Update package version to 1.120.3

chore(deps): update dependency matrix-org/synapse-s3-storage-provider to v1.6.0
| datasource | package | from | to | | --------------- | -------------------------------------- | ----- | ----- | | github-releases | matrix-org/synapse-s3-storage-provider | 1.5.0 | 1.6.0 |
2025-10-11 08:49:00 +00:00 · 2025-10-11 06:19:39 +00:00 · 2025-10-09 07:44:51 +00:00 · 2025-10-09 06:19:41 +00:00 · 2025-10-07 16:56:40 +00:00 · 2025-10-07 15:18:55 +00:00
12 changed files with 3785 additions and 2112 deletions
--- a/240
+++ b/240
@@ -1,240 +0,0 @@
 [0.1.0]
 * Initial version
 [0.1.1]
 * Removed the Riot part of the installation due to security
 * Changed from Sqlite to Postgres
 * Added LDAP support
 * Fixed upload limit in nginx_matrix.conf
 * Added bogus index.html so cloudron recognizes the matrix server as online
 * Added coturn as TURN server
 [0.1.2]
 * Updated logo (transparent)
 * Enabled email settings
 [0.1.3]
 * Changed log location of nginx due to backup crashes
 [0.1.4]
 * Changed log location of synapse due to backup crashes
 * Updated some configs
 [0.1.5]
 * Update to synapse v0.31.2
 [0.1.6]
 * Update to synapse v0.33.8
 [0.1.7]
 * Update to synapse v0.33.9
 [0.1.8]
 * Update to synapse v0.99.0
 * Fixed missing LDAP stuff
 [0.1.9]
 * Update to synapse v0.99.3
 [0.2.0]
 * Update to synapse v0.99.4
 [0.2.1]
 * Update to synapse v0.99.5.1
 [0.2.2]
 * Update to synapse v0.99.5.2
 [0.2.3]
 * Update to synapse v1.0.0
 * Fixed url preview
 * Fixed voip
 [0.2.4]
 * Fixed federation
 [0.2.5]
 * Update to synapse v1.1.0
 [0.2.6]
 * Update to synapse v1.2.1
 [0.2.7]
 * Update to synapse v1.3.0
 [0.2.8]
 * Update to synapse v1.3.1
 [0.2.9]
 * Update to synapse v1.4.0 (lots of changes)
 [0.3.0]
 * Update to synapse v1.4.1
 [0.3.1]
 * Update to synapse v1.5.1
 [0.3.3]
 * Update to synapse v1.6.0
 [0.3.4]
 * Update to synapse v1.6.1
 [0.3.5]
 * Update to synapse v1.8.0
 [0.3.6]
 * Update to synapse v1.9.1
 [0.3.7]
 * Update to synapse v1.10.0
 [0.3.8]
 * Update to synapse v1.11.0
 [0.4.0]
 * Update to synapse v1.12.0
 [0.4.1]
 * Update to synapse v1.12.2
 [0.5.0]
 * New reworked app
 [0.6.0]
 * Fix title
 [0.7.0]
 * Set turn_uris to an array and not a string
 [0.7.1]
 * Users will now automatically join the #discuss channel (only in new installations)
 [1.0.0]
 * Use latest base image
 * Update to synapse v1.12.4
 [1.1.0]
 * Update Synapse to 1.13.0
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.13.0)
 * Set Referrer-Policy header to no-referrer on media downloads. (#7009)
 * Admin API POST /_synapse/admin/v1/join/<roomIdOrAlias> to join users to a room like auto_join_rooms for creation of users. (#7051)
 * Add options to prevent users from changing their profile or associated 3PIDs. (#7096)
 * Allow server admins to define and enforce a password policy (MSC2000). (#7118)
 * Improve the support for SSO authentication on the login fallback page. (#7152, #7235)
 * Always whitelist the login fallback in the SSO configuration if public_baseurl is set. (#7153)
 * Admin users are no longer required to be in a room to create an alias for it. (#7191)
 * Require admin privileges to enable room encryption by default. This does not affect existing rooms. (#7230)
 [1.2.0]
 * Update Synapse to 1.14.0
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.14.0)
 [1.3.0]
 * Add optional sso support
 [1.4.0]
 * Update Synapse to 1.15.1
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.15.0)
 * Advertise support for Client-Server API r0.6.0 and remove related unstable feature flags. (#6585)
 * Add an option to disable autojoining rooms for guest accounts. (#6637)
 * Add admin APIs to allow server admins to manage users' devices. Contributed by @dklimpel. (#7481)
 * Add support for generating thumbnails for WebP images. Previously, users would see an empty box instead of preview image. Contributed by @WGH-. (#7586)
 * Support the standardized m.login.sso user-interactive authentication flow. (#7630)
 [1.5.0]
 * Update Synapse to 1.15.2
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.15.2)
 * A malicious homeserver could force Synapse to reset the state in a room to a small subset of the correct state. This affects all Synapse deployments which federate with untrusted servers. (96e9afe6)
 * HTML pages served via Synapse were vulnerable to clickjacking attacks. This predominantly affects homeservers with single-sign-on enabled, but all server administrators are encouraged to upgrade. (ea26e9a9)
 [1.6.0]
 * Update Synapse to 1.16.0
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.16.0)
 * Add an option to enable encryption by default for new rooms. (#7639)
 * Add support for running multiple media repository workers. See docs/workers.md for instructions. (#7706)
 * Media can now be marked as safe from quarantined. (#7718)
 * Expand the configuration options for auto-join rooms. (#7763)
 [1.6.1]
 * Update Synapse to 1.16.1
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.16.1)
 * Drop table local_rejections_stream which was incorrectly added in Synapse 1.16.0. (#7816, b1beb3ff5)
 [1.7.0]
 * Update Synapse to 1.17.0
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.17.0)
 * Fix inconsistent handling of upper and lower case in email addresses when used as identifiers for login, etc. Contributed by @dklimpel. (#7021)
 * Fix "Tried to close a non-active scope!" error messages when opentracing is enabled. (#7732)
 * Fix incorrect error message when database CTYPE was set incorrectly. (#7760)
 * Fix to not ignore set_tweak actions in Push Rules that have no value, as permitted by the specification. (#7766)
 * Fix synctl to handle empty config files correctly. Contributed by @kotovalexarian. (#7779)
 * Fixes a long standing bug in worker mode where worker information was saved in the devices table instead of the original IP address and user agent. (#7797)
 * Fix 'stuck invites' which happen when we are unable to reject a room invite received over federation. (#7804, #7809, #7810)
 [1.8.0]
 * Update Synapse to 1.18.0
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.18.0)
 * Include room states on invite events that are sent to application services. Contributed by @Sorunome. (#6455)
 * Add delete room admin endpoint (POST /_synapse/admin/v1/rooms/<room_id>/delete). Contributed by @dklimpel. (#7613, #7953)
 * Add experimental support for running multiple federation sender processes. (#7798)
 * Add the option to validate the iss and aud claims for JWT logins. (#7827)
 * Add support for handling registration requests across multiple client reader workers. (#7830)
 * Add an admin API to list the users in a room. Contributed by Awesome Technologies Innovationslabor GmbH. (#7842)
 * Allow email subjects to be customised through Synapse's configuration. (#7846)
 * Add the ability to re-activate an account from the admin API. (#7847, #7908)
 * Support oEmbed for media previews. (#7920)
 [1.9.0]
 * Update Synapse to 1.19.0
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.19.0)
 * Add option to allow server admins to join rooms which fail complexity checks. Contributed by @lugino-emeritus. (#7902)
 * Add an option to purge room or not with delete room admin endpoint (POST /_synapse/admin/v1/rooms/<room_id>/delete). Contributed by @dklimpel. (#7964)
 * Add rate limiting to users joining rooms. (#8008)
 * Add a /health endpoint to every configured HTTP listener that can be used as a health check endpoint by load balancers. (#8048)
 * Allow login to be blocked based on the values of SAML attributes. (#8052)
 * Allow guest access to the GET /_matrix/client/r0/rooms/{room_id}/members endpoint, according to MSC2689. Contributed by Awesome Technologies Innovationslabor GmbH. (#7314)
 [1.9.1]
 * Update Synapse to 1.19.1
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.19.1)
 * Fix a bug introduced in v1.19.0 where appservices with ratelimiting disabled would still be ratelimited when joining rooms. (#8139)
 * Fix a bug introduced in v1.19.0 that would cause e.g. profile updates to fail due to incorrect application of rate limits on join requests. (#8153)
 [1.10.0]
 * Update Synapse to 1.19.3
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.19.3)
 * Partially mitigate bug where newly joined servers couldn't get past events in a room when there is a malformed event. (#8350)
 * Make index.html customizable
 [1.11.0]
 * Update Synapse to 1.20.1
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.20.0)
 * Add an endpoint to query your shared rooms with another user as an implementation of MSC2666. (#7785)
 * Iteratively encode JSON to avoid blocking the reactor. (#8013, #8116)
 * Add support for shadow-banning users (ignoring any message send requests). (#8034, #8092, #8095, #8142, #8152, #8157, #8158, #8176)
 * Use the default template file when its equivalent is not found in a custom template directory. (#8037, #8107, #8252)
 * Add unread messages count to sync responses, as specified in MSC2654. (#8059, #8254, #8270, #8274)
 * Optimise /federation/v1/user/devices/ API by only returning devices with encryption keys. (#8198)
 [1.12.0]
 * Update Synapse to 1.21.0
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.21.0)
 * Require the user to confirm that their password should be reset after clicking the email confirmation link. (#8004)
 * Add an admin API GET /_synapse/admin/v1/event_reports to read entries of table event_reports. Contributed by @dklimpel. (#8217)
 * Consolidate the SSO error template across all configuration. (#8248, #8405)
 * Add a configuration option to specify a whitelist of domains that a user can be redirected to after validating their email or phone number. (#8275, #8417)
 * Add experimental support for sharding event persister. (#8294, #8387, #8396, #8419)
 * Add the room topic and avatar to the room details admin API. (#8305)
 * Add an admin API for querying rooms where a user is a member. Contributed by @dklimpel. (#8306)
 [1.12.1]
 * Updat Synapse to 1.21.1
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.21.1)
 [1.12.2]
 * Update Synapse to 1.21.2
 * [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.21.2)
 * Security: HTML pages served via Synapse were vulnerable to cross-site scripting (XSS) attacks. All server administrators are encouraged to upgrade
 * Fix rare bug where sending an event would fail due to a racey assertion. (#8530)
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/CloudronManifest.json
+++ b/CloudronManifest.json
@@ -3,35 +3,59 @@
  "title": "Matrix Synapse",
  "author": "Matrix synapse authors",
  "description": "file://DESCRIPTION.md",
-  "changelog": "file://CHANGELOG",
+  "changelog": "file://CHANGELOG.md",
  "tagline": "Secure & decentralized communication",
-  "version": "1.12.2",
+  "version": "1.120.3",
  "upstreamVersion": "1.6.0",
  "healthCheckPath": "/",
  "httpPort": 8008,
  "memoryLimit": 536870912,
  "addons": {
    "localstorage": {},
-    "ldap": {},
+    "oidc": {
      "loginRedirectUri": "/_synapse/client/oidc/callback"
    },
    "postgresql": {},
-    "sendmail": {},
+    "sendmail": {
-    "turn": {}
+      "supportsDisplayName": true
    },
    "turn": {
      "optional": true
    }
  },
  "manifestVersion": 2,
  "website": "https://matrix.org",
  "contactEmail": "support@cloudron.io",
  "icon": "file://logo.png",
  "tags": [
-    "im", "collaboration", "voip", "videochat", "chat", "slack", "zulip"
+    "im",
    "collaboration",
    "voip",
    "videochat",
    "chat",
    "slack",
    "zulip",
    "federated",
    "element",
    "riot"
  ],
  "mediaLinks": [
    "https://screenshots.cloudron.io/org.matrix.synapse/1.png",
    "https://screenshots.cloudron.io/org.matrix.synapse/2.png",
    "https://screenshots.cloudron.io/org.matrix.synapse/3.png"
  ],
-  "changelog": "file://CHANGELOG",
+  "checklist": {
    "configure-federation": {
      "message": "For federation to work, the delegation URI `https://$CLOUDRON-APP-DOMAIN/.well-known/matrix/server` must be configured. See the [docs](https://docs.cloudron.io/apps/synapse/#post-installation) on how to do this."
    },
    "registration-enabled-without-verification": {
      "message": "Registration is enabled but verification is disabled. See [docs](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html?highlight=registration_require#enable_registration) for more information",
      "sso": false
    }
  },
  "postInstallMessage": "file://POSTINSTALL.md",
-  "minBoxVersion": "5.3.0",
+  "minBoxVersion": "8.2.0",
  "forumUrl": "https://forum.cloudron.io/category/50/matrix-synapse-riot",
-  "documentationUrl": "https://docs.cloudron.io/apps/synapse/",
+  "documentationUrl": "https://docs.cloudron.io/packages/synapse/",
  "optionalSso": true
 }
--- a/DESCRIPTION.md
+++ b/DESCRIPTION.md
@@ -1,12 +1,10 @@
 This app packages Synapse <upstream>1.21.2</upstream>.
 **This package only provides the Matrix backend. A variety of clients are available
 [here](https://matrix.org/clients/). Riot is a popular web frontend for Matrix and
 is available as a separate app.**
-Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP.
+## About
-## Matrix
+Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP.
 Matrix specifies a set of pragmatic RESTful HTTP JSON APIs as an open standard, which handle:
@@ -18,7 +16,7 @@ Matrix specifies a set of pragmatic RESTful HTTP JSON APIs as an open standard,
 * Using 3rd Party IDs (3PIDs) such as email addresses, phone numbers, Facebook accounts to authenticate, identify and discover users on Matrix.
 * Placing 1:1 VoIP and Video calls
-## Synapse
+## What is Synapse?
 Synapse is a reference "homeserver" implementation of Matrix from the core development
 team at matrix.org, written in Python/Twisted.
