# Warp homeserver configuration.
#
# Copy to warp.yaml and edit. Every field below is optional except
# global.server_name; the values shown are the defaults.
#
# Any field can also be set from the environment, which wins over this
# file. The variable name is on the right of each line below, e.g.
#   WARP_SERVER_NAME=warp.example WARP_FEDERATION_ENABLED=true warp serve
# List values are comma-separated; a single "-" clears a list.

version: 1

global:
  # The Matrix server name. It appears in every user, room and event ID
  # and CANNOT be changed after the first event is written.    WARP_SERVER_NAME
  server_name: warp.example

  # ed25519 signing key, created by `warp generate-keys`.       WARP_PRIVATE_KEY
  private_key: ./keys/signing.key

  well_known:
    # Advertised to clients as m.homeserver.base_url.
    # Defaults to https://<server_name>.   WARP_WELL_KNOWN_CLIENT_BASE_URL
    client_base_url: ""

    # Optional identity server.  WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL
    identity_server_base_url: ""

    # Advertised to other homeservers as m.server, e.g. "warp.example:8448".
    # Only served while federation is enabled; empty means other servers
    # fall back to SRV/A resolution.    WARP_WELL_KNOWN_SERVER_ADDRESS
    server_address: ""

listen:
  address: ":8008"              # WARP_LISTEN_ADDRESS
  read_header_timeout: 10s      # WARP_READ_HEADER_TIMEOUT
  read_timeout: 60s             # WARP_READ_TIMEOUT
  write_timeout: 120s           # WARP_WRITE_TIMEOUT
  idle_timeout: 120s            # WARP_IDLE_TIMEOUT
  max_header_bytes: 1048576     # WARP_MAX_HEADER_BYTES
  shutdown_timeout: 30s         # WARP_SHUTDOWN_TIMEOUT

database:
  # sqlite (dev, single user), postgres (production) or pocketbase
  # (appliance; not implemented yet).            WARP_DB_DRIVER
  driver: sqlite

  # sqlite:     file:warp.db?_pragma=journal_mode(WAL)
  # postgres:   postgres://warp:secret@localhost/warp?sslmode=disable
  #                                              WARP_DB_CONNECTION_STRING
  connection_string: "file:warp.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(10000)&_pragma=foreign_keys(1)"

  max_open_conns: 10            # WARP_DB_MAX_OPEN_CONNS (ignored by sqlite:
  max_idle_conns: 5             # WARP_DB_MAX_IDLE_CONNS  one writer only)
  conn_max_lifetime: 1h         # WARP_DB_CONN_MAX_LIFETIME

  # Apply pending migrations on startup. Set false to gate schema changes
  # behind an explicit `warp migrate`.           WARP_DB_AUTO_MIGRATE
  auto_migrate: true

client_api:
  # The Matrix spec expects a homeserver to allow any origin. Narrow this
  # if only your own web client talks to it.     WARP_CORS_ALLOWED_ORIGINS
  cors_allowed_origins: ["*"]

  # Take the client address from X-Forwarded-For instead of the socket.
  # Turn this on ONLY behind a reverse proxy that overwrites the header:
  # anyone can send it, and the rate limiter keys on the result.
  #                                              WARP_TRUST_X_FORWARDED_FOR
  trust_x_forwarded_for: false

  # Expire access tokens after this long. 0 (the default) issues tokens
  # that never expire, which is what clients without refresh-token
  # support need. With a lifetime set, clients that ask for
  # refresh_token on login get one.   WARP_ACCESS_TOKEN_LIFETIME
  access_token_lifetime: 0s

  # How long a refresh token may be exchanged for a new access token.
  # 0 means no expiry.                WARP_REFRESH_TOKEN_LIFETIME
  refresh_token_lifetime: 0s

  # Per-endpoint rate limiting. Each bucket allows `burst` requests back
  # to back and returns one slot every `interval`, per client address.
  # Login and registration get their own, tighter, buckets because they
  # are the two endpoints worth brute-forcing.
  #
  # Only `enabled` has an environment override (the three buckets share a
  # type, so per-bucket variables would collide): set
  # WARP_RATE_LIMIT_ENABLED=false to turn the whole thing off, which is
  # what a test harness such as Complement wants.
  rate_limit:
    enabled: true                 # WARP_RATE_LIMIT_ENABLED
    default:
      burst: 30
      interval: 100ms
    login:
      burst: 10
      interval: 1s
    register:
      burst: 5
      interval: 2s
    # Creating a room writes a dozen events and joining one writes a
    # membership event that everybody in the room then sees, so both are
    # deliberately slower than a read.
    room_create:
      burst: 10
      interval: 1s
    join:
      burst: 10
      interval: 1s
    # /sync and the chatty writes behind it: typing, receipts, to-device
    # messages and presence. The loosest bucket of the lot on purpose — a
    # client lives in /sync, and a long poll that is refused leaves it
    # reconnecting in a loop, which is the one case where rate limiting
    # makes the load worse rather than better.
    sync:
      burst: 100
      interval: 20ms

sync:
  # Presence — who is online, and the status message they set. Off by
  # default: it is the noisiest thing in Matrix, because every user's
  # state change is published to everybody they share a room with, and a
  # private homeserver gains little from it. With it off, the presence
  # endpoints answer M_FORBIDDEN and a sync's presence section is empty.
  #                                                 WARP_SYNC_PRESENCE
  presence: false

  # How long a typing notification lasts without being renewed, and the
  # cap on what a client may ask for. A notification that outlived its
  # sender's session would leave a room claiming somebody was typing.
  #                                           WARP_SYNC_TYPING_TIMEOUT
  typing_timeout: 30s

  # The cap on a /sync's ?timeout=, whatever the client asks for. Holding
  # a connection open longer buys nothing — a blocked sync is woken the
  # moment anything happens — so this only decides how often an idle
  # client re-establishes its request.
  #                                        WARP_SYNC_LONG_POLL_TIMEOUT
  long_poll_timeout: 30s

federation:
  # Off by default: a new install is a private homeserver until you say
  # otherwise.                                   WARP_FEDERATION_ENABLED
  enabled: false

  # Non-empty = federate ONLY with these servers.
  #                                              WARP_FEDERATION_ALLOWLIST
  allowlist: []

  # Always blocked, even if listed above.        WARP_FEDERATION_DENYLIST
  denylist: []

  # Let the admin API flip `enabled` without a restart. When true, the
  # stored setting overrides the value above on boot.
  #                                WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE
  allow_runtime_toggle: true

registration:
  # Off by default. Make the first account with
  # `warp create-account --username you --admin`, then turn registration
  # on from the admin API if you want others to sign up.
  enabled: false                # WARP_REGISTRATION_ENABLED
  allow_runtime_toggle: true    # WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE

  # Non-empty = registration also requires one of these tokens, as the
  # m.login.registration_token stage of the sign-up flow. Per-token use
  # counts and expiry arrive with admin token management in Phase 9.
  #                                      WARP_REGISTRATION_TOKENS
  tokens: []

logging:
  level: info                   # debug, info, warn, error   WARP_LOG_LEVEL
  format: text                  # text or json               WARP_LOG_FORMAT
  add_source: false             # WARP_LOG_ADD_SOURCE

metrics:
  enabled: true                 # WARP_METRICS_ENABLED
  path: /metrics                # WARP_METRICS_PATH