Update package version to 1.123.0

chore(deps): update dependency element-hq/synapse to v1.142.0
| datasource | package | from | to | | --------------- | ------------------ | ------- | ------- | | github-releases | element-hq/synapse | 1.141.0 | 1.142.0 |
2025-11-12 07:51:11 +00:00 · 2025-11-12 07:19:38 +00:00 · 2025-11-06 18:08:22 +01:00 · 2025-10-30 08:36:07 +00:00 · 2025-10-30 07:19:44 +00:00 · 2025-10-15 09:01:21 +00:00
15 changed files with 4077 additions and 1979 deletions
--- a/197
+++ b/197
@@ -1,197 +0,0 @@
-[0.1.0]
-* Initial version
-
-[0.1.1]
-* Removed the Riot part of the installation due to security
-* Changed from Sqlite to Postgres
-* Added LDAP support
-* Fixed upload limit in nginx_matrix.conf
-* Added bogus index.html so cloudron recognizes the matrix server as online
-* Added coturn as TURN server
-
-[0.1.2]
-* Updated logo (transparent)
-* Enabled email settings
-
-[0.1.3]
-* Changed log location of nginx due to backup crashes
-
-[0.1.4]
-* Changed log location of synapse due to backup crashes
-* Updated some configs
-
-[0.1.5]
-* Update to synapse v0.31.2
-
-[0.1.6]
-* Update to synapse v0.33.8
-
-[0.1.7]
-* Update to synapse v0.33.9
-
-[0.1.8]
-* Update to synapse v0.99.0
-* Fixed missing LDAP stuff
-
-[0.1.9]
-* Update to synapse v0.99.3
-
-[0.2.0]
-* Update to synapse v0.99.4
-
-[0.2.1]
-* Update to synapse v0.99.5.1
-
-[0.2.2]
-* Update to synapse v0.99.5.2
-
-[0.2.3]
-* Update to synapse v1.0.0
-* Fixed url preview
-* Fixed voip
-
-[0.2.4]
-* Fixed federation
-
-[0.2.5]
-* Update to synapse v1.1.0
-
-[0.2.6]
-* Update to synapse v1.2.1
-
-[0.2.7]
-* Update to synapse v1.3.0
-
-[0.2.8]
-* Update to synapse v1.3.1
-
-[0.2.9]
-* Update to synapse v1.4.0 (lots of changes)
-
-[0.3.0]
-* Update to synapse v1.4.1
-
-[0.3.1]
-* Update to synapse v1.5.1
-
-[0.3.3]
-* Update to synapse v1.6.0
-
-[0.3.4]
-* Update to synapse v1.6.1
-
-[0.3.5]
-* Update to synapse v1.8.0
-
-[0.3.6]
-* Update to synapse v1.9.1
-
-[0.3.7]
-* Update to synapse v1.10.0
-
-[0.3.8]
-* Update to synapse v1.11.0
-
-[0.4.0]
-* Update to synapse v1.12.0
-
-[0.4.1]
-* Update to synapse v1.12.2
-
-[0.5.0]
-* New reworked app
-
-[0.6.0]
-* Fix title
-
-[0.7.0]
-* Set turn_uris to an array and not a string
-
-[0.7.1]
-* Users will now automatically join the #discuss channel (only in new installations)
-
-[1.0.0]
-* Use latest base image
-* Update to synapse v1.12.4
-
-[1.1.0]
-* Update Synapse to 1.13.0
-* [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.13.0)
-* Set Referrer-Policy header to no-referrer on media downloads. (#7009)
-* Admin API POST /_synapse/admin/v1/join/<roomIdOrAlias> to join users to a room like auto_join_rooms for creation of users. (#7051)
-* Add options to prevent users from changing their profile or associated 3PIDs. (#7096)
-* Allow server admins to define and enforce a password policy (MSC2000). (#7118)
-* Improve the support for SSO authentication on the login fallback page. (#7152, #7235)
-* Always whitelist the login fallback in the SSO configuration if public_baseurl is set. (#7153)
-* Admin users are no longer required to be in a room to create an alias for it. (#7191)
-* Require admin privileges to enable room encryption by default. This does not affect existing rooms. (#7230)
-
-[1.2.0]
-* Update Synapse to 1.14.0
-* [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.14.0)
-
-[1.3.0]
-* Add optional sso support
-
-[1.4.0]
-* Update Synapse to 1.15.1
-* [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.15.0)
-* Advertise support for Client-Server API r0.6.0 and remove related unstable feature flags. (#6585)
-* Add an option to disable autojoining rooms for guest accounts. (#6637)
-* Add admin APIs to allow server admins to manage users' devices. Contributed by @dklimpel. (#7481)
-* Add support for generating thumbnails for WebP images. Previously, users would see an empty box instead of preview image. Contributed by @WGH-. (#7586)
-* Support the standardized m.login.sso user-interactive authentication flow. (#7630)
-
-[1.5.0]
-* Update Synapse to 1.15.2
-* [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.15.2)
-* A malicious homeserver could force Synapse to reset the state in a room to a small subset of the correct state. This affects all Synapse deployments which federate with untrusted servers. (96e9afe6)
-* HTML pages served via Synapse were vulnerable to clickjacking attacks. This predominantly affects homeservers with single-sign-on enabled, but all server administrators are encouraged to upgrade. (ea26e9a9)
-
-[1.6.0]
-* Update Synapse to 1.16.0
-* [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.16.0)
-* Add an option to enable encryption by default for new rooms. (#7639)
-* Add support for running multiple media repository workers. See docs/workers.md for instructions. (#7706)
-* Media can now be marked as safe from quarantined. (#7718)
-* Expand the configuration options for auto-join rooms. (#7763)
-
-[1.6.1]
-* Update Synapse to 1.16.1
-* [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.16.1)
-* Drop table local_rejections_stream which was incorrectly added in Synapse 1.16.0. (#7816, b1beb3ff5)
-
-[1.7.0]
-* Update Synapse to 1.17.0
-* [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.17.0)
-* Fix inconsistent handling of upper and lower case in email addresses when used as identifiers for login, etc. Contributed by @dklimpel. (#7021)
-* Fix "Tried to close a non-active scope!" error messages when opentracing is enabled. (#7732)
-* Fix incorrect error message when database CTYPE was set incorrectly. (#7760)
-* Fix to not ignore set_tweak actions in Push Rules that have no value, as permitted by the specification. (#7766)
-* Fix synctl to handle empty config files correctly. Contributed by @kotovalexarian. (#7779)
-* Fixes a long standing bug in worker mode where worker information was saved in the devices table instead of the original IP address and user agent. (#7797)
-* Fix 'stuck invites' which happen when we are unable to reject a room invite received over federation. (#7804, #7809, #7810)
-
-[1.8.0]
-* Update Synapse to 1.18.0
-* [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.18.0)
-* Include room states on invite events that are sent to application services. Contributed by @Sorunome. (#6455)
-* Add delete room admin endpoint (POST /_synapse/admin/v1/rooms/<room_id>/delete). Contributed by @dklimpel. (#7613, #7953)
-* Add experimental support for running multiple federation sender processes. (#7798)
-* Add the option to validate the iss and aud claims for JWT logins. (#7827)
-* Add support for handling registration requests across multiple client reader workers. (#7830)
-* Add an admin API to list the users in a room. Contributed by Awesome Technologies Innovationslabor GmbH. (#7842)
-* Allow email subjects to be customised through Synapse's configuration. (#7846)
-* Add the ability to re-activate an account from the admin API. (#7847, #7908)
-* Support oEmbed for media previews. (#7920)
-
-[1.9.0]
-* Update Synapse to 1.19.0
-* [Full changelog](https://github.com/matrix-org/synapse/releases/tag/v1.19.0)
-* Add option to allow server admins to join rooms which fail complexity checks. Contributed by @lugino-emeritus. (#7902)
-* Add an option to purge room or not with delete room admin endpoint (POST /_synapse/admin/v1/rooms/<room_id>/delete). Contributed by @dklimpel. (#7964)
-* Add rate limiting to users joining rooms. (#8008)
-* Add a /health endpoint to every configured HTTP listener that can be used as a health check endpoint by load balancers. (#8048)
-* Allow login to be blocked based on the values of SAML attributes. (#8052)
-* Allow guest access to the GET /_matrix/client/r0/rooms/{room_id}/members endpoint, according to MSC2689. Contributed by Awesome Technologies Innovationslabor GmbH. (#7314)
-
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/CloudronManifest.json
+++ b/CloudronManifest.json
@@ -3,35 +3,59 @@
  "title": "Matrix Synapse",
  "author": "Matrix synapse authors",
  "description": "file://DESCRIPTION.md",
-  "changelog": "file://CHANGELOG",
+  "changelog": "file://CHANGELOG.md",
  "tagline": "Secure & decentralized communication",
-  "version": "1.9.0",
+  "version": "1.123.0",
+  "upstreamVersion": "1.142.0",
  "healthCheckPath": "/",
  "httpPort": 8008,
  "memoryLimit": 536870912,
  "addons": {
    "localstorage": {},
-    "ldap": {},
+    "oidc": {
+      "loginRedirectUri": "/_synapse/client/oidc/callback"
+    },
    "postgresql": {},
-    "sendmail": {},
-    "turn": {}
+    "sendmail": {
+      "supportsDisplayName": true
+    },
+    "turn": {
+      "optional": true
+    }
  },
  "manifestVersion": 2,
  "website": "https://matrix.org",
  "contactEmail": "support@cloudron.io",
  "icon": "file://logo.png",
  "tags": [
-    "im", "collaboration", "voip", "videochat", "chat", "slack"
+    "im",
+    "collaboration",
+    "voip",
+    "videochat",
+    "chat",
+    "slack",
+    "zulip",
+    "federated",
+    "element",
+    "riot"
  ],
  "mediaLinks": [
-    "https://cloudron-app-screenshots.s3.amazonaws.com/org.matrix.synapse/606cd9d4ccc3bee11a49f91444a2dad8947cbc7c/1.png",
-    "https://cloudron-app-screenshots.s3.amazonaws.com/org.matrix.synapse/606cd9d4ccc3bee11a49f91444a2dad8947cbc7c/2.png",
-    "https://cloudron-app-screenshots.s3.amazonaws.com/org.matrix.synapse/606cd9d4ccc3bee11a49f91444a2dad8947cbc7c/3.png"
+    "https://screenshots.cloudron.io/org.matrix.synapse/1.png",
+    "https://screenshots.cloudron.io/org.matrix.synapse/2.png",
+    "https://screenshots.cloudron.io/org.matrix.synapse/3.png"
  ],
-  "changelog": "file://CHANGELOG",
+  "checklist": {
+    "configure-federation": {
+      "message": "For federation to work, the delegation URI `https://$CLOUDRON-APP-DOMAIN/.well-known/matrix/server` must be configured. See the [docs](https://docs.cloudron.io/apps/synapse/#post-installation) on how to do this."
+    },
+    "registration-enabled-without-verification": {
+      "message": "Registration is enabled but verification is disabled. See [docs](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html?highlight=registration_require#enable_registration) for more information",
+      "sso": false
+    }
+  },
  "postInstallMessage": "file://POSTINSTALL.md",
-  "minBoxVersion": "5.3.0",
+  "minBoxVersion": "8.2.0",
  "forumUrl": "https://forum.cloudron.io/category/50/matrix-synapse-riot",
-  "documentationUrl": "https://cloudron.io/documentation/apps/synapse/",
+  "documentationUrl": "https://docs.cloudron.io/packages/synapse/",
  "optionalSso": true
 }
--- a/DESCRIPTION.md
+++ b/DESCRIPTION.md
@@ -1,12 +1,10 @@
-This app packages Synapse <upstream>1.19.0</upstream>.
-
 **This package only provides the Matrix backend. A variety of clients are available
 [here](https://matrix.org/clients/). Riot is a popular web frontend for Matrix and
 is available as a separate app.**

-Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP.
+## About

-## Matrix
+Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP.