--- a/27
+++ b/27
@@ -1,28 +1,27 @@
-FROM cloudron/base:2.0.0@sha256:f9fea80513aa7c92fe2e7bf3978b54c8ac5222f47a9a32a7f8833edf0eb5a4f4
+FROM cloudron/base:5.0.0@sha256:04fd70dbd8ad6149c19de39e35718e024417c3e01dc9c6637eaf4a41ec4e596c
 RUN mkdir -p /app/pkg
 WORKDIR /app/code
-ARG VERSION=v1.21.2
+# https://github.com/element-hq/synapse/blob/master/docs/setup/installation.md?plain=1#L202
 RUN python3 -m venv /app/code/env
-# https://pythonspeed.com/articles/activate-virtualenv-dockerfile/
+# renovate: datasource=github-releases depName=element-hq/synapse versioning=semver extractVersion=^v(?<version>.+)$
-RUN virtualenv -p python3 /app/code/env
+ARG SYNAPSE_VERSION=1.139.2
-ENV VIRTUAL_ENV=/app/code/env
+
-ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+# renovate: datasource=github-releases depName=matrix-org/synapse-s3-storage-provider versioning=semver extractVersion=^v(?<version>.+)$
 ARG S3PROVIDER_VERSION=1.6.0
 # Synapse (https://github.com/matrix-org/synapse/blob/master/INSTALL.md)
 # lxml - required for previews
-RUN pip install --upgrade pip && \
+RUN source /app/code/env/bin/activate && \
-    pip install --upgrade setuptools && \
+    pip3 install --no-cache-dir matrix-synapse==v${SYNAPSE_VERSION} psycopg2-binary python-ldap matrix-synapse-ldap3 lxml publicsuffix2 git+https://github.com/matrix-org/synapse-s3-storage-provider.git@v${S3PROVIDER_VERSION} matrix-synapse[oidc]
    pip install matrix-synapse==${VERSION} psycopg2-binary python-ldap matrix-synapse-ldap3 lxml publicsuffix2
-RUN curl -sL https://github.com/mikefarah/yq/releases/download/3.2.1/yq_linux_amd64 -o /usr/bin/yq && \
+# Updated suffix list
-    chmod +x /usr/bin/yq
+RUN curl -L https://publicsuffix.org/list/public_suffix_list.dat -o /app/code/env/lib/python3.12/site-packages/publicsuffix2/public_suffix_list.dat
-RUN ln -sf /app/data/index.html /app/code/env/lib/python3.6/site-packages/synapse/static/index.html
+RUN ln -sf /app/data/index.html /app/code/env/lib/python3.12/site-packages/synapse/static/index.html
 RUN chown -R cloudron.cloudron /app/code
 ADD index.html homeserver.yaml.template start.sh /app/pkg/
--- a/POSTINSTALL.md
+++ b/POSTINSTALL.md
@@ -1,8 +1,2 @@
 Account ids are created with the username and the second level domain under which the
-app is installed e.g. `@$CLOUDRON-USERNAME@$CLOUDRON-APP-DOMAIN`.
+app is installed e.g. `@$CLOUDRON-USERNAME:$CLOUDRON-APP-DOMAIN`.
 For federation to work, the second level domain has to be configured to serve up the
 `.well-known/domain.com/matrix` URI. See the 
 [federation docs](https://cloudron.io/documentation/apps/synapse/) on
 how to do this.
--- a/homeserver.yaml.template
+++ b/homeserver.yaml.template
@@ -1,4 +1,4 @@
-# https://github.com/matrix-org/synapse/blob/master/docs/sample_config.yaml
+# https://github.com/element-hq/synapse/blob/master/docs/sample_config.yaml
 # if you change this, change the auto_join_rooms below as well
 server_name: "example.com"
@@ -13,7 +13,6 @@ listeners:
    type: http
    x_forwarded: true
    bind_addresses: ['0.0.0.0']
    resources:
      - names: [client,federation]
        compress: false
@@ -21,7 +20,6 @@ listeners:
 database:
  name: "psycopg2"
  args:
    # Path to the database
    user: ${POSTGRESQL_USERNAME}
    password: ${POSTGRESQL_PASSWORD}
    database: ${POSTGRESQL_DATABASE}
@@ -29,6 +27,17 @@ database:
    cp_min: 5
    cp_max: 10
 log_config: "/app/data/configs/log.config"
 media_store_path: "/app/data/data/media_store"
 registration_shared_secret: "some_shared_secret"
 report_stats: false
 macaroon_secret_key: "some_macaroon_secret"
 form_secret: "some_form_secret"
 signing_key_path: "/app/data/configs/signing.key"
 trusted_key_servers:
  - server_name: "matrix.org"
 ## Cloudron packaging
 email:
    smtp_host: mail.server
    smtp_port: 587
@@ -40,73 +49,37 @@ email:
    enable_notifs: true
    notif_for_new_users: true
 password_providers:
    - module: "synapse.util.ldap_auth_provider.LdapAuthProvider"
      config:
        enabled: true
        uri: "ldap://ldap.example.com:389"
        start_tls: true
        base: "ou=users,dc=example,dc=com"
        attributes:
           uid: "username"
           mail: "mail"
           name: "username"
        bind_dn: "ou=users,dc=cloudron"
        bind_password: "password"
        filter: "(objectClass=posixAccount)"
 # turn
 turn_uris: []
 turn_shared_secret: "sharedsecret"
 turn_allow_guests: true
-federation_ip_range_blacklist:
+# sso (https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#single-sign-on-integration)
  - '127.0.0.0/8'
  - '10.0.0.0/8'
  - '172.16.0.0/12'
  - '192.168.0.0/16'
  - '100.64.0.0/10'
  - '169.254.0.0/16'
  - '::1/128'
  - 'fe80::/64'
  - 'fc00::/7'
 enable_registration: false
-registration_shared_secret: "somesecret"
+# without this, registration requires one of email/captcha/token verification
-allow_guest_access: false
+enable_registration_without_verification: true
-enable_group_creation: true
+oidc_providers:
-
+  - idp_id: cloudron
-report_stats: False
+    idp_name: "CLOUDRON_OIDC_PROVIDER_NAME"
-
+    issuer: "CLOUDRON_OIDC_ISSUER"
-signing_key_path: "/app/data/configs/signing.key"
+    client_id: "CLOUDRON_OIDC_CLIENT_ID"
-
+    client_secret: "CLOUDRON_OIDC_CLIENT_SECRET"
-url_preview_enabled: true
+    scopes: ["openid", "profile", "email"]
-url_preview_ip_range_blacklist:
+    authorization_endpoint: "CLOUDRON_OIDC_AUTH_ENDPOINT"
-  - '127.0.0.0/8'
+    token_endpoint: "CLOUDRON_OIDC_TOKEN_ENDPOINT"
-  - '10.0.0.0/8'
+    userinfo_endpoint: "CLOUDRON_OIDC_AUTH_ENDPOINT"
-  - '172.16.0.0/12'
+    allow_existing_users: true
-  - '192.168.0.0/16'
+    enable_registration: true
-  - '100.64.0.0/10'
+    backchannel_logout_enabled: false
-  - '169.254.0.0/16'
+    user_mapping_provider:
-  - '::1/128'
+      config:
-  - 'fe80::/64'
+        localpart_template: "{{ user.sub }}"
-  - 'fc00::/7'
+        display_name_template: "{{ user.name }}"
-
+        email_template: "{{ user.email }}"
 media_store_path: "/app/data/data/media_store"
 max_upload_size: 200M
 max_image_pixels: "32M"
 dynamic_thumbnails: false
 autocreate_auto_join_rooms: true
 auto_join_rooms:
  - "#discuss:example.com"
 trusted_key_servers:
  - server_name: "matrix.org"
 suppress_key_server_warning: true
 password_config:
-   enabled: true
+    enabled: false
-   localdb_enabled: false
+    localdb_enabled: false
    pepper: "some_pepper_secret"
--- a/renovate.json5
+++ b/renovate.json5
@@ -0,0 +1,4 @@
 {
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": ["local>devops/renovator//default.renovate.json5"]
 }
--- a/start.sh
+++ b/start.sh
@@ -4,6 +4,8 @@ set -eu
 mkdir -p /app/data/data /app/data/configs /run/synapse
 source /app/code/env/bin/activate
 if [[ ! -f /app/data/configs/homeserver.yaml ]]; then
    echo "==> Detected first run"
@@ -16,67 +18,89 @@ if [[ ! -f /app/data/configs/homeserver.yaml ]]; then
        --config-directory /app/data/configs \
        --data-directory /app/data/data \
        --generate-config \
-        --report-stats=no 
+        --report-stats=no
    # fix logging configuration
    cp /app/pkg/homeserver.yaml.template /app/data/configs/homeserver.yaml
    mv /app/data/configs/${server_name}.log.config /app/data/configs/log.config
-    yq w -i /app/data/configs/homeserver.yaml log_config /app/data/configs/log.config
+    yq eval -i ".log_config=\"/app/data/configs/log.config\"" /app/data/configs/homeserver.yaml
