Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nixos/matrix-synapse: correct trusted_third_party_id_servers default #59880

Merged
merged 1 commit into from Apr 21, 2019

Conversation

florianjacob
Copy link
Contributor

Motivation for this change

the servers are equivalent and synchronized, but Riot defaults to use vector.im which leads to a nondescribing 401 error message when registering third party identifiers.
This adjusts the NixOS default to the upstream default:
https://github.com/matrix-org/synapse/blob/v0.99.3/docs/sample_config.yaml#L701

I think we should backport this to 19.03 for out of the box compatibility between a NixOS synapse installation and Riot, and as both servers are run by the same operators and contain the same data, I would consider this backward-compatible.

Maintainers: @Ralith @roblabla @Ekleog @pacien

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@florianjacob
Copy link
Contributor Author

@GrahamcOfBorg test matrix-synapse

@pacien
Copy link
Contributor

pacien commented Apr 19, 2019

I don't really like the idea of having servers phoning home and relying on those central 3pid servers by default.
We should perhaps list those values as examples instead of default ones, if we don't mind not matching the upstream default configuration.

@Ekleog
Copy link
Member

Ekleog commented Apr 21, 2019

Thank you! Merged, as it is an improvement over current status.

@pacien I kind of agree with you that I don't want my server phoning home either, but I think currently nixpkgs mostly errs on the side of sticking close to upstream default configuration, as embodied by nginx's recommended*Settings for instance.

Now, if you open an RFC to change this state of affairs for a defined number of cases (said RFC should, I think, say when it's acceptable to diverge from upstream defaults -- insecurity, telemetry, lack of privacy, default config improvements, etc…), I'll likely support you in this endeavor :)

@Ekleog Ekleog merged commit 451961e into NixOS:master Apr 21, 2019
@florianjacob florianjacob deleted the matrix-synapse-identity-servers branch April 22, 2019 15:24
@florianjacob
Copy link
Contributor Author

@Ekleog thanks! 🍻

@pacien without identity servers, you can't register e-mail addresses, even if they're just for password reset links, so in case we decide to deviate from the default, we should pair that with defaulting to host our own identity server. Probably mxisd, not sure how much sense it makes to self-host sydent if it doesn't federate.

While I agree with you in general, I think there is stuff with more impact, especially integration managers, which are used much more often, a gateway to self-host bots and bridges, and are a centralized service as well. As soon as we have a module for dimensions, we can start to think about deviating from the default integrations service to a self-hosted one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants