{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "RootConfig",
  "description": "Application configuration root",
  "type": "object",
  "required": [
    "matrix",
    "secrets"
  ],
  "properties": {
    "clients": {
      "description": "List of OAuth 2.0/OIDC clients config",
      "type": "array",
      "items": {
        "$ref": "#/definitions/ClientConfig"
      }
    },
    "http": {
      "description": "Configuration of the HTTP server",
      "default": {
        "listeners": [
          {
            "name": "web",
            "resources": [
              {
                "name": "discovery"
              },
              {
                "name": "human"
              },
              {
                "name": "oauth"
              },
              {
                "name": "compat"
              },
              {
                "name": "graphql"
              },
              {
                "name": "assets"
              }
            ],
            "binds": [
              {
                "address": "[::]:8080"
              }
            ],
            "proxy_protocol": false
          },
          {
            "name": "internal",
            "resources": [
              {
                "name": "health"
              }
            ],
            "binds": [
              {
                "host": "localhost",
                "port": 8081
              }
            ],
            "proxy_protocol": false
          }
        ],
        "trusted_proxies": [
          "192.168.0.0/16",
          "172.16.0.0/12",
          "10.0.0.0/10",
          "127.0.0.1/8",
          "fd00::/8",
          "::1/128"
        ],
        "public_base": "http://[::]:8080/",
        "issuer": "http://[::]:8080/"
      },
      "allOf": [
        {
          "$ref": "#/definitions/HttpConfig"
        }
      ]
    },
    "database": {
      "description": "Database connection configuration",
      "default": {
        "uri": "postgresql://",
        "max_connections": 10,
        "min_connections": 0,
        "connect_timeout": 30,
        "idle_timeout": 600,
        "max_lifetime": 1800
      },
      "allOf": [
        {
          "$ref": "#/definitions/DatabaseConfig"
        }
      ]
    },
    "telemetry": {
      "description": "Configuration related to sending monitoring data",
      "allOf": [
        {
          "$ref": "#/definitions/TelemetryConfig"
        }
      ]
    },
    "templates": {
      "description": "Configuration related to templates",
      "allOf": [
        {
          "$ref": "#/definitions/TemplatesConfig"
        }
      ]
    },
    "email": {
      "description": "Configuration related to sending emails",
      "default": {
        "from": "\"Authentication Service\" <root@localhost>",
        "reply_to": "\"Authentication Service\" <root@localhost>",
        "transport": "blackhole"
      },
      "allOf": [
        {
          "$ref": "#/definitions/EmailConfig"
        }
      ]
    },
    "secrets": {
      "description": "Application secrets",
      "allOf": [
        {
          "$ref": "#/definitions/SecretsConfig"
        }
      ]
    },
    "passwords": {
      "description": "Configuration related to user passwords",
      "default": {
        "enabled": true,
        "schemes": [
          {
            "version": 1,
            "algorithm": "argon2id"
          }
        ],
        "minimum_complexity": 3
      },
      "allOf": [
        {
          "$ref": "#/definitions/PasswordsConfig"
        }
      ]
    },
    "matrix": {
      "description": "Configuration related to the homeserver",
      "allOf": [
        {
          "$ref": "#/definitions/MatrixConfig"
        }
      ]
    },
    "policy": {
      "description": "Configuration related to the OPA policies",
      "allOf": [
        {
          "$ref": "#/definitions/PolicyConfig"
        }
      ]
    },
    "rate_limiting": {
      "description": "Configuration related to limiting the rate of user actions to prevent abuse",
      "allOf": [
        {
          "$ref": "#/definitions/RateLimitingConfig"
        }
      ]
    },
    "upstream_oauth2": {
      "description": "Configuration related to upstream OAuth providers",
      "allOf": [
        {
          "$ref": "#/definitions/UpstreamOAuth2Config"
        }
      ]
    },
    "branding": {
      "description": "Configuration section for tweaking the branding of the service",
      "allOf": [
        {
          "$ref": "#/definitions/BrandingConfig"
        }
      ]
    },
    "captcha": {
      "description": "Configuration section to setup CAPTCHA protection on a few operations",
      "allOf": [
        {
          "$ref": "#/definitions/CaptchaConfig"
        }
      ]
    },
    "account": {
      "description": "Configuration section to configure features related to account management",
      "allOf": [
        {
          "$ref": "#/definitions/AccountConfig"
        }
      ]
    },
    "experimental": {
      "description": "Experimental configuration options",
      "allOf": [
        {
          "$ref": "#/definitions/ExperimentalConfig"
        }
      ]
    }
  },
  "definitions": {
    "ClientConfig": {
      "description": "An OAuth 2.0 client configuration",
      "type": "object",
      "required": [
        "client_auth_method",
        "client_id"
      ],
      "properties": {
        "client_id": {
          "description": "A ULID as per https://github.com/ulid/spec",
          "type": "string",
          "pattern": "^[0123456789ABCDEFGHJKMNPQRSTVWXYZ]{26}$"
        },
        "client_auth_method": {
          "description": "Authentication method used for this client",
          "allOf": [
            {
              "$ref": "#/definitions/ClientAuthMethodConfig"
            }
          ]
        },
        "client_secret": {
          "description": "The client secret, used by the `client_secret_basic`, `client_secret_post` and `client_secret_jwt` authentication methods",
          "type": "string"
        },
        "jwks": {
          "description": "The JSON Web Key Set (JWKS) used by the `private_key_jwt` authentication method. Mutually exclusive with `jwks_uri`",
          "allOf": [
            {
              "$ref": "#/definitions/JsonWebKeySet_for_JsonWebKeyPublicParameters"
            }
          ]
        },
        "jwks_uri": {
          "description": "The URL of the JSON Web Key Set (JWKS) used by the `private_key_jwt` authentication method. Mutually exclusive with `jwks`",
          "type": "string",
          "format": "uri"
        },
        "redirect_uris": {
          "description": "List of allowed redirect URIs",
          "type": "array",
          "items": {
            "type": "string",
            "format": "uri"
          }
        }
      }
    },
    "ClientAuthMethodConfig": {
      "description": "Authentication method used by clients",
      "oneOf": [
        {
          "description": "`none`: No authentication",
          "type": "string",
          "enum": [
            "none"
          ]
        },
        {
          "description": "`client_secret_basic`: `client_id` and `client_secret` used as basic authorization credentials",
          "type": "string",
          "enum": [
            "client_secret_basic"
          ]
        },
        {
          "description": "`client_secret_post`: `client_id` and `client_secret` sent in the request body",
          "type": "string",
          "enum": [
            "client_secret_post"
          ]
        },
        {
          "description": "`client_secret_basic`: a `client_assertion` sent in the request body and signed using the `client_secret`",
          "type": "string",
          "enum": [
            "client_secret_jwt"
          ]
        },
        {
          "description": "`client_secret_basic`: a `client_assertion` sent in the request body and signed by an asymmetric key",
          "type": "string",
          "enum": [
            "private_key_jwt"
          ]
        }
      ]
    },
    "JsonWebKeySet_for_JsonWebKeyPublicParameters": {
      "type": "object",
      "required": [
        "keys"
      ],
