[global]
server_name = "chat.example.com"
database_path = "/var/lib/tuwunel"
port = 8008
allow_registration = false
registration_token = "your-secure-token-here"
# ... 更多参数

export TUWUNEL_SERVER_NAME=chat.example.com
export TUWUNEL_ALLOW_REGISTRATION=false
export TUWUNEL_REGISTRATION_TOKEN=your-secure-token-here

tuwunel --option "allow_registration=true" --option "log_levels=debug"

[[global.appservice.irc.users]]
regex = "@irc-.*:chat.example.com"

[[global.appservice.irc.rooms]]
regex = "#irc_.*:chat.example.com"

[[global.appservice.irc.aliases]]
regex = "#irc_.*:chat.example.com"

[global]
server_name = "chat.example.com"
database_path = "/var/lib/tuwunel"
address = ["0.0.0.0"]
port = 8008

# === 注册：token 模式 ===
allow_registration = true
registration_token = "please-change-me-to-a-32char-random-string"
# 管理注册密钥（用于 _synapse/admin/v1/register）
registration_shared_secret = "another-long-random-string"

# === 安全：基础加固 ===
allow_federation = true
forbidden_usernames = ["^admin$", "^root$", "^matrix$"]
block_non_admin_invites = false

# === 缓存调优（2GB 内存保守值） ===
cache_capacity_modifier = 1.0
db_cache_capacity_mb = 256
db_write_buffer_capacity_mb = 64

# === Admin Room ===
create_admin_room = true
admin_console_automatic = true
admin_room_notices = true

# === 媒体 ===
expire_media_days = 90
url_preview = true

# === Federation ===
public_base_url = "https://chat.example.com"

# === 备份 ===
database_backup_path = "/var/lib/tuwunel-backup"
database_backups_to_keep = 3

# === 日志 ===
log_levels = "info"

[global]
server_name = "matrix.example.com"
database_path = "/var/lib/tuwunel"
address = ["0.0.0.0"]
port = 8008

# === 安全 ===
allow_registration = false   # 企业内部：关闭注册，用 OIDC
allow_federation = true

# === OIDC 对接企业 IdP ===
[[global.identity_provider]]
issuer = "https://sso.example.com"
client_id = "tuwunel-matrix"
client_secret = "${OIDC_CLIENT_SECRET}"
default = true

# === 缓存调优（8GB 内存利用） ===
cache_capacity_modifier = 1.5
db_cache_capacity_mb = 512
db_write_buffer_capacity_mb = 128

# === S3 媒体存储 ===
media_storage_providers = ["s3"]

[global.storage_provider.s3]
bucket_name = "matrix-media"
access_key_id = "${S3_AK}"
secret_access_key = "${S3_SK}"
endpoint = "https://s3.amazonaws.com"
region = "us-east-1"

# === Admin Room ===
create_admin_room = true
admin_console_automatic = true

# === 备份 ===
database_backup_path = "/opt/backups/tuwunel"
database_backups_to_keep = 7

# === Federation 黑名单 ===
forbidden_remote_server_names = [
    ".*\\.spam\\.example\\.com",
    "evil-server\\.xyz"
]

[global]
server_name = "matrix.corp.example.com"
database_path = "/data/tuwunel"
address = ["0.0.0.0"]
port = 8008

# === 缓存调优（充分利用内存） ===
cache_capacity_modifier = 2.0
db_cache_capacity_mb = 1024
db_write_buffer_capacity_mb = 256
pdu_cache_capacity = 50000
auth_chain_cache_capacity = 20000
stateinfo_cache_capacity = 50000

# === 安全 ===
allow_registration = false
grant_admin_to_first_user = false  # 大部署避免意外提升

# === LDAP + OIDC 双模式 ===
[global.ldap]
url = "ldap://ldap.corp.example.com:389"
bind_user = "cn=tuwunel,dc=corp,dc=example,dc=com"
bind_password = "${LDAP_BIND_PASS}"
search_base_dn = "ou=users,dc=corp,dc=example,dc=com"
search_filter = "(uid={username})"

# === 存储：GCS ===
media_storage_providers = ["gcs"]

[global.storage_provider.gcs.bucket]
# GCS 通过 metadata-server 凭证自动鉴权

# === 备份 ===
database_backup_path = "/data/backups/tuwunel"
database_backups_to_keep = 14

# === 日志 ===
log_levels = "info"