is
|
|
|
|
A single Synapse homeserver rendered from committed **templates** (no hardcoded
|
|
topology — RFC-002 G2). Every topology fact is an environment variable with a
|
|
dev default:
|
|
|
|
| Var | Default | Meaning |
|
|
| -------------------- | ------------------ | --------------------------------------------------- |
|
|
| `MATRIX_SERVER_NAME` | `matrix.localhost` | Synapse `server_name` (the `:suffix` of every MXID) |
|
|
| `MOSAIC_AS_ID` | `mosaic-as` | appservice id / registration filename |
|
|
| `MATRIX_HTTP_PORT` | `18008` | host port → Synapse 8008 (plain HTTP) |
|
|
| `MATRIX_TLS_PORT` | `18448` | host port → Synapse 8448 (self-signed TLS) |
|
|
|
|
Secrets (`as_token`, `hs_token`, Synapse macaroon/form/registration secrets)
|
|
are **throwaway values generated at bring-up** into `.data/dev-secrets.env`
|
|
(gitignored). In production these are crown-jewel secrets held by the
|
|
SecretBackend (RFC-001 §8 / RFC-002 §4) — never committed.
|
|
|
|
## Files
|
|
|
|
- `docker-compose.dev.yml` — Synapse (+ optional Element under `--profile element`).
|
|
- `synapse/homeserver.dev.yaml.tpl` — rendered Synapse config (Mode B, `enable_registration: false`, appservice wired, native TLS).
|
|
- `synapse/log.config` — Synapse logging.
|
|
- `appservice/mosaic-as.dev.yaml.tpl` — minimal AS registration (declares the `@agent-*` user namespace).
|
|
- `dev-up.sh` / `dev-down.sh` — bring up / tear down (`--purge` wipes `.data`).
|
|
- `.data/` — **gitignored** runtime state (rendered config, sqlite db, signing key, self-signed certs, dev secrets).
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
./dev-up.sh # render config, gen signing key + TLS cert, boot Synapse
|
|
# ... run the validation harness (tools/matrix-presence-harness/run.sh) ...
|
|
./dev-down.sh # stop, keep .data
|
|
./dev-down.sh --purge # stop and wipe .data for a pristine next boot
|
|
|
|
# optional human view (A4) — Element pointed at the dev server:
|
|
docker compose -f docker-compose.dev.yml --profile element up -d element
|
|
# -> http://127.0.0.1:18080
|
|
```
|
|
|
|
## Acceptance evidence (A1)
|
|
|
|
- TLS (self-signed) reachable: `curl -sk https://127.0.0.1:18448/_matrix/client/versions` → `200`.
|
|
- Open registration OFF: `POST /_matrix/client/v3/register` → `M_FORBIDDEN "Registration has been disabled"`.
|
|
- AS-token registration bypasses the flag by design (that is how agents are provisioned).
|