-    yq w -i /app/data/configs/log.config handlers.file.filename /run/synapse/homeserver.log
+
    # delete default file and buffer handlers
    yq eval -i "del(.handlers.file)" /app/data/configs/log.config
    yq eval -i "del(.handlers.buffer)" /app/data/configs/log.config
    mv /app/data/configs/${server_name}.signing.key /app/data/configs/signing.key
-    yq w -i /app/data/configs/homeserver.yaml server_name "${server_name}"
+    yq eval -i ".server_name=\"${server_name}\"" /app/data/configs/homeserver.yaml
-    yq w -i /app/data/configs/homeserver.yaml registration_shared_secret "$(pwgen -1s 64)"
+    yq eval -i ".registration_shared_secret=\"$(pwgen -1s 64)\"" /app/data/configs/homeserver.yaml
    yq eval -i ".macaroon_secret_key=\"$(pwgen -1s 64)\"" /app/data/configs/homeserver.yaml
    yq eval -i ".form_secret=\"$(pwgen -1s 64)\"" /app/data/configs/homeserver.yaml
-    yq w -i /app/data/configs/homeserver.yaml auto_join_rooms "[]"
+    if [[ -z "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
-    yq w -i /app/data/configs/homeserver.yaml auto_join_rooms\[0\] "#discuss:${server_name}"
+        yq eval -i ".enable_registration=true" /app/data/configs/homeserver.yaml
-
+        yq eval -i ".password_config.enabled=true" /app/data/configs/homeserver.yaml
-    if [[ -z "${CLOUDRON_LDAP_SERVER:-}" ]]; then
+        yq eval -i ".password_config.localdb_enabled=true" /app/data/configs/homeserver.yaml
-        yq w -i /app/data/configs/homeserver.yaml enable_registration true
+        yq eval -i "del(.oidc_providers)" /app/data/configs/homeserver.yaml
        yq w -i /app/data/configs/homeserver.yaml password_config.pepper "$(pwgen -1s 12)"
    fi
    yq eval -i ".password_config.pepper=\"$(pwgen -1s 12)\"" /app/data/configs/homeserver.yaml # always set this so that users can enable password login if needed
 fi
 echo "==> Ensure we log to console"
 yq eval -i ".root.handlers=[\"console\"]" /app/data/configs/log.config
 yq eval -i ".loggers.twisted.handlers=[\"console\"]" /app/data/configs/log.config
 [[ ! -f /app/data/index.html ]] && cp /app/pkg/index.html /app/data/index.html
 echo "==> Configuring synapse"
-yq w -i /app/data/configs/homeserver.yaml public_baseurl "${CLOUDRON_APP_ORIGIN}"
+yq eval -i ".public_baseurl=\"${CLOUDRON_APP_ORIGIN}\"" /app/data/configs/homeserver.yaml
 # database
-yq w -i /app/data/configs/homeserver.yaml database.args.user "${CLOUDRON_POSTGRESQL_USERNAME}"
+yq eval -i ".database.args.user=\"${CLOUDRON_POSTGRESQL_USERNAME}\"" /app/data/configs/homeserver.yaml
-yq w -i /app/data/configs/homeserver.yaml database.args.password "${CLOUDRON_POSTGRESQL_PASSWORD}"
+yq eval -i ".database.args.password=\"${CLOUDRON_POSTGRESQL_PASSWORD}\"" /app/data/configs/homeserver.yaml
-yq w -i /app/data/configs/homeserver.yaml database.args.database "${CLOUDRON_POSTGRESQL_DATABASE}"
+yq eval -i ".database.args.database=\"${CLOUDRON_POSTGRESQL_DATABASE}\"" /app/data/configs/homeserver.yaml
-yq w -i /app/data/configs/homeserver.yaml database.args.host "${CLOUDRON_POSTGRESQL_HOST}"
+yq eval -i ".database.args.host=\"${CLOUDRON_POSTGRESQL_HOST}\"" /app/data/configs/homeserver.yaml
 # email
-yq w -i /app/data/configs/homeserver.yaml email.smtp_host "${CLOUDRON_MAIL_SMTP_SERVER}"
+yq eval -i ".email.smtp_host=\"${CLOUDRON_MAIL_SMTP_SERVER}\"" /app/data/configs/homeserver.yaml
-yq w -i /app/data/configs/homeserver.yaml email.smtp_port "${CLOUDRON_MAIL_SMTP_PORT}"
+yq eval -i ".email.smtp_port=${CLOUDRON_MAIL_SMTP_PORT}" /app/data/configs/homeserver.yaml
-yq w -i /app/data/configs/homeserver.yaml email.smtp_user "${CLOUDRON_MAIL_SMTP_USERNAME}"
+yq eval -i ".email.smtp_user=\"${CLOUDRON_MAIL_SMTP_USERNAME}\"" /app/data/configs/homeserver.yaml
-yq w -i /app/data/configs/homeserver.yaml email.smtp_pass "${CLOUDRON_MAIL_SMTP_PASSWORD}"
+yq eval -i ".email.smtp_pass=\"${CLOUDRON_MAIL_SMTP_PASSWORD}\"" /app/data/configs/homeserver.yaml
-yq w -i /app/data/configs/homeserver.yaml email.notif_from "%(app)s <${CLOUDRON_MAIL_FROM}>"
+yq eval -i ".email.notif_from=\"${CLOUDRON_MAIL_FROM_DISPLAY_NAME:-Matrix} <${CLOUDRON_MAIL_FROM}>\"" /app/data/configs/homeserver.yaml
-# ldap
+# oidc
-if [[ -n "${CLOUDRON_LDAP_SERVER:-}" ]]; then
+if [[ -n "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.uri' "${CLOUDRON_LDAP_URL}"
+    echo " ==> Configuring OIDC auth"
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.start_tls' false
+    yq eval -i ".oidc_providers[0].idp_id=\"cloudron\"" /app/data/configs/homeserver.yaml
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.base' "${CLOUDRON_LDAP_USERS_BASE_DN}"
+    yq eval -i ".oidc_providers[0].idp_name=\"${CLOUDRON_OIDC_PROVIDER_NAME:-Cloudron}\"" /app/data/configs/homeserver.yaml
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.bind_dn' "${CLOUDRON_LDAP_BIND_DN}"
+    yq eval -i ".oidc_providers[0].issuer=\"${CLOUDRON_OIDC_ISSUER}\"" /app/data/configs/homeserver.yaml
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.bind_password' "${CLOUDRON_LDAP_BIND_PASSWORD}"
+    yq eval -i ".oidc_providers[0].client_id=\"${CLOUDRON_OIDC_CLIENT_ID}\"" /app/data/configs/homeserver.yaml
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.filter' "(objectClass=user)"
+    yq eval -i ".oidc_providers[0].client_secret=\"${CLOUDRON_OIDC_CLIENT_SECRET}\"" /app/data/configs/homeserver.yaml
    yq eval -i ".oidc_providers[0].scopes=[\"openid\", \"email\", \"profile\"]" /app/data/configs/homeserver.yaml
    yq eval -i ".oidc_providers[0].authorization_endpoint=\"${CLOUDRON_OIDC_AUTH_ENDPOINT}\"" /app/data/configs/homeserver.yaml
    yq eval -i ".oidc_providers[0].token_endpoint=\"${CLOUDRON_OIDC_TOKEN_ENDPOINT}\"" /app/data/configs/homeserver.yaml
    yq eval -i ".oidc_providers[0].userinfo_endpoint=\"${CLOUDRON_OIDC_PROFILE_ENDPOINT}\"" /app/data/configs/homeserver.yaml
    # https://s3lph.me/ldap-to-oidc-migration-3-matrix.html
    yq eval -i ".oidc_providers[0].allow_existing_users=true" /app/data/configs/homeserver.yaml
    yq eval -i ".oidc_providers[0].skip_verification=true" /app/data/configs/homeserver.yaml
    yq eval -i ".oidc_providers[0].user_mapping_provider.config.localpart_template=\"{{ user.sub }}\"" /app/data/configs/homeserver.yaml
    yq eval -i ".oidc_providers[0].user_mapping_provider.config.display_name_template=\"{{ user.name }}\"" /app/data/configs/homeserver.yaml
    yq eval -i ".oidc_providers[0].user_mapping_provider.config.email_template=\"{{ user.email }}\"" /app/data/configs/homeserver.yaml
 else
-    yq w -i /app/data/configs/homeserver.yaml password_config.localdb_enabled true
+    yq eval -i ".password_config.localdb_enabled=true" /app/data/configs/homeserver.yaml
 fi
 # turn (https://github.com/matrix-org/synapse/blob/master/docs/turn-howto.md#synapse-setup)
-yq w -i /app/data/configs/homeserver.yaml turn_uris "[]"
+if [[ -n "${CLOUDRON_TURN_SERVER:-}" ]]; then
-yq w -i /app/data/configs/homeserver.yaml turn_uris\[0\] "turn:${CLOUDRON_TURN_SERVER}:${CLOUDRON_TURN_TLS_PORT}?transport=udp"
+    yq eval -i ".turn_uris=[]" /app/data/configs/homeserver.yaml
-yq w -i /app/data/configs/homeserver.yaml turn_uris\[1\] "turn:${CLOUDRON_TURN_SERVER}:${CLOUDRON_TURN_TLS_PORT}?transport=tcp"
+    yq eval -i ".turn_uris[0]=\"turn:${CLOUDRON_TURN_SERVER}:${CLOUDRON_TURN_TLS_PORT}?transport=udp\"" /app/data/configs/homeserver.yaml
-yq w -i /app/data/configs/homeserver.yaml turn_shared_secret "${CLOUDRON_TURN_SECRET}"
+    yq eval -i ".turn_uris[1]=\"turn:${CLOUDRON_TURN_SERVER}:${CLOUDRON_TURN_TLS_PORT}?transport=tcp\"" /app/data/configs/homeserver.yaml
    yq eval -i ".turn_shared_secret=\"${CLOUDRON_TURN_SECRET}\"" /app/data/configs/homeserver.yaml
 fi
 # fix permissions
 echo "==> Fixing permissions"
-chown -R cloudron.cloudron /app/data /run/synapse
+chown -R cloudron:cloudron /app/data /run/synapse
 echo "==> Starting synapse"
-gosu cloudron:cloudron python3 -m synapse.app.homeserver --config-path /app/data/configs/homeserver.yaml
+exec gosu cloudron:cloudron python3 -m synapse.app.homeserver --config-path /app/data/configs/homeserver.yaml -n
--- a/test/package-lock.json
+++ b/test/package-lock.json
--- a/test/package.json
+++ b/test/package.json
@@ -9,14 +9,9 @@
  "author": "",
  "license": "ISC",
  "dependencies": {
-    "chromedriver": "^86.0.0",
+    "chromedriver": "^141.0.2",
    "ejs": "^3.1.5",
    "expect.js": "^0.3.1",
-    "mkdirp": "^1.0.4",
+    "mocha": "^11.7.4",
-    "mocha": "^8.1.3",
+    "selenium-webdriver": "^4.36.0"
    "rimraf": "^3.0.2",
    "selenium-server-standalone-jar": "^3.141.59",
    "selenium-webdriver": "^3.6.0",
    "superagent": "^6.1.0"
  }
 }
--- a/test/test.js
+++ b/test/test.js
@@ -1,256 +1,417 @@
 #!/usr/bin/env node
-/* jslint node:true */
+/* jshint esversion: 8 */
-/* global it:false */
+/* global it, xit, describe, before, after, afterEach */
 /* global xit:false */
 /* global describe:false */
 /* global before:false */
 /* global after:false */
 'use strict';
 require('chromedriver');
-var execSync = require('child_process').execSync,
+const execSync = require('child_process').execSync,
    expect = require('expect.js'),
    fs = require('fs'),
    path = require('path'),
-    superagent = require('superagent'),
+    { Builder, By, Key, until } = require('selenium-webdriver'),
-    webdriver = require('selenium-webdriver');
+    { Options } = require('selenium-webdriver/chrome');
-var by = require('selenium-webdriver').By,
+if (!process.env.USERNAME || !process.env.PASSWORD) {
-    until = require('selenium-webdriver').until,
+    console.log('USERNAME and PASSWORD env vars need to be set');
-    Key = require('selenium-webdriver').Key;
+    process.exit(1);
 }
 describe('Application life cycle test', function () {
    this.timeout(0);
    var server, browser = new webdriver.Builder().forBrowser('chrome').build();
-    var LOCATION = 'test';
+    const ELEMENT_LOCATION = 'element-test';
-    var app;
+    const LOCATION = process.env.LOCATION || 'test';
-    var username = process.env.USERNAME;
+    const TEST_TIMEOUT = parseInt(process.env.TIMEOUT, 10) || 10000;
-    var password = process.env.PASSWORD;
+    const EXEC_ARGS = { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' };
-    var TIMEOUT = process.env.TIMEOUT | 30000;
+    const USERNAME = process.env.USERNAME;
-    var token, roomId;
+    const PASSWORD = process.env.PASSWORD;
    const ROOM_ID = Math.floor((Math.random() * 100) + 1);
    const ROOM_NAME = 'Test room ' + ROOM_ID;
    const MSG_TEXT = 'Test message ';
-    before(function (done) {
+    let browser, app, elementApp;
        if (!process.env.USERNAME) return done(new Error('USERNAME env var not set'));
        if (!process.env.PASSWORD) return done(new Error('PASSWORD env var not set'));
-        var seleniumJar= require('selenium-server-standalone-jar');
+    before(function () {
-        var SeleniumServer = require('selenium-webdriver/remote').SeleniumServer;
+        const chromeOptions = new Options().windowSize({ width: 1280, height: 1024 });
-        server = new SeleniumServer(seleniumJar.path, { port: 4444 });
+        if (process.env.CI) chromeOptions.addArguments('no-sandbox', 'disable-dev-shm-usage', 'headless');
-        server.start();
+        browser = new Builder().forBrowser('chrome').setChromeOptions(chromeOptions).build();
        if (!fs.existsSync('./screenshots')) fs.mkdirSync('./screenshots');
-        done();
+        if (process.env.CI) execSync(`cloudron uninstall --app ${ELEMENT_LOCATION} || true`, EXEC_ARGS);
    });
-    after(function (done) {
+    after(function () {
        browser.quit();
        server.stop();
        done();
    });
-    function checkLandingPage(done) {
+    afterEach(async function () {
-        browser.get('https://' + app.fqdn).then(function () {
+        if (!process.env.CI || !app) return;
            return browser.wait(until.elementLocated(by.xpath('//h1[contains(text(),"Synapse is running")]')), TIMEOUT);
        }).then(function () {
            done();
        });
    }
-    // https://matrix.org/docs/spec/client_server/latest#user-interactive-api-in-the-rest-api
+        const currentUrl = await browser.getCurrentUrl();
-    function registerUser(done) {
+        if (!currentUrl.includes(app.domain)) return;
-        superagent.post('https://' + app.fqdn + '/_matrix/client/r0/register?kind=user').send({
+        expect(this.currentTest.title).to.be.a('string');
            username: username,
            password: password,
            inhibit_login: false
        }).end(function (error, result) {
            // we will first get a 401
            let session = result.body.session;
            console.log('session is', session);
            if (result.statusCode !== 401) return done(new Error('Expecting a 401 ' + result.statusCode));
-            superagent.post('https://' + app.fqdn + '/_matrix/client/r0/register?kind=user').send({
+        const screenshotData = await browser.takeScreenshot();
-                auth: {
+        fs.writeFileSync(`./screenshots/${new Date().getTime()}-${this.currentTest.title.replaceAll(' ', '_')}.png`, screenshotData, 'base64');
                    type: 'm.login.dummy',
                    session: session
                },
                username: username,
                password: password,
                inhibit_login: false
            }).end(function (error, result) {
                if (error) return done(error);
                if (result.statusCode !== 200) return done(new Error('Login failed with status ' + result.statusCode));
                console.log('registered user with id', result.user_id);
                done();
            });
        });
    }
    // https://matrix.org/docs/spec/client_server/latest
    function checkLogin(done) {
        superagent.post('https://' + app.fqdn + '/_matrix/client/r0/login').send({
            type: 'm.login.password',
            user: username,
            password: password
        }).end(function (error, result) {
            if (error) return done(error);
            if (result.statusCode !== 200) return done(new Error('Login failed with status ' + result.statusCode));
            token = result.body.access_token;
            if (!token) return done(new Error('No token'));
            done();
        });
    }
    function checkAutoJoinRoom(done) {
        superagent.get('https://' + app.fqdn + '/_matrix/client/r0/joined_rooms?access_token=' + token).end(function (error, result) {
            if (error) return done(error);
            if (result.statusCode !== 200) return done(new Error('Room listing failed with status ' + result.statusCode));
            if (result.body.joined_rooms.length !== 1) return done(new Error('User must have auto-joined discuss channel:' + result.statusCode));
            done();
        });
    }
    function createRoom(done) {
        superagent.post('https://' + app.fqdn + '/_matrix/client/r0/createRoom?access_token=' + token).send({
            room_alias_name: 'general'