 Matrix specifies a set of pragmatic RESTful HTTP JSON APIs as an open standard, which handle:

@@ -18,7 +16,7 @@ Matrix specifies a set of pragmatic RESTful HTTP JSON APIs as an open standard,
 * Using 3rd Party IDs (3PIDs) such as email addresses, phone numbers, Facebook accounts to authenticate, identify and discover users on Matrix.
 * Placing 1:1 VoIP and Video calls

-## Synapse
+## What is Synapse?

 Synapse is a reference "homeserver" implementation of Matrix from the core development
 team at matrix.org, written in Python/Twisted.
--- a/27
+++ b/27
@@ -1,27 +1,28 @@
-FROM cloudron/base:2.0.0@sha256:f9fea80513aa7c92fe2e7bf3978b54c8ac5222f47a9a32a7f8833edf0eb5a4f4
+FROM cloudron/base:5.0.0@sha256:04fd70dbd8ad6149c19de39e35718e024417c3e01dc9c6637eaf4a41ec4e596c

 RUN mkdir -p /app/pkg

 WORKDIR /app/code

-ARG VERSION=v1.19.0
+# https://github.com/element-hq/synapse/blob/master/docs/setup/installation.md?plain=1#L202
+RUN python3 -m venv /app/code/env

-# https://pythonspeed.com/articles/activate-virtualenv-dockerfile/
-RUN virtualenv -p python3 /app/code/env
-ENV VIRTUAL_ENV=/app/code/env
-ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+# renovate: datasource=github-releases depName=element-hq/synapse versioning=semver extractVersion=^v(?<version>.+)$
+ARG SYNAPSE_VERSION=1.142.0
+
+# renovate: datasource=github-releases depName=matrix-org/synapse-s3-storage-provider versioning=semver extractVersion=^v(?<version>.+)$
+ARG S3PROVIDER_VERSION=1.6.0

 # Synapse (https://github.com/matrix-org/synapse/blob/master/INSTALL.md)
 # lxml - required for previews
-RUN pip install --upgrade pip && \
-    pip install --upgrade setuptools && \
-    pip install matrix-synapse==${VERSION} psycopg2-binary python-ldap matrix-synapse-ldap3 lxml publicsuffix2
+RUN source /app/code/env/bin/activate && \
+    pip3 install --no-cache-dir matrix-synapse==v${SYNAPSE_VERSION} psycopg2-binary python-ldap matrix-synapse-ldap3 lxml publicsuffix2 git+https://github.com/matrix-org/synapse-s3-storage-provider.git@v${S3PROVIDER_VERSION} matrix-synapse[oidc]

-RUN curl -sL https://github.com/mikefarah/yq/releases/download/3.2.1/yq_linux_amd64 -o /usr/bin/yq && \
-    chmod +x /usr/bin/yq
+# Updated suffix list
+RUN curl -L https://publicsuffix.org/list/public_suffix_list.dat -o /app/code/env/lib/python3.12/site-packages/publicsuffix2/public_suffix_list.dat

-RUN chown -R cloudron.cloudron /app/code
+RUN ln -sf /app/data/index.html /app/code/env/lib/python3.12/site-packages/synapse/static/index.html

-ADD homeserver.yaml.template start.sh /app/pkg/
+ADD index.html homeserver.yaml.template start.sh /app/pkg/

 CMD [ "/app/pkg/start.sh" ]
--- a/POSTINSTALL.md
+++ b/POSTINSTALL.md
@@ -1,8 +1,2 @@
 Account ids are created with the username and the second level domain under which the
-app is installed e.g. `@username@domain.com`.
-
-For federation to work, the second level domain has to be configured to serve up the
-`.well-known/domain.com/matrix` URI. See the 
-[federation docs](https://cloudron.io/documentation/apps/synapse/) on
-how to do this.
-
+app is installed e.g. `@$CLOUDRON-USERNAME:$CLOUDRON-APP-DOMAIN`.
--- a/homeserver.yaml.template
+++ b/homeserver.yaml.template
@@ -1,4 +1,4 @@
-# https://github.com/matrix-org/synapse/blob/master/docs/sample_config.yaml
+# https://github.com/element-hq/synapse/blob/master/docs/sample_config.yaml

 # if you change this, change the auto_join_rooms below as well
 server_name: "example.com"
@@ -13,7 +13,6 @@ listeners:
    type: http
    x_forwarded: true
    bind_addresses: ['0.0.0.0']
-
    resources:
      - names: [client,federation]
        compress: false
@@ -21,7 +20,6 @@ listeners:
 database:
  name: "psycopg2"
  args:
-    # Path to the database
    user: ${POSTGRESQL_USERNAME}
    password: ${POSTGRESQL_PASSWORD}
    database: ${POSTGRESQL_DATABASE}
@@ -29,6 +27,17 @@ database:
    cp_min: 5
    cp_max: 10

+log_config: "/app/data/configs/log.config"
+media_store_path: "/app/data/data/media_store"
+registration_shared_secret: "some_shared_secret"
+report_stats: false
+macaroon_secret_key: "some_macaroon_secret"
+form_secret: "some_form_secret"
+signing_key_path: "/app/data/configs/signing.key"
+trusted_key_servers:
+  - server_name: "matrix.org"
+
+## Cloudron packaging
 email:
    smtp_host: mail.server
    smtp_port: 587
@@ -40,73 +49,37 @@ email:
    enable_notifs: true
    notif_for_new_users: true

-password_providers:
-    - module: "synapse.util.ldap_auth_provider.LdapAuthProvider"
-      config:
-        enabled: true
-        uri: "ldap://ldap.example.com:389"
-        start_tls: true
-        base: "ou=users,dc=example,dc=com"
-        attributes:
-           uid: "username"
-           mail: "mail"
-           name: "username"
-        bind_dn: "ou=users,dc=cloudron"
-        bind_password: "password"
-        filter: "(objectClass=posixAccount)"
-
 # turn
 turn_uris: []
 turn_shared_secret: "sharedsecret"
 turn_allow_guests: true

-federation_ip_range_blacklist:
-  - '127.0.0.0/8'
-  - '10.0.0.0/8'
-  - '172.16.0.0/12'
-  - '192.168.0.0/16'
-  - '100.64.0.0/10'
-  - '169.254.0.0/16'
-  - '::1/128'
-  - 'fe80::/64'
-  - 'fc00::/7'
-
+# sso (https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#single-sign-on-integration)
 enable_registration: false
-registration_shared_secret: "somesecret"
-allow_guest_access: false
+# without this, registration requires one of email/captcha/token verification
+enable_registration_without_verification: true

-enable_group_creation: true
-
-report_stats: False
-
-signing_key_path: "/app/data/configs/signing.key"
-
-url_preview_enabled: true
-url_preview_ip_range_blacklist:
-  - '127.0.0.0/8'
-  - '10.0.0.0/8'
-  - '172.16.0.0/12'
-  - '192.168.0.0/16'
-  - '100.64.0.0/10'
-  - '169.254.0.0/16'
-  - '::1/128'
-  - 'fe80::/64'
-  - 'fc00::/7'
-
-media_store_path: "/app/data/data/media_store"
-max_upload_size: 200M
-max_image_pixels: "32M"
-dynamic_thumbnails: false
-
-autocreate_auto_join_rooms: true
-auto_join_rooms:
-  - "#discuss:example.com"
-
-trusted_key_servers:
-  - server_name: "matrix.org"
-suppress_key_server_warning: true
+oidc_providers:
+  - idp_id: cloudron
+    idp_name: "CLOUDRON_OIDC_PROVIDER_NAME"
+    issuer: "CLOUDRON_OIDC_ISSUER"
+    client_id: "CLOUDRON_OIDC_CLIENT_ID"
+    client_secret: "CLOUDRON_OIDC_CLIENT_SECRET"
+    scopes: ["openid", "profile", "email"]
+    authorization_endpoint: "CLOUDRON_OIDC_AUTH_ENDPOINT"
+    token_endpoint: "CLOUDRON_OIDC_TOKEN_ENDPOINT"
+    userinfo_endpoint: "CLOUDRON_OIDC_AUTH_ENDPOINT"
+    allow_existing_users: true
+    enable_registration: true
+    backchannel_logout_enabled: false
+    user_mapping_provider:
+      config:
+        localpart_template: "{{ user.sub }}"
+        display_name_template: "{{ user.name }}"
+        email_template: "{{ user.email }}"

 password_config:
-   enabled: true
+    enabled: false
    localdb_enabled: false
+    pepper: "some_pepper_secret"

--- a/index.html
+++ b/index.html
@@ -0,0 +1,68 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+   <title>Synapse is running</title>
+   <style>
+       body {
+         font-family: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;
+         max-width: 40em;
+         margin: auto;
+         text-align: center;
+       }
+       h1, p {
+         margin: 1.5em;
+       }
+       hr {
+        border: none;
+        background-color: #ccc;
+        color: #ccc;
+        height: 1px;
+        width: 7em;
+        margin-top: 4em;
+      }
+       .logo {
+         display: block;
+         width: 12em;
+         margin: 4em auto;
+       }
+   </style>
+  </head>
+  <body>
+    <div class="logo">
+       <svg role="img" aria-label="[Matrix logo]" viewBox="0 0 200 85" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+          <g id="parent" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
+              <g id="child" transform="translate(-122.000000, -6.000000)" fill="#000000" fill-rule="nonzero">
+                  <g id="matrix-logo" transform="translate(122.000000, 6.000000)">
+                      <polygon id="left-bracket" points="2.24708861 1.93811009 2.24708861 82.7268844 8.10278481 82.7268844 8.10278481 84.6652459 0 84.6652459 0 0 8.10278481 0 8.10278481 1.93811009"></polygon>
+                      <path d="M24.8073418,27.5493174 L24.8073418,31.6376991 L24.924557,31.6376991 C26.0227848,30.0814294 27.3455696,28.8730642 28.8951899,28.0163743 C30.4437975,27.1611927 32.2189873,26.7318422 34.218481,26.7318422 C36.1394937,26.7318422 37.8946835,27.102622 39.4825316,27.8416679 C41.0708861,28.5819706 42.276962,29.8856073 43.1005063,31.7548404 C44.0017722,30.431345 45.2270886,29.2629486 46.7767089,28.2506569 C48.3253165,27.2388679 50.158481,26.7318422 52.2764557,26.7318422 C53.8843038,26.7318422 55.3736709,26.9269101 56.7473418,27.3162917 C58.1189873,27.7056734 59.295443,28.3285835 60.2759494,29.185022 C61.255443,30.0422147 62.02,31.1615927 62.5701266,32.5426532 C63.1187342,33.9262275 63.3936709,35.5898349 63.3936709,37.5372459 L63.3936709,57.7443688 L55.0410127,57.7441174 L55.0410127,40.6319376 C55.0410127,39.6201486 55.0020253,38.6661761 54.9232911,37.7700202 C54.8440506,36.8751211 54.6293671,36.0968606 54.2764557,35.4339817 C53.9232911,34.772611 53.403038,34.2464807 52.7177215,33.8568477 C52.0313924,33.4689743 51.0997468,33.2731523 49.9235443,33.2731523 C48.7473418,33.2731523 47.7962025,33.4983853 47.0706329,33.944578 C46.344557,34.393033 45.7764557,34.9774826 45.3650633,35.6969211 C44.9534177,36.4181193 44.6787342,37.2353431 44.5417722,38.150855 C44.4037975,39.0653615 44.3356962,39.9904257 44.3356962,40.9247908 L44.3356962,57.7443688 L35.9835443,57.7443688 L35.9835443,40.8079009 C35.9835443,39.9124991 35.963038,39.0263982 35.9253165,38.150855 C35.8853165,37.2743064 35.7192405,36.4666349 35.424557,35.7263321 C35.1303797,34.9872862 34.64,34.393033 33.9539241,33.944578 C33.2675949,33.4983853 32.2579747,33.2731523 30.9248101,33.2731523 C30.5321519,33.2731523 30.0126582,33.3608826 29.3663291,33.5365945 C28.7192405,33.7118037 28.0913924,34.0433688 27.4840506,34.5292789 C26.875443,35.0164459 26.3564557,35.7172826 25.9250633,36.6315376 C25.4934177,37.5470495 25.2779747,38.7436 25.2779747,40.2229486 L25.2779747,57.7441174 L16.9260759,57.7443688 L16.9260759,27.5493174 L24.8073418,27.5493174 Z" id="m"></path>
+                      <path d="M68.7455696,31.9886202 C69.6075949,30.7033339 70.7060759,29.672189 72.0397468,28.8926716 C73.3724051,28.1141596 74.8716456,27.5596239 76.5387342,27.2283101 C78.2050633,26.8977505 79.8817722,26.7315908 81.5678481,26.7315908 C83.0974684,26.7315908 84.6458228,26.8391798 86.2144304,27.0525982 C87.7827848,27.2675248 89.2144304,27.6865688 90.5086076,28.3087248 C91.8025316,28.9313835 92.8610127,29.7983798 93.6848101,30.9074514 C94.5083544,32.0170257 94.92,33.4870734 94.92,35.3173431 L94.92,51.026844 C94.92,52.3913138 94.998481,53.6941963 95.1556962,54.9400165 C95.3113924,56.1865908 95.5863291,57.120956 95.9787342,57.7436147 L87.5091139,57.7436147 C87.3518987,57.276055 87.2240506,56.7996972 87.1265823,56.3125303 C87.0278481,55.8266202 86.9592405,55.3301523 86.9207595,54.8236294 C85.5873418,56.1865908 84.0182278,57.1405633 82.2156962,57.6857982 C80.4113924,58.2295248 78.5683544,58.503022 76.6860759,58.503022 C75.2346835,58.503022 73.8817722,58.3275615 72.6270886,57.9776459 C71.3718987,57.6269761 70.2744304,57.082244 69.3334177,56.3411872 C68.3921519,55.602644 67.656962,54.6680275 67.1275949,53.5390972 C66.5982278,52.410167 66.3331646,51.065556 66.3331646,49.5087835 C66.3331646,47.7961578 66.6367089,46.384178 67.2455696,45.2756092 C67.8529114,44.1652807 68.6367089,43.2799339 69.5987342,42.6173064 C70.5589873,41.9556844 71.6567089,41.4592165 72.8924051,41.1284055 C74.1273418,40.7978459 75.3721519,40.5356606 76.6270886,40.3398385 C77.8820253,40.1457761 79.116962,39.9896716 80.3329114,39.873033 C81.5483544,39.7558917 82.6270886,39.5804312 83.5681013,39.3469028 C84.5093671,39.1133743 85.2536709,38.7732624 85.8032911,38.3250587 C86.3513924,37.8773578 86.6063291,37.2252881 86.5678481,36.3680954 C86.5678481,35.4731963 86.4210127,34.7620532 86.1268354,34.2366771 C85.8329114,33.7113009 85.4405063,33.3018092 84.9506329,33.0099615 C84.4602532,32.7181138 83.8916456,32.5232972 83.2450633,32.4255119 C82.5977215,32.3294862 81.9010127,32.2797138 81.156962,32.2797138 C79.5098734,32.2797138 78.2159494,32.6303835 77.2746835,33.3312202 C76.3339241,34.0320569 75.7837975,35.2007046 75.6275949,36.8354037 L67.275443,36.8354037 C67.3924051,34.8892495 67.8817722,33.2726495 68.7455696,31.9886202 Z M85.2440506,43.6984752 C84.7149367,43.873433 84.1460759,44.0189798 83.5387342,44.1361211 C82.9306329,44.253011 82.2936709,44.350545 81.6270886,44.4279688 C80.96,44.5066495 80.2934177,44.6034294 79.6273418,44.7203193 C78.9994937,44.8362037 78.3820253,44.9933138 77.7749367,45.1871248 C77.1663291,45.3829468 76.636962,45.6451321 76.1865823,45.9759431 C75.7349367,46.3070055 75.3724051,46.7263009 75.0979747,47.2313156 C74.8232911,47.7375872 74.6863291,48.380356 74.6863291,49.1588679 C74.6863291,49.8979138 74.8232911,50.5218294 75.0979747,51.026844 C75.3724051,51.5338697 75.7455696,51.9328037 76.2159494,52.2246514 C76.6863291,52.5164991 77.2349367,52.7213706 77.8632911,52.8375064 C78.4898734,52.9546477 79.136962,53.012967 79.8037975,53.012967 C81.4506329,53.012967 82.724557,52.740978 83.6273418,52.1952404 C84.5288608,51.6507596 85.1949367,50.9981872 85.6270886,50.2382771 C86.0579747,49.4793725 86.323038,48.7119211 86.4212658,47.9321523 C86.518481,47.1536404 86.5681013,46.5304789 86.5681013,46.063422 L86.5681013,42.9677248 C86.2146835,43.2799339 85.7736709,43.5230147 85.2440506,43.6984752 Z" id="a"></path>
+                      <path d="M116.917975,27.5493174 L116.917975,33.0976917 L110.801266,33.0976917 L110.801266,48.0492936 C110.801266,49.4502128 111.036203,50.3850807 111.507089,50.8518862 C111.976962,51.3191945 112.918734,51.5527229 114.33038,51.5527229 C114.801013,51.5527229 115.251392,51.5336183 115.683038,51.4944037 C116.114177,51.4561945 116.526076,51.3968697 116.917975,51.3194459 L116.917975,57.7438661 C116.212152,57.860756 115.427595,57.9381798 114.565316,57.9778972 C113.702785,58.0153523 112.859747,58.0357138 112.036203,58.0357138 C110.742278,58.0357138 109.516456,57.9477321 108.36,57.7722716 C107.202785,57.5975651 106.183544,57.2577046 105.301519,56.7509303 C104.418987,56.2454128 103.722785,55.5242147 103.213418,54.5898495 C102.703038,53.6562385 102.448608,52.4292716 102.448608,50.9099541 L102.448608,33.0976917 L97.3903797,33.0976917 L97.3903797,27.5493174 L102.448608,27.5493174 L102.448608,18.4967596 L110.801013,18.4967596 L110.801013,27.5493174 L116.917975,27.5493174 Z" id="t"></path>
+                      <path d="M128.857975,27.5493174 L128.857975,33.1565138 L128.975696,33.1565138 C129.367089,32.2213945 129.896203,31.3559064 130.563544,30.557033 C131.23038,29.7596679 131.99443,29.0776844 132.857215,28.5130936 C133.719241,27.9495083 134.641266,27.5113596 135.622532,27.1988991 C136.601772,26.8879468 137.622025,26.7315908 138.681013,26.7315908 C139.229873,26.7315908 139.836962,26.8296275 140.504304,27.0239413 L140.504304,34.7336477 C140.111646,34.6552183 139.641013,34.586844 139.092658,34.5290275 C138.543291,34.4704569 138.014177,34.4410459 137.504304,34.4410459 C135.974937,34.4410459 134.681013,34.6949358 133.622785,35.2004532 C132.564051,35.7067248 131.711392,36.397255 131.064051,37.2735523 C130.417215,38.1501009 129.955443,39.1714422 129.681266,40.3398385 C129.407089,41.5074807 129.269873,42.7736624 129.269873,44.1361211 L129.269873,57.7438661 L120.917722,57.7438661 L120.917722,27.5493174 L128.857975,27.5493174 Z" id="r"></path>
+                      <path d="M144.033165,22.8767376 L144.033165,16.0435798 L152.386076,16.0435798 L152.386076,22.8767376 L144.033165,22.8767376 Z M152.386076,27.5493174 L152.386076,57.7438661 L144.033165,57.7438661 L144.033165,27.5493174 L152.386076,27.5493174 Z" id="i"></path>
+                      <polygon id="x" points="156.738228 27.5493174 166.266582 27.5493174 171.619494 35.4337303 176.913418 27.5493174 186.147848 27.5493174 176.148861 41.6831927 187.383544 57.7441174 177.85443 57.7441174 171.501772 48.2245028 165.148861 57.7441174 155.797468 57.7441174 166.737468 41.8589046"></polygon>
+                      <polygon id="right-bracket" points="197.580759 82.7268844 197.580759 1.93811009 191.725063 1.93811009 191.725063 0 199.828354 0 199.828354 84.6652459 191.725063 84.6652459 191.725063 82.7268844"></polygon>
+                  </g>
+              </g>
+          </g>
+      </svg>
+    </div>
+    <h1>Synapse is running</h1>
+    <p>Your Synapse server is ready for messages.</p>
+    <p>To use this server you'll need <a href="https://matrix.org/docs/projects/try-matrix-now.html#clients" target="_blank" rel="noopener noreferrer">a Matrix client</a>.
+    </p>
+    <p>Welcome to the Matrix universe :)</p>
+    <hr>
+    <p>
+      <small>
+        <a href="https://matrix.org" target="_blank" rel="noopener noreferrer">
+          matrix.org
+        </a>
+        &nbsp; - &nbsp;
+        <a href="https://cloudron.io" target="_blank" rel="noopener noreferrer">
+          cloudron.io
+        </a>
+      </small>
+    </p>
+  </body>
+</html>
+
--- a/logo.png
+++ b/logo.png
--- a/logo.svg
+++ b/logo.svg
@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg:svg
+   width="92"
+   height="92"
+   viewBox="0 0 92 92"
+   version="1.1"
+   id="svg5"
+   sodipodi:docname="logo.svg"
+   inkscape:version="1.4.2 (ebf0e940d0, 2025-05-08)"
+   inkscape:export-filename="logo.png"
+   inkscape:export-xdpi="534.26086"
+   inkscape:export-ydpi="534.26086"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:dc="http://purl.org/dc/elements/1.1/">
+  <svg:defs
+     id="defs5" />
+  <sodipodi:namedview
+     id="namedview5"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:showpageshadow="2"
+     inkscape:pageopacity="0.0"
+     inkscape:pagecheckerboard="0"
+     inkscape:deskcolor="#d1d1d1"
+     inkscape:zoom="3.5066667"
+     inkscape:cx="34.93346"
+     inkscape:cy="46.340304"
+     inkscape:window-width="1280"
+     inkscape:window-height="654"
+     inkscape:window-x="0"
+     inkscape:window-y="0"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="matrix-logo-white" />
+  <!-- Generator: Sketch 55 (78076) - https://sketchapp.com -->
+  <svg:title
+     id="title1">matrix logo white</svg:title>
+  <svg:desc
+     id="desc1">Created with Sketch.</svg:desc>
+  <svg:g
+     id="Page-1"
+     stroke="none"
+     stroke-width="1"
+     fill="none"
+     fill-rule="evenodd"
+     style="fill:#000000">
+    <svg:g
+       id="matrix-logo-white"
+       fill="#FFFFFF"
+       fill-rule="nonzero"
+       style="fill:#000000">
+      <svg:g
+         id="g5"
+         transform="matrix(1.1943286,0,0,1.1943286,1.1945584,26.901573)"
+         style="fill:#666666;stroke:none;stroke-opacity:1;stroke-width:0.99972487;stroke-dasharray:none">
+        <svg:polygon
+           id="Path"
+           points="0.93631479,31.249567 3.1294248,31.249567 3.1294248,31.981769 0.094721871,31.981769 0.094721871,9.495549e-05 3.1294248,9.495549e-05 3.1294248,0.73220178 0.93631479,0.73220178 "
+           style="fill:#666666;stroke:none;stroke-opacity:1;stroke-width:0.99972487;stroke-dasharray:none" />
+        <svg:path
+           d="m 9.3857143,10.406647 v 1.544356 h 0.0439 c 0.4113148,-0.587869 0.9067317,-1.04432 1.4871047,-1.367929 0.579994,-0.323038 1.244849,-0.485222 1.993711,-0.485222 0.719469,0 1.376833,0.140059 1.971523,0.419228 0.59488,0.279644 1.046587,0.772083 1.355025,1.478172 0.337548,-0.49994 0.796461,-0.941293 1.376834,-1.323679 0.579993,-0.382196 1.266561,-0.573721 2.059797,-0.573721 0.602181,0 1.159988,0.07369 1.674463,0.220771 0.513717,0.147086 0.95433,0.382386 1.321555,0.705899 0.366846,0.323799 0.653192,0.746635 0.859229,1.268321 0.205468,0.522635 0.308439,1.15105 0.308439,1.88667 v 7.633092 l -3.128382,-9.5e-5 v -6.464 c 0,-0.382196 -0.0146,-0.742551 -0.04409,-1.081068 -0.02968,-0.338041 -0.110082,-0.632024 -0.242257,-0.882421 -0.132269,-0.249828 -0.327117,-0.44857 -0.583786,-0.595751 -0.257048,-0.146516 -0.605973,-0.220487 -1.046492,-0.220487 -0.440518,0 -0.796744,0.08508 -1.068489,0.253626 -0.271934,0.169401 -0.484703,0.390173 -0.63878,0.661935 -0.154172,0.272427 -0.257048,0.581128 -0.308344,0.926956 -0.05167,0.345448 -0.07718,0.694884 -0.07718,1.047834 v 6.353471 h -3.128097 v -6.397626 c 0,-0.338231 -0.0077,-0.672949 -0.02181,-1.003679 -0.01498,-0.33111 -0.07718,-0.636202 -0.187547,-0.915846 -0.110177,-0.279169 -0.293837,-0.503644 -0.55079,-0.673045 -0.257048,-0.168545 -0.635177,-0.253626 -1.134482,-0.253626 -0.147061,0 -0.341625,0.03314 -0.583692,0.09951 -0.242351,0.06618 -0.477497,0.19143 -0.704962,0.374979 -0.227939,0.184024 -0.4223133,0.44876 -0.5838809,0.794113 -0.1616625,0.345828 -0.2423515,0.797816 -0.2423515,1.356629 v 6.618492 l -3.1280025,9.5e-5 V 10.406647 Z"
+           id="path1"
+           style="fill:#666666;stroke:none;stroke-opacity:1;stroke-width:0.99972487;stroke-dasharray:none" />
+        <svg:path
+           d="m 25.841719,12.083561 c 0.322851,-0.485508 0.734261,-0.875015 1.233755,-1.169472 0.499115,-0.294077 1.06062,-0.503549 1.684987,-0.6287 0.624084,-0.124867 1.252055,-0.187632 1.883534,-0.187632 0.572882,0 1.152781,0.04064 1.740265,0.121258 0.58739,0.08119 1.123578,0.239478 1.608281,0.474492 0.484608,0.235205 0.881037,0.562707 1.18957,0.98165 0.308439,0.419134 0.462611,0.974434 0.462611,1.665804 v 5.934149 c 0,0.515418 0.02939,1.007572 0.08827,1.478172 0.05831,0.470884 0.161283,0.823834 0.308249,1.059038 h -3.172092 c -0.05888,-0.176617 -0.106764,-0.356557 -0.143268,-0.540581 -0.03698,-0.183549 -0.06267,-0.371086 -0.07709,-0.562422 -0.4994,0.514849 -1.087073,0.875205 -1.762168,1.081164 -0.675759,0.205388 -1.366024,0.3087 -2.070986,0.3087 -0.543584,0 -1.050285,-0.06628 -1.520196,-0.198457 C 26.82534,21.768261 26.414309,21.562493 26.061876,21.282564 25.709347,21.003585 25.434,20.65054 25.235738,20.224095 25.037476,19.79765 24.938203,19.289733 24.938203,18.701674 c 0,-0.646932 0.113685,-1.180297 0.341719,-1.599051 0.227466,-0.419418 0.521018,-0.753851 0.881322,-1.004154 0.359639,-0.249923 0.770764,-0.43746 1.233565,-0.562421 0.462515,-0.124867 0.928729,-0.223906 1.398735,-0.297876 0.470007,-0.07331 0.932523,-0.132273 1.387927,-0.176332 0.455215,-0.04425 0.859229,-0.110528 1.211663,-0.198742 0.352528,-0.08821 0.631289,-0.216688 0.837136,-0.385994 0.205278,-0.169116 0.300759,-0.41543 0.286346,-0.739229 0,-0.338041 -0.05499,-0.60667 -0.16517,-0.805127 -0.110082,-0.198457 -0.257048,-0.35314 -0.440519,-0.463383 -0.183659,-0.110243 -0.396618,-0.183834 -0.63878,-0.220771 -0.242446,-0.03627 -0.503381,-0.05508 -0.782048,-0.05508 -0.616877,0 -1.101485,0.132463 -1.454013,0.397199 -0.352339,0.264736 -0.558376,0.706184 -0.616878,1.32368 h -3.128097 c 0.04381,-0.735146 0.227086,-1.345804 0.5506,-1.830837 z m 6.179109,4.423311 c -0.198167,0.06609 -0.41122,0.121069 -0.638685,0.165318 -0.22775,0.04415 -0.466309,0.081 -0.715961,0.110243 -0.249842,0.02972 -0.499494,0.06628 -0.748957,0.110433 -0.235145,0.04378 -0.466403,0.103122 -0.693774,0.176333 -0.227939,0.07397 -0.426201,0.173009 -0.59488,0.29797 -0.169152,0.125056 -0.30493,0.283442 -0.407711,0.474208 -0.102876,0.19124 -0.154172,0.434041 -0.154172,0.728118 0,0.27917 0.0513,0.514849 0.154172,0.705615 0.102781,0.191525 0.242541,0.342219 0.41871,0.452463 0.17617,0.110243 0.381637,0.187632 0.616972,0.231501 0.234672,0.04425 0.477023,0.06628 0.72677,0.06628 0.616783,0 1.0939,-0.102742 1.432017,-0.30889 0.337642,-0.205674 0.587105,-0.452178 0.748957,-0.739229 0.161378,-0.28667 0.260651,-0.576569 0.29744,-0.871121 0.03641,-0.294077 0.05499,-0.529472 0.05499,-0.705899 v -1.169472 c -0.132364,0.11803 -0.297534,0.209851 -0.495891,0.27613 z"
+           id="Shape"
+           style="fill:#666666;stroke:none;stroke-opacity:1;stroke-width:0.99972487;stroke-dasharray:none" />
+        <svg:path
+           d="m 43.883533,10.406647 v 2.095858 h -2.290866 v 5.647857 c 0,0.529187 0.08799,0.882326 0.264349,1.058659 0.17598,0.176522 0.528698,0.264736 1.057396,0.264736 0.176264,0 0.344943,-0.0072 0.506606,-0.02203 0.161472,-0.01443 0.315739,-0.03684 0.462515,-0.06609 v 2.426777 c -0.264348,0.04415 -0.558185,0.0734 -0.881131,0.0884 -0.32304,0.01415 -0.63878,0.02184 -0.947219,0.02184 -0.484608,0 -0.94371,-0.03323 -1.376833,-0.09951 C 40.244943,21.757154 39.863211,21.62877 39.53287,21.43734 39.202339,21.246385 38.941593,20.973957 38.750822,20.621008 38.559671,20.268343 38.46438,19.804865 38.46438,19.230954 v -6.72845 H 36.569943 V 10.406647 H 38.46438 V 6.9871098 h 3.128193 v 3.4195372 z"
+           id="path2"
+           style="fill:#666666;stroke:none;stroke-opacity:1;stroke-width:0.99972487;stroke-dasharray:none" />
+        <svg:path
+           d="m 48.355373,10.406647 v 2.117982 h 0.04409 c 0.146586,-0.353234 0.344753,-0.680166 0.59469,-0.981935 0.249747,-0.301199 0.535904,-0.558813 0.859039,-0.772083 0.322851,-0.21289 0.668173,-0.378397 1.035683,-0.496427 0.366751,-0.11746 0.748862,-0.176522 1.14548,-0.176522 0.205563,0 0.432933,0.03703 0.68287,0.110433 v 2.912285 c -0.147061,-0.02963 -0.323325,-0.05545 -0.528698,-0.07729 -0.205752,-0.02213 -0.403919,-0.03323 -0.59488,-0.03323 -0.572787,0 -1.057395,0.09591 -1.453729,0.28686 -0.396524,0.191241 -0.715866,0.452083 -0.958312,0.783098 -0.242257,0.33111 -0.415203,0.716914 -0.517889,1.158267 -0.102687,0.441068 -0.154077,0.919359 -0.154077,1.434018 V 21.81232 H 45.381542 V 10.406647 Z"
+           id="path3"
+           style="fill:#666666;stroke:none;stroke-opacity:1;stroke-width:0.99972487;stroke-dasharray:none" />
+        <svg:path
+           d="m 54.038875,8.6416142 v -2.581175 h 3.128382 v 2.581175 z m 3.128382,1.7650328 V 21.812415 H 54.038875 V 10.406647 Z"
+           id="path4"
+           style="fill:#666666;stroke:none;stroke-opacity:1;stroke-width:0.99972487;stroke-dasharray:none" />
+        <svg:polygon
+           id="polygon4"
+           points="61.94725,21.81251 58.444912,21.81251 62.542225,15.811988 58.79725,10.406647 62.365866,10.406647 64.37067,13.384926 66.353382,10.406647 69.811915,10.406647 66.067035,15.745614 70.274715,21.81251 66.705815,21.81251 64.32658,18.216546 "
+           style="fill:#666666;stroke:none;stroke-opacity:1;stroke-width:0.99972487;stroke-dasharray:none" />
+        <svg:polygon
+           id="polygon5"
+           points="74.093837,0.73220178 71.900727,0.73220178 71.900727,9.495549e-05 74.93562,9.495549e-05 74.93562,31.981769 71.900727,31.981769 71.900727,31.249567 74.093837,31.249567 "
+           style="fill:#666666;stroke:none;stroke-opacity:1;stroke-width:0.99972487;stroke-dasharray:none" />
+      </svg:g>
+    </svg:g>
+  </svg:g>
+  <script />
+  <svg:metadata
+     id="metadata5">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:title>matrix logo white</dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </svg:metadata>
+</svg:svg>
--- a/renovate.json5
+++ b/renovate.json5
@@ -0,0 +1,4 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": ["local>devops/renovator//default.renovate.json5"]
+}
--- a/start.sh
+++ b/start.sh
@@ -4,6 +4,8 @@ set -eu

