matrix-org
Single config option to disable federation.
This probably means:-
- Setting the federation whitelist to an empty string,
- Disabling the federation listener
- Auditing all other cases where an outbound federation request might be made.
Also document this more clearly
https://github.com/matrix-org/synapse/pull/5078/ does this. The suggestion of making it enable_federation_with_sqlite_can_cause_bad_perfs can probably just be reverted to the original enable_federation.
For privacy reasons, if federation is completely disabled, the trusted key servers should automatically be set to the private home server only. Otherwise it seems the riot desktop client establishes connections to cloudflare servers.
Has there been any movement on this? There are numerous organizations that want this isolation funtionality.
The easiest way to do this currently is to set federation_domain_whitelist: [] in the config file, though I'd still like there to be a big kill-switch to turn off everything federation-related.
I didn't know that by default you can be found by anyone using any matrix server. Very useful, thank you!
is there any guide or any documentation about how to disable federation with this federation_domain_whitelist: []? i added it to my homeserver.yaml, but the logs are still flooded and its impossible to fix another problem, because of this ultimate annoying "feature". i really like synapse/matrix, but this is the worst logging implementation i ever encountered in my 30 years of IT experience.
is there any guide or any documentation about how to disable federation with this federation_domain_whitelist: []? i added it to my homeserver.yaml, but the logs are still flooded...
Can you set your firewall to close port 8448 and make sure there's no reverse proxy setting for that port, either? i am getting no inbound traffic at least in the access logs.
when i block it with iptables, i get tons of errors about connection refused. i was able to find my initial problem, and the logging was only hardcore annoying to figure out what was initially going wrong, but this is really nasty. i did not test it with disabling the reverse proxy
@tirranaa Which hosts and ip addresses did Synapse connect to when federation was disabled?
@tirranaa There should be no federation connection unless you tried to join a remote room or so (and certainly not in any case if federation was disabled by setting the allow list to an empty list), so it's a pity that you don't have any details to share here to look into.
I would guess some of that was due to report_stats being enabled. I don't think any TURN connections are made by default, but maybe a client does that by default.
There is already a federation: section. Why not just (analog to other keywords) add an enable keyword?
federation:
enable: false
...