        }).end(function (error, result) {
            if (error) return done(error);
            if (result.statusCode !== 200) return done(new Error('Room creation failed with status ' + result.statusCode));
            roomId = result.body.room_id;
            if (!roomId) return done(new Error('No room id'));
            done();
        });
    }
    function checkRoom(done) {
        superagent.get('https://' + app.fqdn + '/_matrix/client/r0/joined_rooms?access_token=' + token).end(function (error, result) {
            if (error) return done(error);
            if (result.statusCode !== 200) return done(new Error('Room listing failed with status ' + result.statusCode));
            if (!result.body.joined_rooms.includes(roomId)) return done(new Error('No room in list: ' + JSON.stringify(result.body)));
            done();
        });
    }
    xit('build app', function () {
        execSync('cloudron build', { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
    });
    async function clearCache() {
        await browser.manage().deleteAllCookies();
        await browser.quit();
        browser = null;
        const chromeOptions = new Options().windowSize({ width: 1280, height: 1024 });
        if (process.env.CI) chromeOptions.addArguments('no-sandbox', 'disable-dev-shm-usage', 'headless');
        chromeOptions.addArguments(`--user-data-dir=${await fs.promises.mkdtemp('/tmp/test-')}`); // --profile-directory=Default
        browser = new Builder().forBrowser('chrome').setChromeOptions(chromeOptions).build();
    }
    async function waitForElement(elem) {
        await browser.wait(until.elementLocated(elem), TEST_TIMEOUT);
        await browser.wait(until.elementIsVisible(browser.findElement(elem)), TEST_TIMEOUT);
    }
    function getAppInfo() {
        const inspect = JSON.parse(execSync('cloudron inspect'));
        app = inspect.apps.filter(function (a) { return a.location.indexOf(LOCATION) === 0; })[0];
        expect(app).to.be.an('object');
    }
    function getElementAppInfo() {
        const inspect = JSON.parse(execSync('cloudron inspect'));
        elementApp = inspect.apps.filter(function (a) { return a.location.indexOf(ELEMENT_LOCATION) === 0; })[0];
        expect(elementApp).to.be.an('object');
    }
    function getMessage() {
        return MSG_TEXT + Math.floor((Math.random() * 100) + 1);
    }
    async function updateSynapseConfig() {
        console.log(`Setting Synapse Matrix server location to "https://${app.fqdn}"`);
        execSync(`cloudron exec --app ${ELEMENT_LOCATION} -- bash -c "jq '.default_server_config[\\"m.homeserver\\"].base_url = \\"https://${app.fqdn}\\"' /app/data/config.json | sponge /app/data/config.json"`);
        execSync(`cloudron restart --app ${ELEMENT_LOCATION}`);
        // wait when all services are up and running
        await browser.sleep(15000);
    }
    async function checkLandingPage() {
        await browser.get(`https://${app.fqdn}`);
        await browser.wait(until.elementLocated(By.xpath('//h1[contains(text(),"Synapse is running")]')), TEST_TIMEOUT);
    }
    async function registerUser() {
        await browser.get(`https://${elementApp.fqdn}/#/register`);
        await waitForElement(By.xpath('//input[@label="Username"]'));
        await browser.findElement(By.xpath('//input[@label="Username"]')).sendKeys(USERNAME);
        await browser.findElement(By.xpath('//input[@label="Password"]')).sendKeys(PASSWORD);
        await browser.findElement(By.xpath('//input[@label="Confirm password"]')).sendKeys(PASSWORD);
        await browser.findElement(By.xpath('//input[@value="Register"]')).click();
        await waitForElement(By.xpath('//h1[text()="You\'re in"] | //h1[contains(., "Welcome")]'));
        if (await browser.findElements(By.xpath('//div[@role="button" and text()="Skip"]')).then(found => !!found.length)) {
            await browser.findElement(By.xpath('//div[@role="button" and text()="Skip"]')).click();
        }
        await waitForElement(By.xpath(`//h1[contains(., "Welcome")]`));
    }
    async function loginOIDCOld(username, password, alreadyAuthenticated, proceedWithReset) {
        await browser.get(`https://${elementApp.fqdn}/#/login`);
        await browser.sleep(2000);
        await waitForElement(By.css('.mx_Dropdown_arrow'));
        await browser.findElement(By.css('.mx_Dropdown_arrow')).click();
        await waitForElement(By.id('mx_LanguageDropdown__en'));
        await browser.findElement(By.id('mx_LanguageDropdown__en')).click();
        await browser.sleep(3000);
        await waitForElement(By.xpath('//div[@role="button" and contains(., "Continue with")]'));
        await browser.findElement(By.xpath('//div[@role="button" and contains(., "Continue with")]')).click();
        if (!alreadyAuthenticated) {
            await waitForElement(By.id('inputUsername'));
            await browser.findElement(By.id('inputUsername')).sendKeys(username);
            await browser.findElement(By.id('inputPassword')).sendKeys(password);
            await browser.findElement(By.id('loginSubmitButton')).click();
        }
        await waitForElement(By.xpath('//p[@class="confirm-trust" and contains(., "Continuing will grant ")]'));
        await browser.findElement(By.xpath('//a[contains(., "Continue")]')).click();
        if (proceedWithReset) {
            await waitForElement(By.xpath('//div[text()="Proceed with reset" or text()="Reset all"]'));
            if (await browser.findElements(By.xpath('//div[text()="Reset all"]')).then(found => !!found.length)) {
                await browser.findElement(By.xpath('//div[text()="Reset all"]')).click();
            }
            await waitForElement(By.xpath('//div[text()="Proceed with reset"]'));
            await browser.findElement(By.xpath('//div[text()="Proceed with reset"]')).click();
            await waitForElement(By.xpath('//button[@class="mx_Dialog_primary" and text()="Continue"] | //div[@class="mx_EncryptionCard_buttons"]/button[@data-kind="primary"]'));
            await browser.findElement(By.xpath('//button[@class="mx_Dialog_primary" and text()="Continue"] | //div[@class="mx_EncryptionCard_buttons"]/button[@data-kind="primary"]')).click();
            await waitForElement(By.xpath('//button[@class="mx_Dialog_primary" and text()="Continue"] | //div[@class="mx_EncryptionCard_buttons"]/button[@data-kind="primary"]'));
            await browser.findElement(By.xpath('//button[@class="mx_Dialog_primary" and text()="Continue"] | //div[@class="mx_EncryptionCard_buttons"]/button[@data-kind="primary"]')).click();
            await waitForElement(By.xpath('//button[text()="Done"] | //div[text()="Single Sign On"]'));
            if (await browser.findElements(By.xpath('//div[text()="Single Sign On"]')).then(found => !!found.length)) {
                await browser.findElement(By.xpath('//div[text()="Single Sign On"]')).click();
                const originalWindowHandle = await browser.getWindowHandle();
                await browser.wait(async () => (await browser.getAllWindowHandles()).length === 2, 10000);
                //Loop through until we find a new window handle
                const windows = await browser.getAllWindowHandles();
                windows.forEach(async handle => {
                    if (handle !== originalWindowHandle) {
                        await browser.switchTo().window(handle);
                    }
                });
                await waitForElement(By.xpath('//a[contains(., "Continue with")]'));
                await browser.findElement(By.xpath('//a[contains(., "Continue with")]')).click();
                // switch back to the main window
                await browser.switchTo().window(originalWindowHandle);
                await waitForElement(By.xpath('//div[text()="Confirm"]'));
                await browser.findElement(By.xpath('//div[text()="Confirm"]')).click();
            }
            await waitForElement(By.xpath('//div[text()="Cancel"] | //h1[contains(., "Welcome")]'));
            if (await browser.findElements(By.xpath('//div[text()="Cancel"]')).then(found => !!found.length)) {
                await browser.findElement(By.xpath('//div[text()="Cancel"]')).click();
            }
        }
        await browser.sleep(3000);
        await waitForElement(By.xpath(`//h1[contains(., "Welcome")]`));
    }
    async function loginOIDC(username, password, alreadyAuthenticated, proceedWithReset) {
        await browser.get(`https://${elementApp.fqdn}/#/login`);
        await browser.sleep(2000);
        await waitForElement(By.css('.mx_Dropdown_arrow'));
        await browser.findElement(By.css('.mx_Dropdown_arrow')).click();
        await waitForElement(By.id('mx_LanguageDropdown__en'));
        await browser.findElement(By.id('mx_LanguageDropdown__en')).click();
        await browser.sleep(3000);
        await waitForElement(By.xpath('//div[@role="button" and contains(., "Continue with")]'));
        await browser.findElement(By.xpath('//div[@role="button" and contains(., "Continue with")]')).click();
        if (!alreadyAuthenticated) {
            await waitForElement(By.id('inputUsername'));
            await browser.findElement(By.id('inputUsername')).sendKeys(username);
            await browser.findElement(By.id('inputPassword')).sendKeys(password);
            await browser.findElement(By.id('loginSubmitButton')).click();
        }
        await waitForElement(By.xpath('//p[@class="confirm-trust" and contains(., "Continuing will grant ")]'));
        await browser.findElement(By.xpath('//a[contains(., "Continue")]')).click();
        if (proceedWithReset) {
            await waitForElement(By.xpath('//h2[text()="Confirm your identity"]'));
            await waitForElement(By.xpath('//button[text()="Can\'t confirm?"]'));
            await browser.findElement(By.xpath('//button[text()="Can\'t confirm?"]')).click();
            await waitForElement(By.xpath('//button[text()="Continue"]'));
            await browser.findElement(By.xpath('//button[text()="Continue"]')).click();
            await waitForElement(By.xpath('//button[text()="Done"] | //div[text()="Single Sign On"]'));
            if (await browser.findElements(By.xpath('//div[text()="Single Sign On"]')).then(found => !!found.length)) {
                await browser.findElement(By.xpath('//div[text()="Single Sign On"]')).click();
                const originalWindowHandle = await browser.getWindowHandle();
                await browser.wait(async () => (await browser.getAllWindowHandles()).length === 2, 10000);
                //Loop through until we find a new window handle
                const windows = await browser.getAllWindowHandles();
                windows.forEach(async handle => {
                    if (handle !== originalWindowHandle) {
                        await browser.switchTo().window(handle);
                    }
                });
                await waitForElement(By.xpath('//a[contains(., "Continue with")]'));
                await browser.findElement(By.xpath('//a[contains(., "Continue with")]')).click();
                // switch back to the main window
                await browser.switchTo().window(originalWindowHandle);
                await waitForElement(By.xpath('//div[text()="Confirm"]'));
                await browser.findElement(By.xpath('//div[text()="Confirm"]')).click();
            }
            await waitForElement(By.xpath('//div[text()="Cancel"] | //h1[contains(., "Welcome")]'));
            if (await browser.findElements(By.xpath('//div[text()="Cancel"]')).then(found => !!found.length)) {
                await browser.findElement(By.xpath('//div[text()="Cancel"]')).click();
            }
        }
        await browser.sleep(3000);
        await waitForElement(By.xpath(`//h1[contains(., "Welcome")]`));
    }
    async function login() {
        await browser.get(`https://${elementApp.fqdn}/#/login`);
        await browser.wait(until.elementLocated(By.xpath('//input[@value="Sign in"]')), TEST_TIMEOUT);
        await browser.findElement(By.xpath('//input[@name="username"]')).sendKeys(USERNAME);
        await browser.findElement(By.xpath('//input[@name="password"]')).sendKeys(PASSWORD);
        await browser.findElement(By.xpath('//input[@value="Sign in"]')).click();
        await browser.sleep(5000);
        await skipVerification();
        await browser.wait(until.elementLocated(By.xpath('//h1[contains(., "Welcome")] | //span[text()="Rooms"]')), TEST_TIMEOUT);
    }
    async function skipVerification() {
        await browser.wait(until.elementLocated(By.xpath('//div[@aria-label="Skip verification for now"]')), TEST_TIMEOUT);
        await browser.sleep(5000);
        await browser.findElement(By.xpath('//div[@aria-label="Skip verification for now"]')).click();
        await browser.wait(until.elementLocated(By.xpath('//div[contains(text(), "verify later")]')), TEST_TIMEOUT);
        await browser.sleep(5000);
        await browser.findElement(By.xpath('//div[contains(text(), "verify later")]')).click();
        await browser.sleep(5000);
    }
    async function logout() {
        await browser.get(`https://${elementApp.fqdn}/#/home`);
        await browser.sleep(5000);
        await waitForElement(By.xpath('//div[@role="button" and @aria-label="User menu"]'));
        await browser.findElement(By.xpath('//div[@role="button" and @aria-label="User menu"]')).click();
        await browser.sleep(2000);
        await browser.findElement(By.xpath('//li[@role="menuitem" and @aria-label="Sign out"]')).click();
        await browser.sleep(2000);
        if (await browser.findElements(By.xpath('//button[contains(text(), "I don\'t want my encrypted messages")]')).then(found => !!found.length)) {
            await browser.findElement(By.xpath('//button[contains(text(), "I don\'t want my encrypted messages")]')).click();
            await browser.sleep(3000);
        }
        await waitForElement(By.xpath('//h1[text()="Sign in"]'));
    }
    async function isLoggedIn() {
        await browser.get(`https://${elementApp.fqdn}/#/home`);
        await browser.wait(until.elementLocated(By.xpath('//h1[contains(., "Welcome")] | //span[text()="Rooms"]')), TEST_TIMEOUT);
    }
    xit('build app', function () { execSync('cloudron build', EXEC_ARGS); });
    // No SSO
-    it('install app (no sso)', function () {
+    it('install app (no sso)', function () { execSync('cloudron install --no-sso --location ' + LOCATION, EXEC_ARGS); });
-        execSync('cloudron install --no-sso --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    it('can get app information', getAppInfo);
    });
    it('can get app information', function () {
        var inspect = JSON.parse(execSync('cloudron inspect'));
        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
        expect(app).to.be.an('object');
    });
    it('check landing page', checkLandingPage);
    it('can register new user', registerUser);
    it('can login', checkLogin);