 mkdir -p /app/data/data /app/data/configs /run/synapse

+source /app/code/env/bin/activate
+
 if [[ ! -f /app/data/configs/homeserver.yaml ]]; then
    echo "==> Detected first run"

@@ -21,60 +23,84 @@ if [[ ! -f /app/data/configs/homeserver.yaml ]]; then
    # fix logging configuration
    cp /app/pkg/homeserver.yaml.template /app/data/configs/homeserver.yaml
    mv /app/data/configs/${server_name}.log.config /app/data/configs/log.config
-    yq w -i /app/data/configs/homeserver.yaml log_config /app/data/configs/log.config
-    yq w -i /app/data/configs/log.config handlers.file.filename /run/synapse/homeserver.log
+    yq eval -i ".log_config=\"/app/data/configs/log.config\"" /app/data/configs/homeserver.yaml
+
+    # delete default file and buffer handlers
+    yq eval -i "del(.handlers.file)" /app/data/configs/log.config
+    yq eval -i "del(.handlers.buffer)" /app/data/configs/log.config

    mv /app/data/configs/${server_name}.signing.key /app/data/configs/signing.key

-    yq w -i /app/data/configs/homeserver.yaml server_name "${server_name}"
-    yq w -i /app/data/configs/homeserver.yaml registration_shared_secret "$(pwgen -1s 64)"
+    yq eval -i ".server_name=\"${server_name}\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".registration_shared_secret=\"$(pwgen -1s 64)\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".macaroon_secret_key=\"$(pwgen -1s 64)\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".form_secret=\"$(pwgen -1s 64)\"" /app/data/configs/homeserver.yaml

-    yq w -i /app/data/configs/homeserver.yaml auto_join_rooms "[]"
-    yq w -i /app/data/configs/homeserver.yaml auto_join_rooms\[0\] "#discuss:${server_name}"
+    if [[ -z "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
+        yq eval -i ".enable_registration=true" /app/data/configs/homeserver.yaml
+        yq eval -i ".password_config.enabled=true" /app/data/configs/homeserver.yaml
+        yq eval -i ".password_config.localdb_enabled=true" /app/data/configs/homeserver.yaml
+        yq eval -i "del(.oidc_providers)" /app/data/configs/homeserver.yaml
+    fi
+    yq eval -i ".password_config.pepper=\"$(pwgen -1s 12)\"" /app/data/configs/homeserver.yaml # always set this so that users can enable password login if needed
+fi

-    if [[ -z "${CLOUDRON_LDAP_SERVER:-}" ]]; then
-        yq w -i /app/data/configs/homeserver.yaml enable_registration true
-        yq w -i /app/data/configs/homeserver.yaml password_config.pepper "$(pwgen -1s 12)"
-    fi
-fi
+echo "==> Ensure we log to console"
+yq eval -i ".root.handlers=[\"console\"]" /app/data/configs/log.config
+yq eval -i ".loggers.twisted.handlers=[\"console\"]" /app/data/configs/log.config
+
+[[ ! -f /app/data/index.html ]] && cp /app/pkg/index.html /app/data/index.html

 echo "==> Configuring synapse"
-yq w -i /app/data/configs/homeserver.yaml public_baseurl "${CLOUDRON_APP_ORIGIN}"
+yq eval -i ".public_baseurl=\"${CLOUDRON_APP_ORIGIN}\"" /app/data/configs/homeserver.yaml

 # database
-yq w -i /app/data/configs/homeserver.yaml database.args.user "${CLOUDRON_POSTGRESQL_USERNAME}"
-yq w -i /app/data/configs/homeserver.yaml database.args.password "${CLOUDRON_POSTGRESQL_PASSWORD}"
-yq w -i /app/data/configs/homeserver.yaml database.args.database "${CLOUDRON_POSTGRESQL_DATABASE}"
-yq w -i /app/data/configs/homeserver.yaml database.args.host "${CLOUDRON_POSTGRESQL_HOST}"
+yq eval -i ".database.args.user=\"${CLOUDRON_POSTGRESQL_USERNAME}\"" /app/data/configs/homeserver.yaml
+yq eval -i ".database.args.password=\"${CLOUDRON_POSTGRESQL_PASSWORD}\"" /app/data/configs/homeserver.yaml
+yq eval -i ".database.args.database=\"${CLOUDRON_POSTGRESQL_DATABASE}\"" /app/data/configs/homeserver.yaml
+yq eval -i ".database.args.host=\"${CLOUDRON_POSTGRESQL_HOST}\"" /app/data/configs/homeserver.yaml

 # email
-yq w -i /app/data/configs/homeserver.yaml email.smtp_host "${CLOUDRON_MAIL_SMTP_SERVER}"
-yq w -i /app/data/configs/homeserver.yaml email.smtp_port "${CLOUDRON_MAIL_SMTP_PORT}"
-yq w -i /app/data/configs/homeserver.yaml email.smtp_user "${CLOUDRON_MAIL_SMTP_USERNAME}"
-yq w -i /app/data/configs/homeserver.yaml email.smtp_pass "${CLOUDRON_MAIL_SMTP_PASSWORD}"
-yq w -i /app/data/configs/homeserver.yaml email.notif_from "%(app)s <${CLOUDRON_MAIL_FROM}>"
+yq eval -i ".email.smtp_host=\"${CLOUDRON_MAIL_SMTP_SERVER}\"" /app/data/configs/homeserver.yaml
+yq eval -i ".email.smtp_port=${CLOUDRON_MAIL_SMTP_PORT}" /app/data/configs/homeserver.yaml
+yq eval -i ".email.smtp_user=\"${CLOUDRON_MAIL_SMTP_USERNAME}\"" /app/data/configs/homeserver.yaml
+yq eval -i ".email.smtp_pass=\"${CLOUDRON_MAIL_SMTP_PASSWORD}\"" /app/data/configs/homeserver.yaml
+yq eval -i ".email.notif_from=\"${CLOUDRON_MAIL_FROM_DISPLAY_NAME:-Matrix} <${CLOUDRON_MAIL_FROM}>\"" /app/data/configs/homeserver.yaml

