matrix authentication service needs to generate its own config wich also gens the keys it uses

this will generate it in your current directory
use the key it generated and put it in homeserver.yaml

podman run --rm \
  ghcr.io/element-hq/matrix-authentication-service:latest \
  config generate > config.yaml

you can use the same postgres database as synapse i reccomend making another user and another table and make mas use that

database is added like this

database:
  uri: matrix-postgres://{YOUR DATABASE USER}:{YOUR DATABASE PASSWORD}@matrix-postgres:5432/mas
  max_connections: 10
  min_connections: 0
  connect_timeout: 30
  idle_timeout: 600
  max_lifetime: 1800

other useful configs include

passwords:
  enabled: false
  schemes:
  - version: 1
    algorithm: argon2id
  minimum_complexity: 3
matrix:
  kind: synapse
  homeserver: {YOURDOMAIN.COM}
  secret: this gets generated by the container
  endpoint: http://matrix-synapse:8008/

the ID needs to be a valid ULID wich is also put in the authentik redirect URI like so

https://mas.{YOURDOMAIN}/upstream/callback/{YOUR ULID}

upstream_oauth2:
  providers:
    - id: "{YOUR ULID}"
      human_name: Authentik
      issuer: 
      client_id: 
      client_secret: 
      token_endpoint_auth_method: client_secret_basic
      scope: "openid profile email"
      claims_imports:
        localpart:
          action: require
          template: "{{ user.preferred_username | lower}}" # enforces lowercase because it does NOT like caps
        displayname:
          action: suggest
          template: "{{ user.name }}"
        email:
          action: suggest
          template: "{{ user.email }}"