      "properties": {
        "keys": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/JsonWebKey_for_JsonWebKeyPublicParameters"
          }
        }
      }
    },
    "JsonWebKey_for_JsonWebKeyPublicParameters": {
      "type": "object",
      "oneOf": [
        {
          "type": "object",
          "required": [
            "e",
            "kty",
            "n"
          ],
          "properties": {
            "kty": {
              "type": "string",
              "enum": [
                "RSA"
              ]
            },
            "n": {
              "type": "string"
            },
            "e": {
              "type": "string"
            }
          }
        },
        {
          "type": "object",
          "required": [
            "crv",
            "kty",
            "x",
            "y"
          ],
          "properties": {
            "kty": {
              "type": "string",
              "enum": [
                "EC"
              ]
            },
            "crv": {
              "$ref": "#/definitions/JsonWebKeyEcEllipticCurve"
            },
            "x": {
              "type": "string"
            },
            "y": {
              "type": "string"
            }
          }
        },
        {
          "type": "object",
          "required": [
            "crv",
            "kty",
            "x"
          ],
          "properties": {
            "kty": {
              "type": "string",
              "enum": [
                "OKP"
              ]
            },
            "crv": {
              "$ref": "#/definitions/JsonWebKeyOkpEllipticCurve"
            },
            "x": {
              "type": "string"
            }
          }
        }
      ],
      "properties": {
        "use": {
          "$ref": "#/definitions/JsonWebKeyUse"
        },
        "key_ops": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/JsonWebKeyOperation"
          }
        },
        "alg": {
          "$ref": "#/definitions/JsonWebSignatureAlg"
        },
        "kid": {
          "type": "string"
        },
        "x5u": {
          "type": "string"
        },
        "x5c": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "x5t": {
          "type": "string"
        },
        "x5t#S256": {
          "type": "string"
        }
      }
    },
    "JsonWebKeyUse": {
      "description": "JSON Web Key Use",
      "anyOf": [
        {
          "description": "Digital Signature or MAC",
          "const": "sig"
        },
        {
          "description": "Encryption",
          "const": "enc"
        }
      ]
    },
    "JsonWebKeyOperation": {
      "description": "JSON Web Key Operation",
      "anyOf": [
        {
          "description": "Compute digital signature or MAC",
          "const": "sign"
        },
        {
          "description": "Verify digital signature or MAC",
          "const": "verify"
        },
        {
          "description": "Encrypt content",
          "const": "encrypt"
        },
        {
          "description": "Decrypt content and validate decryption, if applicable",
          "const": "decrypt"
        },
        {
          "description": "Encrypt key",
          "const": "wrapKey"
        },
        {
          "description": "Decrypt key and validate decryption, if applicable",
          "const": "unwrapKey"
        },
        {
          "description": "Derive key",
          "const": "deriveKey"
        },
        {
          "description": "Derive bits not to be used as a key",
          "const": "deriveBits"
        }
      ]
    },
    "JsonWebSignatureAlg": {
      "description": "JSON Web Signature \"alg\" parameter",
      "anyOf": [
        {
          "description": "HMAC using SHA-256",
          "const": "HS256"
        },
        {
          "description": "HMAC using SHA-384",
          "const": "HS384"
        },
        {
          "description": "HMAC using SHA-512",
          "const": "HS512"
        },
        {
          "description": "RSASSA-PKCS1-v1_5 using SHA-256",
          "const": "RS256"
        },
        {
          "description": "RSASSA-PKCS1-v1_5 using SHA-384",
          "const": "RS384"
        },
        {
          "description": "RSASSA-PKCS1-v1_5 using SHA-512",
          "const": "RS512"
        },
        {
          "description": "ECDSA using P-256 and SHA-256",
          "const": "ES256"
        },
        {
          "description": "ECDSA using P-384 and SHA-384",
          "const": "ES384"
        },
        {
          "description": "ECDSA using P-521 and SHA-512",
          "const": "ES512"
        },
        {
          "description": "RSASSA-PSS using SHA-256 and MGF1 with SHA-256",
          "const": "PS256"
        },
        {
          "description": "RSASSA-PSS using SHA-384 and MGF1 with SHA-384",
          "const": "PS384"
        },
        {
          "description": "RSASSA-PSS using SHA-512 and MGF1 with SHA-512",
          "const": "PS512"
        },
        {
          "description": "No digital signature or MAC performed",
          "const": "none"
        },
        {
          "description": "EdDSA signature algorithms",
          "const": "EdDSA"
        },
        {
          "description": "ECDSA using secp256k1 curve and SHA-256",
          "const": "ES256K"
        }
      ]
    },
    "JsonWebKeyEcEllipticCurve": {
      "description": "JSON Web Key EC Elliptic Curve",
      "anyOf": [
        {
          "description": "P-256 Curve",
          "const": "P-256"
        },
        {
          "description": "P-384 Curve",
          "const": "P-384"
        },
        {
          "description": "P-521 Curve",
          "const": "P-521"
        },
        {
          "description": "SECG secp256k1 curve",
          "const": "secp256k1"
        }
      ]
    },
    "JsonWebKeyOkpEllipticCurve": {
      "description": "JSON Web Key OKP Elliptic Curve",
      "anyOf": [
        {
          "description": "Ed25519 signature algorithm key pairs",
          "const": "Ed25519"
        },
        {
          "description": "Ed448 signature algorithm key pairs",
          "const": "Ed448"
        },
        {
          "description": "X25519 function key pairs",
          "const": "X25519"
        },
        {
          "description": "X448 function key pairs",
          "const": "X448"
        }
      ]
    },
    "HttpConfig": {
      "description": "Configuration related to the web server",
      "type": "object",
      "required": [
        "public_base"
      ],
      "properties": {
        "listeners": {
          "description": "List of listeners to run",
          "default": [],
          "type": "array",
          "items": {
            "$ref": "#/definitions/ListenerConfig"
          }
        },
        "trusted_proxies": {
          "description": "List of trusted reverse proxies that can set the `X-Forwarded-For` header",
          "default": [
            "192.168.0.0/16",
            "172.16.0.0/12",
            "10.0.0.0/10",
            "127.0.0.1/8",
            "fd00::/8",
            "::1/128"
          ],
          "type": "array",
          "items": {
            "$ref": "#/definitions/IpNetwork"
          }
        },
        "public_base": {
          "description": "Public URL base from where the authentication service is reachable",
          "type": "string",
          "format": "uri"
        },
        "issuer": {
          "description": "OIDC issuer URL. Defaults to `public_base` if not set.",
          "type": "string",
          "format": "uri"
        }
      }
    },
    "ListenerConfig": {
      "description": "Configuration of a listener",
      "type": "object",
      "required": [
        "binds",
        "resources"
      ],
      "properties": {
        "name": {
          "description": "A unique name for this listener which will be shown in traces and in metrics labels",
          "type": "string"
        },
        "resources": {
          "description": "List of resources to mount",
          "type": "array",
          "items": {
            "$ref": "#/definitions/Resource"
          }
        },
        "prefix": {
          "description": "HTTP prefix to mount the resources on",
          "type": "string"
        },
        "binds": {
          "description": "List of sockets to bind",
          "type": "array",
          "items": {
            "$ref": "#/definitions/BindConfig"
          }
        },
        "proxy_protocol": {
          "description": "Accept `HAProxy`'s Proxy Protocol V1",
          "default": false,
          "type": "boolean"
        },
        "tls": {
          "description": "If set, makes the listener use TLS with the provided certificate and key",
          "allOf": [
            {
              "$ref": "#/definitions/TlsConfig"
            }
          ]
        }
      }
    },
    "Resource": {
      "description": "HTTP resources to mount",
      "oneOf": [
        {
          "description": "Healthcheck endpoint (/health)",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "health"
              ]
            }
          }
        },
        {
          "description": "Prometheus metrics endpoint (/metrics)",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "prometheus"
              ]
            }
          }
        },
        {
          "description": "OIDC discovery endpoints",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "discovery"
              ]
            }
          }
        },
        {
          "description": "Pages destined to be viewed by humans",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "human"
              ]
            }
          }
        },
        {
          "description": "GraphQL endpoint",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "graphql"
              ]
            },
            "playground": {
              "description": "Enabled the GraphQL playground",
              "type": "boolean"
            },
            "undocumented_oauth2_access": {
              "description": "Allow access for OAuth 2.0 clients (undocumented)",
              "type": "boolean"
            }
          }
        },
        {
          "description": "OAuth-related APIs",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "oauth"
              ]
            }
          }
        },
        {
          "description": "Matrix compatibility API",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "compat"
              ]
            }
          }
        },
        {
          "description": "Static files",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "assets"
              ]
            },
            "path": {
              "description": "Path to the directory to serve.",
              "type": "string"
            }
          }
        },
        {
          "description": "Admin API, served at `/api/admin/v1`",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "adminapi"
              ]
            }
          }
        },
        {
          "description": "Mount a \"/connection-info\" handler which helps debugging informations on the upstream connection",
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "enum": [
                "connection-info"
              ]
            }
          }
        }
      ]
    },
    "BindConfig": {
      "description": "Configuration of a single listener",
      "anyOf": [
        {
          "description": "Listen on the specified host and port",
          "type": "object",
          "required": [
            "port"
          ],
          "properties": {
            "host": {
              "description": "Host on which to listen.\n\nDefaults to listening on all addresses",
              "type": "string"
            },
            "port": {
              "description": "Port on which to listen.",
              "type": "integer",
              "format": "uint16",
              "minimum": 0.0
            }
          }
        },
        {
          "description": "Listen on the specified address",
          "type": "object",
          "required": [
            "address"
          ],
          "properties": {
            "address": {
              "description": "Host and port on which to listen",
              "examples": [
                "[::1]:8080",
                "[::]:8080",
                "127.0.0.1:8080",
                "0.0.0.0:8080"
              ],
              "type": "string"
            }
          }
        },
        {
          "description": "Listen on a UNIX domain socket",
          "type": "object",
          "required": [
            "socket"
          ],
          "properties": {
            "socket": {
              "description": "Path to the socket",
              "type": "string"
            }
          }
        },
        {
          "description": "Accept connections on file descriptors passed by the parent process.\n\nThis is useful for grabbing sockets passed by systemd.\n\nSee <https://www.freedesktop.org/software/systemd/man/sd_listen_fds.html>",
          "type": "object",
          "properties": {
            "fd": {
              "description": "Index of the file descriptor. Note that this is offseted by 3 because of the standard input/output sockets, so setting here a value of `0` will grab the file descriptor `3`",
              "default": 0,
              "type": "integer",
              "format": "uint",
              "minimum": 0.0
            },
            "kind": {
              "description": "Whether the socket is a TCP socket or a UNIX domain socket. Defaults to TCP.",
              "default": "tcp",
              "allOf": [
                {
                  "$ref": "#/definitions/UnixOrTcp"
                }
              ]
            }
          }
        }
      ]
    },
    "UnixOrTcp": {
      "description": "Kind of socket",
      "oneOf": [
        {
          "description": "UNIX domain socket",
          "type": "string",
          "enum": [
            "unix"
          ]
        },
        {
          "description": "TCP socket",
          "type": "string",
          "enum": [
            "tcp"
          ]
        }
      ]
    },
    "TlsConfig": {
      "description": "Configuration related to TLS on a listener",
      "type": "object",
      "properties": {
        "certificate": {
          "description": "PEM-encoded X509 certificate chain\n\nExactly one of `certificate` or `certificate_file` must be set.",
          "type": "string"
        },
        "certificate_file": {
          "description": "File containing the PEM-encoded X509 certificate chain\n\nExactly one of `certificate` or `certificate_file` must be set.",
          "type": "string"
        },
        "key": {
          "description": "PEM-encoded private key\n\nExactly one of `key` or `key_file` must be set.",
          "type": "string"
        },
        "key_file": {
          "description": "File containing a PEM or DER-encoded private key\n\nExactly one of `key` or `key_file` must be set.",
          "type": "string"
        },
        "password": {
          "description": "Password used to decode the private key\n\nOne of `password` or `password_file` must be set if the key is encrypted.",
          "type": "string"
        },
        "password_file": {
          "description": "Password file used to decode the private key\n\nOne of `password` or `password_file` must be set if the key is encrypted.",
          "type": "string"
        }
      }
    },
    "IpNetwork": {
      "oneOf": [
        {
          "title": "v4",
          "allOf": [
            {
              "$ref": "#/definitions/Ipv4Network"
            }
          ]
        },
        {
          "title": "v6",
          "allOf": [
            {
              "$ref": "#/definitions/Ipv6Network"
            }
          ]
        }
      ],
      "x-rust-type": "ipnetwork::IpNetwork"
    },
    "Ipv4Network": {
      "type": "string",
      "pattern": "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\/(3[0-2]|[0-2]?[0-9])$",
      "x-rust-type": "ipnetwork::Ipv4Network"
    },
    "Ipv6Network": {
      "type": "string",
      "pattern": "^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\")[/](12[0-8]|1[0-1][0-9]|[0-9]?[0-9])$",
      "x-rust-type": "ipnetwork::Ipv6Network"