-# ldap
-if [[ -n "${CLOUDRON_LDAP_SERVER:-}" ]]; then
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.uri' "${CLOUDRON_LDAP_URL}"
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.start_tls' false
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.base' "${CLOUDRON_LDAP_USERS_BASE_DN}"
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.bind_dn' "${CLOUDRON_LDAP_BIND_DN}"
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.bind_password' "${CLOUDRON_LDAP_BIND_PASSWORD}"
-    yq w -i /app/data/configs/homeserver.yaml 'password_providers[0].config.filter' "(objectClass=user)"
+# oidc
+if [[ -n "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
+    echo " ==> Configuring OIDC auth"
+    yq eval -i ".oidc_providers[0].idp_id=\"cloudron\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].idp_name=\"${CLOUDRON_OIDC_PROVIDER_NAME:-Cloudron}\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].issuer=\"${CLOUDRON_OIDC_ISSUER}\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].client_id=\"${CLOUDRON_OIDC_CLIENT_ID}\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].client_secret=\"${CLOUDRON_OIDC_CLIENT_SECRET}\"" /app/data/configs/homeserver.yaml
+
+    yq eval -i ".oidc_providers[0].scopes=[\"openid\", \"email\", \"profile\"]" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].authorization_endpoint=\"${CLOUDRON_OIDC_AUTH_ENDPOINT}\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].token_endpoint=\"${CLOUDRON_OIDC_TOKEN_ENDPOINT}\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].userinfo_endpoint=\"${CLOUDRON_OIDC_PROFILE_ENDPOINT}\"" /app/data/configs/homeserver.yaml
+    # https://s3lph.me/ldap-to-oidc-migration-3-matrix.html
+    yq eval -i ".oidc_providers[0].allow_existing_users=true" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].skip_verification=true" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].user_mapping_provider.config.localpart_template=\"{{ user.sub }}\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].user_mapping_provider.config.display_name_template=\"{{ user.name }}\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".oidc_providers[0].user_mapping_provider.config.email_template=\"{{ user.email }}\"" /app/data/configs/homeserver.yaml
 else
-    yq w -i /app/data/configs/homeserver.yaml password_config.localdb_enabled true
+    yq eval -i ".password_config.localdb_enabled=true" /app/data/configs/homeserver.yaml
 fi

 # turn (https://github.com/matrix-org/synapse/blob/master/docs/turn-howto.md#synapse-setup)
-yq w -i /app/data/configs/homeserver.yaml turn_uris "[]"
-yq w -i /app/data/configs/homeserver.yaml turn_uris\[0\] "turn:${CLOUDRON_TURN_SERVER}:${CLOUDRON_TURN_TLS_PORT}?transport=udp"
-yq w -i /app/data/configs/homeserver.yaml turn_uris\[1\] "turn:${CLOUDRON_TURN_SERVER}:${CLOUDRON_TURN_TLS_PORT}?transport=tcp"
-yq w -i /app/data/configs/homeserver.yaml turn_shared_secret "${CLOUDRON_TURN_SECRET}"
+if [[ -n "${CLOUDRON_TURN_SERVER:-}" ]]; then
+    yq eval -i ".turn_uris=[]" /app/data/configs/homeserver.yaml
+    yq eval -i ".turn_uris[0]=\"turn:${CLOUDRON_TURN_SERVER}:${CLOUDRON_TURN_TLS_PORT}?transport=udp\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".turn_uris[1]=\"turn:${CLOUDRON_TURN_SERVER}:${CLOUDRON_TURN_TLS_PORT}?transport=tcp\"" /app/data/configs/homeserver.yaml
+    yq eval -i ".turn_shared_secret=\"${CLOUDRON_TURN_SECRET}\"" /app/data/configs/homeserver.yaml
+fi

 # fix permissions
 echo "==> Fixing permissions"
-chown -R cloudron.cloudron /app/data /run/synapse
+chown -R cloudron:cloudron /app/data /run/synapse

 echo "==> Starting synapse"
-gosu cloudron:cloudron python3 -m synapse.app.homeserver --config-path /app/data/configs/homeserver.yaml
+exec gosu cloudron:cloudron python3 -m synapse.app.homeserver --config-path /app/data/configs/homeserver.yaml -n
--- a/test/package-lock.json
+++ b/test/package-lock.json
--- a/test/package.json
+++ b/test/package.json
@@ -9,14 +9,9 @@
  "author": "",
  "license": "ISC",
  "dependencies": {
-    "chromedriver": "^83.0.1",
-    "ejs": "^3.1.3",
+    "chromedriver": "^142.0.1",
    "expect.js": "^0.3.1",
-    "mkdirp": "^1.0.4",
-    "mocha": "^8.0.1",
-    "rimraf": "^3.0.2",
-    "selenium-server-standalone-jar": "^3.141.59",
-    "selenium-webdriver": "^3.6.0",
-    "superagent": "^5.3.1"
+    "mocha": "^11.7.5",
+    "selenium-webdriver": "^4.38.0"
  }
 }
--- a/test/test.js
+++ b/test/test.js
@@ -1,256 +1,417 @@
 #!/usr/bin/env node

-/* jslint node:true */
-/* global it:false */
-/* global xit:false */
-/* global describe:false */
-/* global before:false */
-/* global after:false */
+/* jshint esversion: 8 */
+/* global it, xit, describe, before, after, afterEach */

 'use strict';

 require('chromedriver');

-var execSync = require('child_process').execSync,
+const execSync = require('child_process').execSync,
    expect = require('expect.js'),
+    fs = require('fs'),
    path = require('path'),
-    superagent = require('superagent'),
-    webdriver = require('selenium-webdriver');
+    { Builder, By, Key, until } = require('selenium-webdriver'),
+    { Options } = require('selenium-webdriver/chrome');

-var by = require('selenium-webdriver').By,
-    until = require('selenium-webdriver').until,
-    Key = require('selenium-webdriver').Key;
+if (!process.env.USERNAME || !process.env.PASSWORD) {
+    console.log('USERNAME and PASSWORD env vars need to be set');
+    process.exit(1);
+}

 describe('Application life cycle test', function () {
    this.timeout(0);
-    var server, browser = new webdriver.Builder().forBrowser('chrome').build();

-    var LOCATION = 'test';
-    var app;
-    var username = process.env.USERNAME;
-    var password = process.env.PASSWORD;
-    var TIMEOUT = process.env.TIMEOUT | 30000;
-    var token, roomId;
+    const ELEMENT_LOCATION = 'element-test';
+    const LOCATION = process.env.LOCATION || 'test';
+    const TEST_TIMEOUT = parseInt(process.env.TIMEOUT, 10) || 10000;
+    const EXEC_ARGS = { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' };
+    const USERNAME = process.env.USERNAME;
+    const PASSWORD = process.env.PASSWORD;
+    const ROOM_ID = Math.floor((Math.random() * 100) + 1);
+    const ROOM_NAME = 'Test room ' + ROOM_ID;
+    const MSG_TEXT = 'Test message ';

-    before(function (done) {
-        if (!process.env.USERNAME) return done(new Error('USERNAME env var not set'));
-        if (!process.env.PASSWORD) return done(new Error('PASSWORD env var not set'));
+    let browser, app, elementApp;

-        var seleniumJar= require('selenium-server-standalone-jar');
-        var SeleniumServer = require('selenium-webdriver/remote').SeleniumServer;
-        server = new SeleniumServer(seleniumJar.path, { port: 4444 });
-        server.start();
+    before(function () {
+        const chromeOptions = new Options().windowSize({ width: 1280, height: 1024 });
+        if (process.env.CI) chromeOptions.addArguments('no-sandbox', 'disable-dev-shm-usage', 'headless');
+        browser = new Builder().forBrowser('chrome').setChromeOptions(chromeOptions).build();
+        if (!fs.existsSync('./screenshots')) fs.mkdirSync('./screenshots');

-        done();
+        if (process.env.CI) execSync(`cloudron uninstall --app ${ELEMENT_LOCATION} || true`, EXEC_ARGS);
    });

-    after(function (done) {
+    after(function () {
        browser.quit();
-        server.stop();
-        done();
    });

-    function checkLandingPage(done) {
-        browser.get('https://' + app.fqdn).then(function () {
-            return browser.wait(until.elementLocated(by.xpath('//h1[contains(text(),"Synapse is running")]')), TIMEOUT);
-        }).then(function () {
-            done();
+    afterEach(async function () {
+        if (!process.env.CI || !app) return;
+
+        const currentUrl = await browser.getCurrentUrl();
+        if (!currentUrl.includes(app.domain)) return;
+        expect(this.currentTest.title).to.be.a('string');
+
+        const screenshotData = await browser.takeScreenshot();
+        fs.writeFileSync(`./screenshots/${new Date().getTime()}-${this.currentTest.title.replaceAll(' ', '_')}.png`, screenshotData, 'base64');
    });
+
+    async function clearCache() {
+        await browser.manage().deleteAllCookies();
+        await browser.quit();
+        browser = null;
+        const chromeOptions = new Options().windowSize({ width: 1280, height: 1024 });
+        if (process.env.CI) chromeOptions.addArguments('no-sandbox', 'disable-dev-shm-usage', 'headless');
+        chromeOptions.addArguments(`--user-data-dir=${await fs.promises.mkdtemp('/tmp/test-')}`); // --profile-directory=Default
+        browser = new Builder().forBrowser('chrome').setChromeOptions(chromeOptions).build();
    }

-    // https://matrix.org/docs/spec/client_server/latest#user-interactive-api-in-the-rest-api
-    function registerUser(done) {
-        superagent.post('https://' + app.fqdn + '/_matrix/client/r0/register?kind=user').send({
-            username: username,
-            password: password,
-            inhibit_login: false
-        }).end(function (error, result) {
-            // we will first get a 401
-            let session = result.body.session;
-            console.log('session is', session);
-            if (result.statusCode !== 401) return done(new Error('Expecting a 401 ' + result.statusCode));
-
-            superagent.post('https://' + app.fqdn + '/_matrix/client/r0/register?kind=user').send({
-                auth: {
-                    type: 'm.login.dummy',
-                    session: session
-                },
-                username: username,
-                password: password,
-                inhibit_login: false
-            }).end(function (error, result) {
-                if (error) return done(error);
-                if (result.statusCode !== 200) return done(new Error('Login failed with status ' + result.statusCode));
-
-                console.log('registered user with id', result.user_id);
-
-                done();
-            });
-        });
+    async function waitForElement(elem) {
+        await browser.wait(until.elementLocated(elem), TEST_TIMEOUT);
+        await browser.wait(until.elementIsVisible(browser.findElement(elem)), TEST_TIMEOUT);
    }

-    // https://matrix.org/docs/spec/client_server/latest
-    function checkLogin(done) {
-        superagent.post('https://' + app.fqdn + '/_matrix/client/r0/login').send({
-            type: 'm.login.password',
-            user: username,
-            password: password
-        }).end(function (error, result) {
-            if (error) return done(error);
-            if (result.statusCode !== 200) return done(new Error('Login failed with status ' + result.statusCode));
-
-            token = result.body.access_token;
-            if (!token) return done(new Error('No token'));
-
-            done();
-        });
+    function getAppInfo() {
+        const inspect = JSON.parse(execSync('cloudron inspect'));
+        app = inspect.apps.filter(function (a) { return a.location.indexOf(LOCATION) === 0; })[0];
+        expect(app).to.be.an('object');
    }

