From 1918cce63fce7ef4ec281922eca6faed0a0daf62 Mon Sep 17 00:00:00 2001
From: topterrorist <topterrorist@terrorist.academy>
Date: Sat, 3 Oct 2026 11:29:44 +0200
Subject: [PATCH] matrix/configs/matrix-authentication-service README bijwerken

---
 .../matrix-authentication-service README      | 59 ++++++++++++++++++-
 1 file changed, 58 insertions(+), 1 deletion(-)

diff --git a/matrix/configs/matrix-authentication-service README b/matrix/configs/matrix-authentication-service README
index a993179..d8de389 100644
--- a/matrix/configs/matrix-authentication-service README	
+++ b/matrix/configs/matrix-authentication-service README	
@@ -1 +1,58 @@
-matrix mad
\ No newline at end of file
+matrix authentication service needs to generate its own config wich also gens the keys it uses
+
+this will generate it in your current directory
+use the key it generated and put it in homeserver.yaml
+
+podman run --rm \
+  ghcr.io/element-hq/matrix-authentication-service:latest \
+  config generate > config.yaml
+
+you can use the same postgres database as synapse i reccomend making another user and another table and make mas use that
+
+database is added like this
+
+database:
+  uri: matrix-postgres://{YOUR DATABASE USER}:{YOUR DATABASE PASSWORD}@matrix-postgres:5432/mas
+  max_connections: 10
+  min_connections: 0
+  connect_timeout: 30
+  idle_timeout: 600
+  max_lifetime: 1800
+
+other useful configs include
+
+passwords:
+  enabled: false
+  schemes:
+  - version: 1
+    algorithm: argon2id
+  minimum_complexity: 3
+matrix:
+  kind: synapse
+  homeserver: {YOURDOMAIN.COM}
+  secret: this gets generated by the container
+  endpoint: http://matrix-synapse:8008/
+
+the ID needs to be a valid ULID wich is also put in the authentik redirect URI like so
+
+https://mas.{YOURDOMAIN}/upstream/callback/{YOUR ULID}
+
+upstream_oauth2:
+  providers:
+    - id: "{YOUR ULID}"
+      human_name: Authentik
+      issuer: 
+      client_id: 
+      client_secret: 
+      token_endpoint_auth_method: client_secret_basic
+      scope: "openid profile email"
+      claims_imports:
+        localpart:
+          action: require
+          template: "{{ user.preferred_username | lower}}" # enforces lowercase because it does NOT like caps
+        displayname:
+          action: suggest
+          template: "{{ user.name }}"
+        email:
+          action: suggest
+          template: "{{ user.email }}"