    },
    "DatabaseConfig": {
      "description": "Database connection configuration",
      "type": "object",
      "properties": {
        "uri": {
          "description": "Connection URI\n\nThis must not be specified if `host`, `port`, `socket`, `username`, `password`, or `database` are specified.",
          "default": "postgresql://",
          "type": "string",
          "format": "uri"
        },
        "host": {
          "description": "Name of host to connect to\n\nThis must not be specified if `uri` is specified.",
          "allOf": [
            {
              "$ref": "#/definitions/Hostname"
            }
          ]
        },
        "port": {
          "description": "Port number to connect at the server host\n\nThis must not be specified if `uri` is specified.",
          "type": "integer",
          "format": "uint16",
          "maximum": 65535.0,
          "minimum": 1.0
        },
        "socket": {
          "description": "Directory containing the UNIX socket to connect to\n\nThis must not be specified if `uri` is specified.",
          "type": "string"
        },
        "username": {
          "description": "PostgreSQL user name to connect as\n\nThis must not be specified if `uri` is specified.",
          "type": "string"
        },
        "password": {
          "description": "Password to be used if the server demands password authentication\n\nThis must not be specified if `uri` is specified.",
          "type": "string"
        },
        "database": {
          "description": "The database name\n\nThis must not be specified if `uri` is specified.",
          "type": "string"
        },
        "ssl_mode": {
          "description": "How to handle SSL connections",
          "allOf": [
            {
              "$ref": "#/definitions/PgSslMode"
            }
          ]
        },
        "ssl_ca": {
          "description": "The PEM-encoded root certificate for SSL connections\n\nThis must not be specified if the `ssl_ca_file` option is specified.",
          "type": "string"
        },
        "ssl_ca_file": {
          "description": "Path to the root certificate for SSL connections\n\nThis must not be specified if the `ssl_ca` option is specified.",
          "type": "string"
        },
        "ssl_certificate": {
          "description": "The PEM-encoded client certificate for SSL connections\n\nThis must not be specified if the `ssl_certificate_file` option is specified.",
          "type": "string"
        },
        "ssl_certificate_file": {
          "description": "Path to the client certificate for SSL connections\n\nThis must not be specified if the `ssl_certificate` option is specified.",
          "type": "string"
        },
        "ssl_key": {
          "description": "The PEM-encoded client key for SSL connections\n\nThis must not be specified if the `ssl_key_file` option is specified.",
          "type": "string"
        },
        "ssl_key_file": {
          "description": "Path to the client key for SSL connections\n\nThis must not be specified if the `ssl_key` option is specified.",
          "type": "string"
        },
        "max_connections": {
          "description": "Set the maximum number of connections the pool should maintain",
          "default": 10,
          "type": "integer",
          "format": "uint32",
          "minimum": 1.0
        },
        "min_connections": {
          "description": "Set the minimum number of connections the pool should maintain",
          "default": 0,
          "type": "integer",
          "format": "uint32",
          "minimum": 0.0
        },
        "connect_timeout": {
          "description": "Set the amount of time to attempt connecting to the database",
          "default": 30,
          "type": "integer",
          "format": "uint64",
          "minimum": 0.0
        },
        "idle_timeout": {
          "description": "Set a maximum idle duration for individual connections",
          "default": 600,
          "type": "integer",
          "format": "uint64",
          "minimum": 0.0
        },
        "max_lifetime": {
          "description": "Set the maximum lifetime of individual connections",
          "default": 1800,
          "type": "integer",
          "format": "uint64",
          "minimum": 0.0
        }
      }
    },
    "Hostname": {
      "type": "string",
      "format": "hostname"
    },
    "PgSslMode": {
      "description": "Options for controlling the level of protection provided for PostgreSQL SSL connections.",
      "oneOf": [
        {
          "description": "Only try a non-SSL connection.",
          "type": "string",
          "enum": [
            "disable"
          ]
        },
        {
          "description": "First try a non-SSL connection; if that fails, try an SSL connection.",
          "type": "string",
          "enum": [
            "allow"
          ]
        },
        {
          "description": "First try an SSL connection; if that fails, try a non-SSL connection.",
          "type": "string",
          "enum": [
            "prefer"
          ]
        },
        {
          "description": "Only try an SSL connection. If a root CA file is present, verify the connection in the same way as if `VerifyCa` was specified.",
          "type": "string",
          "enum": [
            "require"
          ]
        },
        {
          "description": "Only try an SSL connection, and verify that the server certificate is issued by a trusted certificate authority (CA).",
          "type": "string",
          "enum": [
            "verify-ca"
          ]
        },
        {
          "description": "Only try an SSL connection; verify that the server certificate is issued by a trusted CA and that the requested server host name matches that in the certificate.",
          "type": "string",
          "enum": [
            "verify-full"
          ]
        }
      ]
    },
    "TelemetryConfig": {
      "description": "Configuration related to sending monitoring data",
      "type": "object",
      "properties": {
        "tracing": {
          "description": "Configuration related to exporting traces",
          "allOf": [
            {
              "$ref": "#/definitions/TracingConfig"
            }
          ]
        },
        "metrics": {
          "description": "Configuration related to exporting metrics",
          "allOf": [
            {
              "$ref": "#/definitions/MetricsConfig"
            }
          ]
        },
        "sentry": {
          "description": "Configuration related to the Sentry integration",
          "allOf": [
            {
              "$ref": "#/definitions/SentryConfig"
            }
          ]
        }
      }
    },
    "TracingConfig": {
      "description": "Configuration related to exporting traces",
      "type": "object",
      "required": [
        "propagators"
      ],
      "properties": {
        "exporter": {
          "description": "Exporter to use when exporting traces",
          "default": "none",
          "allOf": [
            {
              "$ref": "#/definitions/TracingExporterKind"
            }
          ]
        },
        "endpoint": {
          "description": "OTLP exporter: OTLP over HTTP compatible endpoint",
          "default": "https://localhost:4318",
          "type": "string",
          "format": "uri"
        },
        "propagators": {
          "description": "List of propagation formats to use for incoming and outgoing requests",
          "type": "array",
          "items": {
            "$ref": "#/definitions/Propagator"
          }
        }
      }
    },
    "TracingExporterKind": {
      "description": "Exporter to use when exporting traces",
      "oneOf": [
        {
          "description": "Don't export traces",
          "type": "string",
          "enum": [
            "none"
          ]
        },
        {
          "description": "Export traces to the standard output. Only useful for debugging",
          "type": "string",
          "enum": [
            "stdout"
          ]
        },
        {
          "description": "Export traces to an OpenTelemetry protocol compatible endpoint",
          "type": "string",
          "enum": [
            "otlp"
          ]
        }
      ]
    },
    "Propagator": {
      "description": "Propagation format for incoming and outgoing requests",
      "oneOf": [
        {
          "description": "Propagate according to the W3C Trace Context specification",
          "type": "string",
          "enum": [
            "tracecontext"
          ]
        },
        {
          "description": "Propagate according to the W3C Baggage specification",
          "type": "string",
          "enum": [
            "baggage"
          ]
        },
        {
          "description": "Propagate trace context with Jaeger compatible headers",
          "type": "string",
          "enum": [
            "jaeger"
          ]
        }
      ]
    },
    "MetricsConfig": {
      "description": "Configuration related to exporting metrics",
      "type": "object",
      "properties": {
        "exporter": {
          "description": "Exporter to use when exporting metrics",
          "default": "none",
          "allOf": [
            {
              "$ref": "#/definitions/MetricsExporterKind"
            }
          ]
        },
        "endpoint": {
          "description": "OTLP exporter: OTLP over HTTP compatible endpoint",
          "default": "https://localhost:4318",
          "type": "string",
          "format": "uri"
        }
      }
    },
    "MetricsExporterKind": {
      "description": "Exporter to use when exporting metrics",
      "oneOf": [
        {
          "description": "Don't export metrics",
          "type": "string",
          "enum": [
            "none"
          ]
        },
        {
          "description": "Export metrics to stdout. Only useful for debugging",
          "type": "string",
          "enum": [
            "stdout"
          ]
        },
        {
          "description": "Export metrics to an OpenTelemetry protocol compatible endpoint",
          "type": "string",
          "enum": [
            "otlp"
          ]
        },
        {
          "description": "Export metrics via Prometheus. An HTTP listener with the `prometheus` resource must be setup to expose the Promethes metrics.",
          "type": "string",
          "enum": [
            "prometheus"
          ]
        }
      ]
    },
    "SentryConfig": {
      "description": "Configuration related to the Sentry integration",
      "type": "object",
      "properties": {
        "dsn": {
          "description": "Sentry DSN",
          "examples": [
            "https://public@host:port/1"
          ],
          "type": "string",
          "format": "uri"
        }
      }
    },
    "TemplatesConfig": {
      "description": "Configuration related to templates",
      "type": "object",
      "properties": {
        "path": {
          "description": "Path to the folder which holds the templates",
          "type": "string"
        },
        "assets_manifest": {
          "description": "Path to the assets manifest",
          "type": "string"
        },
        "translations_path": {
          "description": "Path to the translations",
          "type": "string"
        }
      }
    },
    "EmailConfig": {
      "description": "Configuration related to sending emails",
      "type": "object",
      "required": [
        "transport"
      ],
      "properties": {
        "from": {
          "description": "Email address to use as From when sending emails",
          "default": "\"Authentication Service\" <root@localhost>",
          "type": "string",
          "format": "email"
        },
        "reply_to": {
          "description": "Email address to use as Reply-To when sending emails",
          "default": "\"Authentication Service\" <root@localhost>",
          "type": "string",
          "format": "email"
        },
        "transport": {
          "description": "What backend should be used when sending emails",
          "allOf": [
            {
              "$ref": "#/definitions/EmailTransportKind"
            }
          ]
        },
        "mode": {
          "description": "SMTP transport: Connection mode to the relay",
          "allOf": [
            {
              "$ref": "#/definitions/EmailSmtpMode"
            }
          ]
        },
        "hostname": {
          "description": "SMTP transport: Hostname to connect to",
          "allOf": [
            {
              "$ref": "#/definitions/Hostname"
            }
          ]
        },
        "port": {
          "description": "SMTP transport: Port to connect to. Default is 25 for plain, 465 for TLS and 587 for `StartTLS`",
          "type": "integer",
          "format": "uint16",
          "maximum": 65535.0,
          "minimum": 1.0
        },
        "username": {
          "description": "SMTP transport: Username for use to authenticate when connecting to the SMTP server\n\nMust be set if the `password` field is set",
          "type": "string"
        },
        "password": {
          "description": "SMTP transport: Password for use to authenticate when connecting to the SMTP server\n\nMust be set if the `username` field is set",
          "type": "string"
        },
        "command": {
          "description": "Sendmail transport: Command to use to send emails",
          "default": "sendmail",
          "type": "string"
        }
      }
    },
    "EmailTransportKind": {
      "description": "What backend should be used when sending emails",
      "oneOf": [
        {
          "description": "Don't send emails anywhere",
          "type": "string",
          "enum": [
            "blackhole"
          ]
        },
        {
          "description": "Send emails via an SMTP relay",
          "type": "string",
          "enum": [
            "smtp"
          ]
        },
        {
          "description": "Send emails by calling sendmail",
          "type": "string",
          "enum": [
            "sendmail"
          ]
        }
      ]
    },
    "EmailSmtpMode": {
      "description": "Encryption mode to use",
      "oneOf": [
        {
          "description": "Plain text",
          "type": "string",
          "enum": [
            "plain"
          ]
        },
        {
          "description": "`StartTLS` (starts as plain text then upgrade to TLS)",
          "type": "string",
          "enum": [
            "starttls"
          ]
        },
        {
          "description": "TLS",
          "type": "string",
          "enum": [
            "tls"
          ]
        }
      ]
    },
    "SecretsConfig": {
      "description": "Application secrets",
      "type": "object",
      "required": [
        "encryption"
      ],
      "properties": {
        "encryption": {
          "description": "Encryption key for secure cookies",
          "examples": [
            "0000111122223333444455556666777788889999aaaabbbbccccddddeeeeffff"
          ],
          "type": "string",
          "pattern": "[0-9a-fA-F]{64}"
        },
        "keys": {
          "description": "List of private keys to use for signing and encrypting payloads",
          "default": [],
          "type": "array",
          "items": {
            "$ref": "#/definitions/KeyConfig"
          }
        }
      }
    },
    "KeyConfig": {
      "type": "object",
      "required": [
        "kid"
      ],
      "properties": {
        "kid": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "password_file": {
          "type": "string"
        },
        "key": {
          "type": "string"
        },
        "key_file": {
          "type": "string"
        }
      }
    },
    "PasswordsConfig": {
      "description": "User password hashing config",
      "type": "object",
      "properties": {
        "enabled": {
          "description": "Whether password-based authentication is enabled",
          "default": true,
          "type": "boolean"
        },
        "schemes": {
          "default": [
            {
              "version": 1,
              "algorithm": "argon2id"
            }
          ],
          "type": "array",
          "items": {