-    function checkAutoJoinRoom(done) {
-        superagent.get('https://' + app.fqdn + '/_matrix/client/r0/joined_rooms?access_token=' + token).end(function (error, result) {
-            if (error) return done(error);
-            if (result.statusCode !== 200) return done(new Error('Room listing failed with status ' + result.statusCode));
-
-            if (result.body.joined_rooms.length !== 1) return done(new Error('User must have auto-joined discuss channel:' + result.statusCode));
-            done();
-        });
+    function getElementAppInfo() {
+        const inspect = JSON.parse(execSync('cloudron inspect'));
+        elementApp = inspect.apps.filter(function (a) { return a.location.indexOf(ELEMENT_LOCATION) === 0; })[0];
+        expect(elementApp).to.be.an('object');
    }

-    function createRoom(done) {
-        superagent.post('https://' + app.fqdn + '/_matrix/client/r0/createRoom?access_token=' + token).send({
-            room_alias_name: 'general'
-        }).end(function (error, result) {
-            if (error) return done(error);
-            if (result.statusCode !== 200) return done(new Error('Room creation failed with status ' + result.statusCode));
-
-            roomId = result.body.room_id;
-            if (!roomId) return done(new Error('No room id'));
-
-            done();
-        });
+    function getMessage() {
+        return MSG_TEXT + Math.floor((Math.random() * 100) + 1);
    }

-    function checkRoom(done) {
-        superagent.get('https://' + app.fqdn + '/_matrix/client/r0/joined_rooms?access_token=' + token).end(function (error, result) {
-            if (error) return done(error);
-            if (result.statusCode !== 200) return done(new Error('Room listing failed with status ' + result.statusCode));
+    async function updateSynapseConfig() {
+        console.log(`Setting Synapse Matrix server location to "https://${app.fqdn}"`);

-            if (!result.body.joined_rooms.includes(roomId)) return done(new Error('No room in list: ' + JSON.stringify(result.body)));
-
-            done();
-        });
+        execSync(`cloudron exec --app ${ELEMENT_LOCATION} -- bash -c "jq '.default_server_config[\\"m.homeserver\\"].base_url = \\"https://${app.fqdn}\\"' /app/data/config.json | sponge /app/data/config.json"`);
+        execSync(`cloudron restart --app ${ELEMENT_LOCATION}`);
+        // wait when all services are up and running
+        await browser.sleep(15000);
    }

-    xit('build app', function () {
-        execSync('cloudron build', { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    async function checkLandingPage() {
+        await browser.get(`https://${app.fqdn}`);
+        await browser.wait(until.elementLocated(By.xpath('//h1[contains(text(),"Synapse is running")]')), TEST_TIMEOUT);
+    }
+
+    async function registerUser() {
+        await browser.get(`https://${elementApp.fqdn}/#/register`);
+        await waitForElement(By.xpath('//input[@label="Username"]'));
+        await browser.findElement(By.xpath('//input[@label="Username"]')).sendKeys(USERNAME);
+        await browser.findElement(By.xpath('//input[@label="Password"]')).sendKeys(PASSWORD);
+        await browser.findElement(By.xpath('//input[@label="Confirm password"]')).sendKeys(PASSWORD);
+        await browser.findElement(By.xpath('//input[@value="Register"]')).click();
+
+        await waitForElement(By.xpath('//h1[text()="You\'re in"] | //h1[contains(., "Welcome")]'));
+        if (await browser.findElements(By.xpath('//div[@role="button" and text()="Skip"]')).then(found => !!found.length)) {
+            await browser.findElement(By.xpath('//div[@role="button" and text()="Skip"]')).click();
+        }
+
+        await waitForElement(By.xpath(`//h1[contains(., "Welcome")]`));
+    }
+
+    async function loginOIDCOld(username, password, alreadyAuthenticated, proceedWithReset) {
+        await browser.get(`https://${elementApp.fqdn}/#/login`);
+        await browser.sleep(2000);
+
+        await waitForElement(By.css('.mx_Dropdown_arrow'));
+        await browser.findElement(By.css('.mx_Dropdown_arrow')).click();
+        await waitForElement(By.id('mx_LanguageDropdown__en'));
+        await browser.findElement(By.id('mx_LanguageDropdown__en')).click();
+        await browser.sleep(3000);
+
+        await waitForElement(By.xpath('//div[@role="button" and contains(., "Continue with")]'));
+        await browser.findElement(By.xpath('//div[@role="button" and contains(., "Continue with")]')).click();
+        if (!alreadyAuthenticated) {
+            await waitForElement(By.id('inputUsername'));
+            await browser.findElement(By.id('inputUsername')).sendKeys(username);
+            await browser.findElement(By.id('inputPassword')).sendKeys(password);
+            await browser.findElement(By.id('loginSubmitButton')).click();
+        }
+
+        await waitForElement(By.xpath('//p[@class="confirm-trust" and contains(., "Continuing will grant ")]'));
+        await browser.findElement(By.xpath('//a[contains(., "Continue")]')).click();
+
+        if (proceedWithReset) {
+            await waitForElement(By.xpath('//div[text()="Proceed with reset" or text()="Reset all"]'));
+
+            if (await browser.findElements(By.xpath('//div[text()="Reset all"]')).then(found => !!found.length)) {
+                await browser.findElement(By.xpath('//div[text()="Reset all"]')).click();
+            }
+
+            await waitForElement(By.xpath('//div[text()="Proceed with reset"]'));
+            await browser.findElement(By.xpath('//div[text()="Proceed with reset"]')).click();
+
+            await waitForElement(By.xpath('//button[@class="mx_Dialog_primary" and text()="Continue"] | //div[@class="mx_EncryptionCard_buttons"]/button[@data-kind="primary"]'));
+            await browser.findElement(By.xpath('//button[@class="mx_Dialog_primary" and text()="Continue"] | //div[@class="mx_EncryptionCard_buttons"]/button[@data-kind="primary"]')).click();
+
+            await waitForElement(By.xpath('//button[@class="mx_Dialog_primary" and text()="Continue"] | //div[@class="mx_EncryptionCard_buttons"]/button[@data-kind="primary"]'));
+            await browser.findElement(By.xpath('//button[@class="mx_Dialog_primary" and text()="Continue"] | //div[@class="mx_EncryptionCard_buttons"]/button[@data-kind="primary"]')).click();
+            await waitForElement(By.xpath('//button[text()="Done"] | //div[text()="Single Sign On"]'));
+
+            if (await browser.findElements(By.xpath('//div[text()="Single Sign On"]')).then(found => !!found.length)) {
+
+                await browser.findElement(By.xpath('//div[text()="Single Sign On"]')).click();
+
+                const originalWindowHandle = await browser.getWindowHandle();
+                await browser.wait(async () => (await browser.getAllWindowHandles()).length === 2, 10000);
+                //Loop through until we find a new window handle
+                const windows = await browser.getAllWindowHandles();
+                windows.forEach(async handle => {
+                    if (handle !== originalWindowHandle) {
+                        await browser.switchTo().window(handle);
+                    }
                });
+                await waitForElement(By.xpath('//a[contains(., "Continue with")]'));
+                await browser.findElement(By.xpath('//a[contains(., "Continue with")]')).click();
+
+                // switch back to the main window
+                await browser.switchTo().window(originalWindowHandle);
+
+                await waitForElement(By.xpath('//div[text()="Confirm"]'));
+                await browser.findElement(By.xpath('//div[text()="Confirm"]')).click();
+            }
+
+            await waitForElement(By.xpath('//div[text()="Cancel"] | //h1[contains(., "Welcome")]'));
+            if (await browser.findElements(By.xpath('//div[text()="Cancel"]')).then(found => !!found.length)) {
+                await browser.findElement(By.xpath('//div[text()="Cancel"]')).click();
+            }
+        }
+
+        await browser.sleep(3000);
+        await waitForElement(By.xpath(`//h1[contains(., "Welcome")]`));
+    }
+
+    async function loginOIDC(username, password, alreadyAuthenticated, proceedWithReset) {
+        await browser.get(`https://${elementApp.fqdn}/#/login`);
+        await browser.sleep(2000);
+
+        await waitForElement(By.css('.mx_Dropdown_arrow'));
+        await browser.findElement(By.css('.mx_Dropdown_arrow')).click();
+        await waitForElement(By.id('mx_LanguageDropdown__en'));
+        await browser.findElement(By.id('mx_LanguageDropdown__en')).click();
+        await browser.sleep(3000);
+
+        await waitForElement(By.xpath('//div[@role="button" and contains(., "Continue with")]'));
+        await browser.findElement(By.xpath('//div[@role="button" and contains(., "Continue with")]')).click();
+        if (!alreadyAuthenticated) {
+            await waitForElement(By.id('inputUsername'));
+            await browser.findElement(By.id('inputUsername')).sendKeys(username);
+            await browser.findElement(By.id('inputPassword')).sendKeys(password);
+            await browser.findElement(By.id('loginSubmitButton')).click();
+        }
+
+        await waitForElement(By.xpath('//p[@class="confirm-trust" and contains(., "Continuing will grant ")]'));
+        await browser.findElement(By.xpath('//a[contains(., "Continue")]')).click();
+
+        if (proceedWithReset) {
+            await waitForElement(By.xpath('//h2[text()="Confirm your identity"]'));
+
+            await waitForElement(By.xpath('//button[text()="Can\'t confirm?"]'));
+            await browser.findElement(By.xpath('//button[text()="Can\'t confirm?"]')).click();
+
+            await waitForElement(By.xpath('//button[text()="Continue"]'));
+            await browser.findElement(By.xpath('//button[text()="Continue"]')).click();
+
+            await waitForElement(By.xpath('//button[text()="Done"] | //div[text()="Single Sign On"]'));
+
+            if (await browser.findElements(By.xpath('//div[text()="Single Sign On"]')).then(found => !!found.length)) {
+
+                await browser.findElement(By.xpath('//div[text()="Single Sign On"]')).click();
+
+                const originalWindowHandle = await browser.getWindowHandle();
+                await browser.wait(async () => (await browser.getAllWindowHandles()).length === 2, 10000);
+                //Loop through until we find a new window handle
+                const windows = await browser.getAllWindowHandles();
+                windows.forEach(async handle => {
+                    if (handle !== originalWindowHandle) {
+                        await browser.switchTo().window(handle);
+                    }
+                });
+                await waitForElement(By.xpath('//a[contains(., "Continue with")]'));
+                await browser.findElement(By.xpath('//a[contains(., "Continue with")]')).click();
+
+                // switch back to the main window
+                await browser.switchTo().window(originalWindowHandle);
+
+                await waitForElement(By.xpath('//div[text()="Confirm"]'));
+                await browser.findElement(By.xpath('//div[text()="Confirm"]')).click();
+            }
+
+            await waitForElement(By.xpath('//div[text()="Cancel"] | //h1[contains(., "Welcome")]'));
+            if (await browser.findElements(By.xpath('//div[text()="Cancel"]')).then(found => !!found.length)) {
+                await browser.findElement(By.xpath('//div[text()="Cancel"]')).click();
+            }
+        }
+
+        await browser.sleep(3000);
+        await waitForElement(By.xpath(`//h1[contains(., "Welcome")]`));
+    }
+
+    async function login() {
+        await browser.get(`https://${elementApp.fqdn}/#/login`);
+        await browser.wait(until.elementLocated(By.xpath('//input[@value="Sign in"]')), TEST_TIMEOUT);
+        await browser.findElement(By.xpath('//input[@name="username"]')).sendKeys(USERNAME);
+        await browser.findElement(By.xpath('//input[@name="password"]')).sendKeys(PASSWORD);
+        await browser.findElement(By.xpath('//input[@value="Sign in"]')).click();
+        await browser.sleep(5000);
+        await skipVerification();
+        await browser.wait(until.elementLocated(By.xpath('//h1[contains(., "Welcome")] | //span[text()="Rooms"]')), TEST_TIMEOUT);
+    }
+
+    async function skipVerification() {
+        await browser.wait(until.elementLocated(By.xpath('//div[@aria-label="Skip verification for now"]')), TEST_TIMEOUT);
+        await browser.sleep(5000);
+        await browser.findElement(By.xpath('//div[@aria-label="Skip verification for now"]')).click();
+        await browser.wait(until.elementLocated(By.xpath('//div[contains(text(), "verify later")]')), TEST_TIMEOUT);
+        await browser.sleep(5000);
+        await browser.findElement(By.xpath('//div[contains(text(), "verify later")]')).click();
+        await browser.sleep(5000);
+    }
+
+    async function logout() {
+        await browser.get(`https://${elementApp.fqdn}/#/home`);
+        await browser.sleep(5000);
+        await waitForElement(By.xpath('//div[@role="button" and @aria-label="User menu"]'));
+
+        await browser.findElement(By.xpath('//div[@role="button" and @aria-label="User menu"]')).click();
+        await browser.sleep(2000);
+
+        await browser.findElement(By.xpath('//li[@role="menuitem" and @aria-label="Sign out"]')).click();
+        await browser.sleep(2000);
+
+        if (await browser.findElements(By.xpath('//button[contains(text(), "I don\'t want my encrypted messages")]')).then(found => !!found.length)) {
+            await browser.findElement(By.xpath('//button[contains(text(), "I don\'t want my encrypted messages")]')).click();
+            await browser.sleep(3000);
+        }
+
+        await waitForElement(By.xpath('//h1[text()="Sign in"]'));
+    }
+
+    async function isLoggedIn() {
+        await browser.get(`https://${elementApp.fqdn}/#/home`);
+        await browser.wait(until.elementLocated(By.xpath('//h1[contains(., "Welcome")] | //span[text()="Rooms"]')), TEST_TIMEOUT);
+    }
+
+    xit('build app', function () { execSync('cloudron build', EXEC_ARGS); });

