58 lines
1.6 KiB
Text
58 lines
1.6 KiB
Text
matrix authentication service needs to generate its own config wich also gens the keys it uses
|
|
|
|
this will generate it in your current directory
|
|
use the key it generated and put it in homeserver.yaml
|
|
|
|
podman run --rm \
|
|
ghcr.io/element-hq/matrix-authentication-service:latest \
|
|
config generate > config.yaml
|
|
|
|
you can use the same postgres database as synapse i reccomend making another user and another table and make mas use that
|
|
|
|
database is added like this
|
|
|
|
database:
|
|
uri: matrix-postgres://{YOUR DATABASE USER}:{YOUR DATABASE PASSWORD}@matrix-postgres:5432/mas
|
|
max_connections: 10
|
|
min_connections: 0
|
|
connect_timeout: 30
|
|
idle_timeout: 600
|
|
max_lifetime: 1800
|
|
|
|
other useful configs include
|
|
|
|
passwords:
|
|
enabled: false
|
|
schemes:
|
|
- version: 1
|
|
algorithm: argon2id
|
|
minimum_complexity: 3
|
|
matrix:
|
|
kind: synapse
|
|
homeserver: {YOURDOMAIN.COM}
|
|
secret: this gets generated by the container
|
|
endpoint: http://matrix-synapse:8008/
|
|
|
|
the ID needs to be a valid ULID wich is also put in the authentik redirect URI like so
|
|
|
|
https://mas.{YOURDOMAIN}/upstream/callback/{YOUR ULID}
|
|
|
|
upstream_oauth2:
|
|
providers:
|
|
- id: "{YOUR ULID}"
|
|
human_name: Authentik
|
|
issuer:
|
|
client_id:
|
|
client_secret:
|
|
token_endpoint_auth_method: client_secret_basic
|
|
scope: "openid profile email"
|
|
claims_imports:
|
|
localpart:
|
|
action: require
|
|
template: "{{ user.preferred_username | lower}}" # enforces lowercase because it does NOT like caps
|
|
displayname:
|
|
action: suggest
|
|
template: "{{ user.name }}"
|
|
email:
|
|
action: suggest
|
|
template: "{{ user.email }}"
|