            "$ref": "#/definitions/HashingScheme"
          }
        },
        "minimum_complexity": {
          "description": "Score between 0 and 4 determining the minimum allowed password complexity. Scores are based on the ESTIMATED number of guesses needed to guess the password.\n\n- 0: less than 10^2 (100) - 1: less than 10^4 (10'000) - 2: less than 10^6 (1'000'000) - 3: less than 10^8 (100'000'000) - 4: any more than that",
          "default": 3,
          "type": "integer",
          "format": "uint8",
          "minimum": 0.0
        }
      }
    },
    "HashingScheme": {
      "type": "object",
      "required": [
        "algorithm",
        "version"
      ],
      "properties": {
        "version": {
          "type": "integer",
          "format": "uint16",
          "minimum": 0.0
        },
        "algorithm": {
          "$ref": "#/definitions/Algorithm"
        },
        "cost": {
          "description": "Cost for the bcrypt algorithm",
          "default": 12,
          "type": "integer",
          "format": "uint32",
          "minimum": 0.0
        },
        "secret": {
          "type": "string"
        },
        "secret_file": {
          "type": "string"
        }
      }
    },
    "Algorithm": {
      "description": "A hashing algorithm",
      "oneOf": [
        {
          "description": "bcrypt",
          "type": "string",
          "enum": [
            "bcrypt"
          ]
        },
        {
          "description": "argon2id",
          "type": "string",
          "enum": [
            "argon2id"
          ]
        },
        {
          "description": "PBKDF2",
          "type": "string",
          "enum": [
            "pbkdf2"
          ]
        }
      ]
    },
    "MatrixConfig": {
      "description": "Configuration related to the Matrix homeserver",
      "type": "object",
      "required": [
        "secret"
      ],
      "properties": {
        "homeserver": {
          "description": "The server name of the homeserver.",
          "default": "localhost:8008",
          "type": "string"
        },
        "secret": {
          "description": "Shared secret to use for calls to the admin API",
          "type": "string"
        },
        "endpoint": {
          "description": "The base URL of the homeserver's client API",
          "default": "http://localhost:8008/",
          "type": "string",
          "format": "uri"
        }
      }
    },
    "PolicyConfig": {
      "description": "Application secrets",
      "type": "object",
      "properties": {
        "wasm_module": {
          "description": "Path to the WASM module",
          "type": "string"
        },
        "client_registration_entrypoint": {
          "description": "Entrypoint to use when evaluating client registrations",
          "type": "string"
        },
        "register_entrypoint": {
          "description": "Entrypoint to use when evaluating user registrations",
          "type": "string"
        },
        "authorization_grant_entrypoint": {
          "description": "Entrypoint to use when evaluating authorization grants",
          "type": "string"
        },
        "password_entrypoint": {
          "description": "Entrypoint to use when changing password",
          "type": "string"
        },
        "email_entrypoint": {
          "description": "Entrypoint to use when adding an email address",
          "type": "string"
        },
        "data": {
          "description": "Arbitrary data to pass to the policy"
        }
      }
    },
    "RateLimitingConfig": {
      "description": "Configuration related to sending emails",
      "type": "object",
      "properties": {
        "account_recovery": {
          "description": "Account Recovery-specific rate limits",
          "default": {
            "per_ip": {
              "burst": 3,
              "per_second": 0.0008333333333333334
            },
            "per_address": {
              "burst": 3,
              "per_second": 0.0002777777777777778
            }
          },
          "allOf": [
            {
              "$ref": "#/definitions/AccountRecoveryRateLimitingConfig"
            }
          ]
        },
        "login": {
          "description": "Login-specific rate limits",
          "default": {
            "per_ip": {
              "burst": 3,
              "per_second": 0.05
            },
            "per_account": {
              "burst": 1800,
              "per_second": 0.5
            }
          },
          "allOf": [
            {
              "$ref": "#/definitions/LoginRateLimitingConfig"
            }
          ]
        },
        "registration": {
          "description": "Controls how many registrations attempts are permitted based on source address.",
          "default": {
            "burst": 3,
            "per_second": 0.0008333333333333334
          },
          "allOf": [
            {
              "$ref": "#/definitions/RateLimiterConfiguration"
            }
          ]
        }
      }
    },
    "AccountRecoveryRateLimitingConfig": {
      "type": "object",
      "properties": {
        "per_ip": {
          "description": "Controls how many account recovery attempts are permitted based on source IP address. This can protect against causing e-mail spam to many targets.\n\nNote: this limit also applies to re-sends.",
          "default": {
            "burst": 3,
            "per_second": 0.0008333333333333334
          },
          "allOf": [
            {
              "$ref": "#/definitions/RateLimiterConfiguration"
            }
          ]
        },
        "per_address": {
          "description": "Controls how many account recovery attempts are permitted based on the e-mail address entered into the recovery form. This can protect against causing e-mail spam to one target.\n\nNote: this limit also applies to re-sends.",
          "default": {
            "burst": 3,
            "per_second": 0.0002777777777777778
          },
          "allOf": [
            {
              "$ref": "#/definitions/RateLimiterConfiguration"
            }
          ]
        }
      }
    },
    "RateLimiterConfiguration": {
      "type": "object",
      "required": [
        "burst",
        "per_second"
      ],
      "properties": {
        "burst": {
          "description": "A one-off burst of actions that the user can perform in one go without waiting.",
          "type": "integer",
          "format": "uint32",
          "minimum": 1.0
        },
        "per_second": {
          "description": "How quickly the allowance replenishes, in number of actions per second. Can be fractional to replenish slower.",
          "type": "number",
          "format": "double"
        }
      }
    },
    "LoginRateLimitingConfig": {
      "type": "object",
      "properties": {
        "per_ip": {
          "description": "Controls how many login attempts are permitted based on source IP address. This can protect against brute force login attempts.\n\nNote: this limit also applies to password checks when a user attempts to change their own password.",
          "default": {
            "burst": 3,
            "per_second": 0.05
          },
          "allOf": [
            {
              "$ref": "#/definitions/RateLimiterConfiguration"
            }
          ]
        },
        "per_account": {
          "description": "Controls how many login attempts are permitted based on the account that is being attempted to be logged into. This can protect against a distributed brute force attack but should be set high enough to prevent someone's account being casually locked out.\n\nNote: this limit also applies to password checks when a user attempts to change their own password.",
          "default": {
            "burst": 1800,
            "per_second": 0.5
          },
          "allOf": [
            {
              "$ref": "#/definitions/RateLimiterConfiguration"
            }
          ]
        }
      }
    },
    "UpstreamOAuth2Config": {
      "description": "Upstream OAuth 2.0 providers configuration",
      "type": "object",
      "required": [
        "providers"
      ],