    it('check autojoin', checkAutoJoinRoom);
    it('create room', createRoom);
    it('check room', checkRoom);
-    it('uninstall app', function () {
+    it('can install element-web app (no sso)', function () { execSync('cloudron install --appstore-id im.riot.cloudronapp --location ' + ELEMENT_LOCATION, EXEC_ARGS); });
-        execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    it('update element-app config', updateSynapseConfig);
    it('can get Element app info', getElementAppInfo);
    it('can register new user', registerUser);
    it('can logout', logout); // from auto-login
    it('can login', login);
    it('can logout', logout);
    it('uninstall element-web app', async function () {
        await browser.get('about:blank');
        execSync(`cloudron uninstall --app ${ELEMENT_LOCATION}`, EXEC_ARGS);
    });
    it('uninstall app', function () { execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS); });
    // SSO
-    it('install app', function () {
+    it('install app (sso)', function () { execSync('cloudron install --location ' + LOCATION, EXEC_ARGS); });
-        execSync('cloudron install --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    it('can get app info', getAppInfo);
    it('can install element-web app (sso)', function () { execSync('cloudron install --appstore-id im.riot.cloudronapp --location ' + ELEMENT_LOCATION, EXEC_ARGS); });
    it('can get Element app info', getElementAppInfo);
    it('update element-app config', updateSynapseConfig);
    it('can login via OIDC', loginOIDC.bind(null, USERNAME, PASSWORD, false, false));
    it('can get app info', getAppInfo);
    it('can restart app', function () { execSync(`cloudron restart --app ${app.id}`); });
    it('backup app', function () { execSync(`cloudron backup create --app ${app.id}`, EXEC_ARGS); });
    it('is logged in', isLoggedIn);
    it('restore app', async function () {
        const backups = JSON.parse(execSync(`cloudron backup list --raw --app ${app.id}`));
        await browser.get('about:blank');
        execSync(`cloudron uninstall --app ${app.id}`, EXEC_ARGS);
        execSync(`cloudron install --location ${LOCATION}`, EXEC_ARGS);
        getAppInfo();
        execSync(`cloudron restore --backup ${backups[0].id} --app ${app.id}`, EXEC_ARGS);
    });
-    it('can get app information', function () {
+    it('is logged in', isLoggedIn);
-        var inspect = JSON.parse(execSync('cloudron inspect'));
+    it('can logout', logout);
    it('can get app info', getAppInfo);
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
+    // web ui also throws random errors after changing domain
-
+    xit('move to different location (skipped since no matrix support)', async function () {
        expect(app).to.be.an('object');
    });
    it('check landing page', checkLandingPage);
    it('can login', checkLogin);
    it('check autojoin', checkAutoJoinRoom);
    it('create room', createRoom);
    it('check room', checkRoom);
    it('can restart app', function (done) {
        execSync('cloudron restart');
        done();
    });
    it('check landing page', checkLandingPage);
    it('check room', checkRoom);
    it('backup app', function () {
        execSync('cloudron backup create --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
    });
    it('check landing page', checkLandingPage);
    it('check room', checkRoom);
    it('restore app', function () {
        const backups = JSON.parse(execSync('cloudron backup list --raw'));
        execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
        execSync('cloudron install --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
        var inspect = JSON.parse(execSync('cloudron inspect'));
        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
        execSync(`cloudron restore --backup ${backups[0].id} --app ${app.id}`, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
    });
    it('check landing page', checkLandingPage);
    it('check room', checkRoom);
    it('move to different location', function () {
        browser.manage().deleteAllCookies();
-        execSync('cloudron configure --location ' + LOCATION + '2', { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+        await browser.get('about:blank');
-        var inspect = JSON.parse(execSync('cloudron inspect'));
+
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION + '2'; })[0];
+        execSync(`cloudron configure --location ${LOCATION}2`, EXEC_ARGS);
-        expect(app).to.be.an('object');
+        getAppInfo();
        await browser.sleep(15000);
    });
    xit('update element-app config', updateSynapseConfig);
    xit('can get Element app info', getElementAppInfo);
    xit('can login via OIDC', loginOIDC.bind(null, USERNAME, PASSWORD, true, true));
    it('uninstall app', async function () {
        await browser.get('about:blank');
        execSync(`cloudron uninstall --app ${app.id}`, EXEC_ARGS);
    });
-    it('check landing page', checkLandingPage);
+    it('uninstall element-web app', function () {
-    it('check room', checkRoom);
+        execSync(`cloudron uninstall --app ${ELEMENT_LOCATION}`, EXEC_ARGS);
    it('uninstall app', function () {
        execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
    });
    // test update
-    it('can install app', function () {
+    it('clear cache', clearCache);
-        execSync('cloudron install --appstore-id org.matrix.synapse --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    it('can install app for update', function () { execSync('cloudron install --appstore-id org.matrix.synapse --location ' + LOCATION, EXEC_ARGS); });
-        var inspect = JSON.parse(execSync('cloudron inspect'));
+    it('can get app info', getAppInfo);
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
+
-        expect(app).to.be.an('object');
+    it('can install element-web app (update)', function () { execSync('cloudron install --appstore-id im.riot.cloudronapp --location ' + ELEMENT_LOCATION, EXEC_ARGS); });
    it('can get Element app info', getElementAppInfo);
    it('update element-app config', updateSynapseConfig);
    it('can login via OIDC', loginOIDCOld.bind(null, USERNAME, PASSWORD, false, false));
    it('is logged in', isLoggedIn);
    it('can logout', logout);
    it('clear cache', clearCache);
    it('can update', async function () {
        await browser.get('about:blank');
        execSync(`cloudron update --app ${app.id}`, EXEC_ARGS);
        await browser.sleep(15000);
    });
-    it('check landing page', checkLandingPage);
+    it('can get Element app info', getElementAppInfo);
-    it('can login', checkLogin);
+    it('can login via OIDC', loginOIDC.bind(null, USERNAME, PASSWORD, false, true));
    it('create room', createRoom);
    it('check room', checkRoom);
-    it('can update', function () {
+    it('is logged in', isLoggedIn);
-        execSync('cloudron update --app ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+
    it('uninstall app', async function () {
        await browser.get('about:blank');
        execSync(`cloudron uninstall --app ${app.id}`, EXEC_ARGS);
    });
-    it('check landing page', checkLandingPage);
+    it('uninstall element-web app', function () {
-    it('check room', checkRoom);
+        execSync(`cloudron uninstall --app ${ELEMENT_LOCATION}`, EXEC_ARGS);
    it('uninstall app', function () {
        execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
    });
 });