    // No SSO
-    it('install app (no sso)', function () {
-        execSync('cloudron install --no-sso --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-    });
-
-    it('can get app information', function () {
-        var inspect = JSON.parse(execSync('cloudron inspect'));
-
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
-
-        expect(app).to.be.an('object');
-    });
-
+    it('install app (no sso)', function () { execSync('cloudron install --no-sso --location ' + LOCATION, EXEC_ARGS); });
+    it('can get app information', getAppInfo);
    it('check landing page', checkLandingPage);
-    it('can register new user', registerUser);
-    it('can login', checkLogin);
-    it('check autojoin', checkAutoJoinRoom);
-    it('create room', createRoom);
-    it('check room', checkRoom);

-    it('uninstall app', function () {
-        execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    it('can install element-web app (no sso)', function () { execSync('cloudron install --appstore-id im.riot.cloudronapp --location ' + ELEMENT_LOCATION, EXEC_ARGS); });
+    it('update element-app config', updateSynapseConfig);
+
+    it('can get Element app info', getElementAppInfo);
+    it('can register new user', registerUser);
+    it('can logout', logout); // from auto-login
+
+    it('can login', login);
+    it('can logout', logout);
+
+    it('uninstall element-web app', async function () {
+        await browser.get('about:blank');
+        execSync(`cloudron uninstall --app ${ELEMENT_LOCATION}`, EXEC_ARGS);
    });
+    it('uninstall app', function () { execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS); });

    // SSO
-    it('install app', function () {
-        execSync('cloudron install --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    it('install app (sso)', function () { execSync('cloudron install --location ' + LOCATION, EXEC_ARGS); });
+    it('can get app info', getAppInfo);
+
+    it('can install element-web app (sso)', function () { execSync('cloudron install --appstore-id im.riot.cloudronapp --location ' + ELEMENT_LOCATION, EXEC_ARGS); });
+    it('can get Element app info', getElementAppInfo);
+    it('update element-app config', updateSynapseConfig);
+
+    it('can login via OIDC', loginOIDC.bind(null, USERNAME, PASSWORD, false, false));
+    it('can get app info', getAppInfo);
+
+    it('can restart app', function () { execSync(`cloudron restart --app ${app.id}`); });
+
+    it('backup app', function () { execSync(`cloudron backup create --app ${app.id}`, EXEC_ARGS); });
+
+    it('is logged in', isLoggedIn);
+
+    it('restore app', async function () {
+        const backups = JSON.parse(execSync(`cloudron backup list --raw --app ${app.id}`));
+
+        await browser.get('about:blank');
+        execSync(`cloudron uninstall --app ${app.id}`, EXEC_ARGS);
+        execSync(`cloudron install --location ${LOCATION}`, EXEC_ARGS);
+
+        getAppInfo();
+
+        execSync(`cloudron restore --backup ${backups[0].id} --app ${app.id}`, EXEC_ARGS);
    });

-    it('can get app information', function () {
-        var inspect = JSON.parse(execSync('cloudron inspect'));
+    it('is logged in', isLoggedIn);
+    it('can logout', logout);
+    it('can get app info', getAppInfo);

-        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
-
-        expect(app).to.be.an('object');
-    });
-
-    it('check landing page', checkLandingPage);
-    it('can login', checkLogin);
-    it('check autojoin', checkAutoJoinRoom);
-    it('create room', createRoom);
-    it('check room', checkRoom);
-
-    it('can restart app', function (done) {
-        execSync('cloudron restart');
-        done();
-    });
-
-    it('check landing page', checkLandingPage);
-    it('check room', checkRoom);
-
-    it('backup app', function () {
-        execSync('cloudron backup create --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-    });
-
-    it('check landing page', checkLandingPage);
-    it('check room', checkRoom);
-
-    it('restore app', function () {
-        const backups = JSON.parse(execSync('cloudron backup list --raw'));
-        execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-        execSync('cloudron install --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-        var inspect = JSON.parse(execSync('cloudron inspect'));
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
-        execSync(`cloudron restore --backup ${backups[0].id} --app ${app.id}`, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-    });
-
-    it('check landing page', checkLandingPage);
-    it('check room', checkRoom);
-
-    it('move to different location', function () {
+    // web ui also throws random errors after changing domain
+    xit('move to different location (skipped since no matrix support)', async function () {
        browser.manage().deleteAllCookies();
-        execSync('cloudron configure --location ' + LOCATION + '2', { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-        var inspect = JSON.parse(execSync('cloudron inspect'));
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION + '2'; })[0];
-        expect(app).to.be.an('object');
+        await browser.get('about:blank');
+
+        execSync(`cloudron configure --location ${LOCATION}2`, EXEC_ARGS);
+        getAppInfo();
+        await browser.sleep(15000);
+    });
+    xit('update element-app config', updateSynapseConfig);
+    xit('can get Element app info', getElementAppInfo);
+    xit('can login via OIDC', loginOIDC.bind(null, USERNAME, PASSWORD, true, true));
+
+    it('uninstall app', async function () {
+        await browser.get('about:blank');
+        execSync(`cloudron uninstall --app ${app.id}`, EXEC_ARGS);
    });

-    it('check landing page', checkLandingPage);
-    it('check room', checkRoom);
-
-    it('uninstall app', function () {
-        execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    it('uninstall element-web app', function () {
+        execSync(`cloudron uninstall --app ${ELEMENT_LOCATION}`, EXEC_ARGS);
    });

    // test update
-    it('can install app', function () {
-        execSync('cloudron install --appstore-id org.matrix.synapse --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-        var inspect = JSON.parse(execSync('cloudron inspect'));
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
-        expect(app).to.be.an('object');
+    it('clear cache', clearCache);
+    it('can install app for update', function () { execSync('cloudron install --appstore-id org.matrix.synapse --location ' + LOCATION, EXEC_ARGS); });
+    it('can get app info', getAppInfo);
+
+    it('can install element-web app (update)', function () { execSync('cloudron install --appstore-id im.riot.cloudronapp --location ' + ELEMENT_LOCATION, EXEC_ARGS); });
+    it('can get Element app info', getElementAppInfo);
+    it('update element-app config', updateSynapseConfig);
+
+    it('can login via OIDC', loginOIDCOld.bind(null, USERNAME, PASSWORD, false, false));
+
+    it('is logged in', isLoggedIn);
+    it('can logout', logout);
+    it('clear cache', clearCache);
+
+    it('can update', async function () {
+        await browser.get('about:blank');
+        execSync(`cloudron update --app ${app.id}`, EXEC_ARGS);
+        await browser.sleep(15000);
    });

-    it('check landing page', checkLandingPage);
-    it('can login', checkLogin);
-    it('create room', createRoom);
-    it('check room', checkRoom);
+    it('can get Element app info', getElementAppInfo);
+    it('can login via OIDC', loginOIDC.bind(null, USERNAME, PASSWORD, false, true));

-    it('can update', function () {
-        execSync('cloudron update --app ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    it('is logged in', isLoggedIn);
+
+    it('uninstall app', async function () {
+        await browser.get('about:blank');
+        execSync(`cloudron uninstall --app ${app.id}`, EXEC_ARGS);
    });

-    it('check landing page', checkLandingPage);
-    it('check room', checkRoom);
-    it('uninstall app', function () {
-        execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+    it('uninstall element-web app', function () {
+        execSync(`cloudron uninstall --app ${ELEMENT_LOCATION}`, EXEC_ARGS);
    });
 });
-