      "properties": {
        "providers": {
          "description": "List of OAuth 2.0 providers",
          "type": "array",
          "items": {
            "$ref": "#/definitions/Provider"
          }
        }
      }
    },
    "Provider": {
      "type": "object",
      "required": [
        "client_id",
        "id",
        "issuer",
        "scope",
        "token_endpoint_auth_method"
      ],
      "properties": {
        "enabled": {
          "description": "Whether this provider is enabled.\n\nDefaults to `true`",
          "type": "boolean"
        },
        "id": {
          "description": "A ULID as per https://github.com/ulid/spec",
          "type": "string",
          "pattern": "^[0123456789ABCDEFGHJKMNPQRSTVWXYZ]{26}$"
        },
        "issuer": {
          "description": "The OIDC issuer URL",
          "type": "string"
        },
        "human_name": {
          "description": "A human-readable name for the provider, that will be shown to users",
          "type": "string"
        },
        "brand_name": {
          "description": "A brand identifier used to customise the UI, e.g. `apple`, `google`, `github`, etc.\n\nValues supported by the default template are:\n\n- `apple` - `google` - `facebook` - `github` - `gitlab` - `twitter`",
          "type": "string"
        },
        "client_id": {
          "description": "The client ID to use when authenticating with the provider",
          "type": "string"
        },
        "client_secret": {
          "description": "The client secret to use when authenticating with the provider\n\nUsed by the `client_secret_basic`, `client_secret_post`, and `client_secret_jwt` methods",
          "type": "string"
        },
        "token_endpoint_auth_method": {
          "description": "The method to authenticate the client with the provider",
          "allOf": [
            {
              "$ref": "#/definitions/TokenAuthMethod"
            }
          ]
        },
        "token_endpoint_auth_signing_alg": {
          "description": "The JWS algorithm to use when authenticating the client with the provider\n\nUsed by the `client_secret_jwt` and `private_key_jwt` methods",
          "allOf": [
            {
              "$ref": "#/definitions/JsonWebSignatureAlg"
            }
          ]
        },
        "scope": {
          "description": "The scopes to request from the provider",
          "type": "string"
        },
        "discovery_mode": {
          "description": "How to discover the provider's configuration\n\nDefaults to `oidc`, which uses OIDC discovery with strict metadata verification",
          "allOf": [
            {
              "$ref": "#/definitions/DiscoveryMode"
            }
          ]
        },
        "pkce_method": {
          "description": "Whether to use proof key for code exchange (PKCE) when requesting and exchanging the token.\n\nDefaults to `auto`, which uses PKCE if the provider supports it.",
          "allOf": [
            {
              "$ref": "#/definitions/PkceMethod"
            }
          ]
        },
        "authorization_endpoint": {
          "description": "The URL to use for the provider's authorization endpoint\n\nDefaults to the `authorization_endpoint` provided through discovery",
          "type": "string",
          "format": "uri"
        },
        "token_endpoint": {
          "description": "The URL to use for the provider's token endpoint\n\nDefaults to the `token_endpoint` provided through discovery",
          "type": "string",
          "format": "uri"
        },
        "jwks_uri": {
          "description": "The URL to use for getting the provider's public keys\n\nDefaults to the `jwks_uri` provided through discovery",
          "type": "string",
          "format": "uri"
        },
        "claims_imports": {
          "description": "How claims should be imported from the `id_token` provided by the provider",
          "allOf": [
            {
              "$ref": "#/definitions/ClaimsImports"
            }
          ]
        },
        "additional_authorization_parameters": {
          "description": "Additional parameters to include in the authorization request\n\nOrders of the keys are not preserved.",
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "TokenAuthMethod": {
      "description": "Authentication methods used against the OAuth 2.0 provider",
      "oneOf": [
        {
          "description": "`none`: No authentication",
          "type": "string",
          "enum": [
            "none"
          ]
        },
        {
          "description": "`client_secret_basic`: `client_id` and `client_secret` used as basic authorization credentials",
          "type": "string",
          "enum": [
            "client_secret_basic"
          ]
        },
        {
          "description": "`client_secret_post`: `client_id` and `client_secret` sent in the request body",
          "type": "string",
          "enum": [
            "client_secret_post"
          ]
        },
        {
          "description": "`client_secret_jwt`: a `client_assertion` sent in the request body and signed using the `client_secret`",
          "type": "string",
          "enum": [
            "client_secret_jwt"
          ]
        },
        {
          "description": "`private_key_jwt`: a `client_assertion` sent in the request body and signed by an asymmetric key",
          "type": "string",
          "enum": [
            "private_key_jwt"
          ]
        }
      ]
    },
    "DiscoveryMode": {
      "description": "How to discover the provider's configuration",
      "oneOf": [
        {
          "description": "Use OIDC discovery with strict metadata verification",
          "type": "string",
          "enum": [
            "oidc"
          ]
        },
        {
          "description": "Use OIDC discovery with relaxed metadata verification",
          "type": "string",
          "enum": [
            "insecure"
          ]
        },
        {
          "description": "Use a static configuration",
          "type": "string",
          "enum": [
            "disabled"
          ]
        }
      ]
    },
    "PkceMethod": {
      "description": "Whether to use proof key for code exchange (PKCE) when requesting and exchanging the token.",
      "oneOf": [
        {
          "description": "Use PKCE if the provider supports it\n\nDefaults to no PKCE if provider discovery is disabled",
          "type": "string",
          "enum": [
            "auto"
          ]
        },
        {
          "description": "Always use PKCE with the S256 challenge method",
          "type": "string",
          "enum": [
            "always"
          ]
        },
        {
          "description": "Never use PKCE",
          "type": "string",
          "enum": [
            "never"
          ]
        }
      ]
    },
    "ClaimsImports": {
      "description": "How claims should be imported",
      "type": "object",
      "properties": {
        "subject": {
          "description": "How to determine the subject of the user",
          "allOf": [
            {
              "$ref": "#/definitions/SubjectImportPreference"
            }
          ]
        },
        "localpart": {
          "description": "Import the localpart of the MXID",
          "allOf": [
            {
              "$ref": "#/definitions/LocalpartImportPreference"
            }
          ]
        },
        "displayname": {
          "description": "Import the displayname of the user.",
          "allOf": [
            {
              "$ref": "#/definitions/DisplaynameImportPreference"
            }
          ]
        },
        "email": {
          "description": "Import the email address of the user based on the `email` and `email_verified` claims",
          "allOf": [
            {
              "$ref": "#/definitions/EmailImportPreference"
            }
          ]
        }
      }
    },
    "SubjectImportPreference": {
      "description": "What should be done for the subject attribute",
      "type": "object",
      "properties": {
        "template": {
          "description": "The Jinja2 template to use for the subject attribute\n\nIf not provided, the default template is `{{ user.sub }}`",
          "type": "string"
        }
      }
    },
    "LocalpartImportPreference": {
      "description": "What should be done for the localpart attribute",
      "type": "object",
      "properties": {
        "action": {
          "description": "How to handle the attribute",
          "allOf": [
            {
              "$ref": "#/definitions/ImportAction"
            }
          ]
        },
        "template": {
          "description": "The Jinja2 template to use for the localpart attribute\n\nIf not provided, the default template is `{{ user.preferred_username }}`",
          "type": "string"
        }
      }
    },
    "ImportAction": {
      "description": "How to handle a claim",
      "oneOf": [
        {
          "description": "Ignore the claim",
          "type": "string",
          "enum": [
            "ignore"
          ]
        },
        {
          "description": "Suggest the claim value, but allow the user to change it",
          "type": "string",
          "enum": [
            "suggest"
          ]
        },
        {
          "description": "Force the claim value, but don't fail if it is missing",
          "type": "string",
          "enum": [
            "force"
          ]
        },
        {
          "description": "Force the claim value, and fail if it is missing",
          "type": "string",
          "enum": [
            "require"
          ]
        }
      ]
    },
    "DisplaynameImportPreference": {
      "description": "What should be done for the displayname attribute",
      "type": "object",
      "properties": {
        "action": {
          "description": "How to handle the attribute",
          "allOf": [
            {
              "$ref": "#/definitions/ImportAction"
            }
          ]
        },
        "template": {
          "description": "The Jinja2 template to use for the displayname attribute\n\nIf not provided, the default template is `{{ user.name }}`",
          "type": "string"
        }
      }
    },
    "EmailImportPreference": {
      "description": "What should be done with the email attribute",
      "type": "object",
      "properties": {
        "action": {
          "description": "How to handle the claim",
          "allOf": [
            {
              "$ref": "#/definitions/ImportAction"
            }
          ]
        },
        "template": {
          "description": "The Jinja2 template to use for the email address attribute\n\nIf not provided, the default template is `{{ user.email }}`",
          "type": "string"
        },
        "set_email_verification": {
          "description": "Should the email address be marked as verified",
          "allOf": [
            {
              "$ref": "#/definitions/SetEmailVerification"
            }
          ]
        }
      }
    },
    "SetEmailVerification": {
      "description": "Should the email address be marked as verified",
      "oneOf": [
        {
          "description": "Mark the email address as verified",
          "type": "string",
          "enum": [
            "always"
          ]
        },
        {
          "description": "Don't mark the email address as verified",
          "type": "string",
          "enum": [
            "never"
          ]
        },
        {
          "description": "Mark the email address as verified if the upstream provider says it is through the `email_verified` claim",
          "type": "string",
          "enum": [
            "import"
          ]
        }
      ]
    },
    "BrandingConfig": {
      "description": "Configuration section for tweaking the branding of the service",
      "type": "object",
      "properties": {
        "service_name": {
          "description": "A human-readable name. Defaults to the server's address.",
          "type": "string"
        },
        "policy_uri": {
          "description": "Link to a privacy policy, displayed in the footer of web pages and emails. It is also advertised to clients through the `op_policy_uri` OIDC provider metadata.",
          "type": "string",
          "format": "uri"
        },
        "tos_uri": {
          "description": "Link to a terms of service document, displayed in the footer of web pages and emails. It is also advertised to clients through the `op_tos_uri` OIDC provider metadata.",
          "type": "string",
          "format": "uri"
        },
        "imprint": {
          "description": "Legal imprint, displayed in the footer in the footer of web pages and emails.",
          "type": "string"
        },
        "logo_uri": {
          "description": "Logo displayed in some web pages.",
          "type": "string",
          "format": "uri"
        }
      }
    },
    "CaptchaConfig": {
      "description": "Configuration section to setup CAPTCHA protection on a few operations",
      "type": "object",
      "properties": {
        "service": {
          "description": "Which service should be used for CAPTCHA protection",
          "allOf": [
            {
              "$ref": "#/definitions/CaptchaServiceKind"
            }
          ]
        },
        "site_key": {
          "description": "The site key to use",
          "type": "string"
        },
        "secret_key": {
          "description": "The secret key to use",
          "type": "string"
        }
      }
    },
    "CaptchaServiceKind": {
      "description": "Which service should be used for CAPTCHA protection",
      "oneOf": [
        {
          "description": "Use Google's reCAPTCHA v2 API",
          "type": "string",
          "enum": [
            "recaptcha_v2"
          ]
        },
        {
          "description": "Use Cloudflare Turnstile",
          "type": "string",
          "enum": [
            "cloudflare_turnstile"
          ]
        },
        {
          "description": "Use ``HCaptcha``",
          "type": "string",
          "enum": [
            "hcaptcha"
          ]
        }
      ]
    },
    "AccountConfig": {
      "description": "Configuration section to configure features related to account management",
      "type": "object",
      "properties": {
        "email_change_allowed": {
          "description": "Whether users are allowed to change their email addresses. Defaults to `true`.",
          "type": "boolean"
        },
        "displayname_change_allowed": {
          "description": "Whether users are allowed to change their display names. Defaults to `true`.\n\nThis should be in sync with the policy in the homeserver configuration.",
          "type": "boolean"
        },
        "password_registration_enabled": {
          "description": "Whether to enable self-service password registration. Defaults to `false` if password authentication is enabled.\n\nThis has no effect if password login is disabled.",
          "type": "boolean"
        },
        "password_change_allowed": {
          "description": "Whether users are allowed to change their passwords. Defaults to `true`.\n\nThis has no effect if password login is disabled.",
          "type": "boolean"
        },
        "password_recovery_enabled": {
          "description": "Whether email-based password recovery is enabled. Defaults to `false`.\n\nThis has no effect if password login is disabled.",
          "type": "boolean"
        }
      }
    },
    "ExperimentalConfig": {
      "description": "Configuration sections for experimental options\n\nDo not change these options unless you know what you are doing.",
      "type": "object",
      "properties": {
        "access_token_ttl": {
          "description": "Time-to-live of access tokens in seconds. Defaults to 5 minutes.",
          "type": "integer",
          "format": "uint64",
          "maximum": 86400.0,
          "minimum": 60.0
        },
        "compat_token_ttl": {
          "description": "Time-to-live of compatibility access tokens in seconds. Defaults to 5 minutes.",
          "type": "integer",
          "format": "uint64",
          "maximum": 86400.0,
          "minimum": 60.0
        }
      }
    }
  }
}