Gå till innehållet

Configuration Examples

Tip

Edit the values in the table below — all references to them on this page will update automatically.

Input data

Server type Components Plugins
World
Organization
Parameter Value
World FQDN
Organization name
Web services FQDN
World IP
Organization IP
Web services IP
UUID for main component
UUID for Web component
UUID for API component
UUID for World component

DNS records

Record Type Record Name Record Value Purpose
A world.example.com 203.0.113.10 World
A szex4mpl318d4f4c9ba2e37f5c1b9d3e6a.world.example.com 203.0.113.20 Organization (szID)
A example.com 203.0.113.20 Web services (if enabled)
CNAME szworld.example.com world.example.com Organization registration in World

Note

Checks are performed client-side against Cloudflare's public DNS resolver (1.1.1.1). Results reflect what that resolver sees, not necessarily what your own network or the World/Organization servers see, and the lookup itself is sent to Cloudflare.

Firewall rules

Source Destination Port Purpose
0.0.0.0/0 203.0.113.10 443 Client and Organization to World communication
0.0.0.0/0 203.0.113.20 80 HTTP challenge for certificate renewal (if enabled)
0.0.0.0/0 203.0.113.20 443 TLS routes to Organization or web/API based on SNI

Configuration

World

World component

ApplicationInstance=ex4mpl30-5c2e-4b8a-9f1d-3a7e6b4c2d8f

World=world.example.com
SNTPServer=ntp.netnod.se
SNTPServerBackup=ntp.netnod.se

mailservice=true
mailservice.bounce=bounce@example.com
mailservice.domain=example.com
mailservice.reply=noreply@example.com
mailservice.sender=Synkzone
mailservice.smtp.host=mail.example.com
mailservice.smtp.port=587
mailservice.smtp.credentials=/config/mailservice-credentials.properties
mailservice.startup=admin@example.com
mailservice.monitoring=monitoring@example.com

username=smtp-user@example.com
password=secret

Organization

Main component

ApplicationInstance=ex4mpl31-8d4f-4c9b-a2e3-7f5c1b9d3e6a

Organization=example.com
AdminEmail=admin@example.com
TLSPort=443
SynkzoneWebAddress=example.com
SNTPServer=pool.ntp.org
SNTPServerBackup=pool.ntp.org
otp.issuer=Synkzone
EmailTemplates=/email-templates

# Comma-separated UUIDs of the API and BFF components — required if using API or Web
TrustedNodeInstances=ex4mpl32-3a7f-4e1c-b8d5-2c9e4f7a1b3d,ex4mpl33-6b1e-4d8c-a5f2-9e3c7b4d2f1a

mailservice=true
mailservice.bounce=bounce@example.com
mailservice.domain=example.com
mailservice.reply=noreply@example.com
mailservice.sender=Synkzone
mailservice.smtp.host=mail.example.com
mailservice.smtp.port=587
mailservice.smtp.credentials=/config/mailservice-credentials.properties
mailservice.startup=admin@example.com
mailservice.monitoring=monitoring@example.com

remote_storage.enabled=true
remote_storage.bucket=ex4mpl31-8d4f-4c9b-a2e3-7f5c1b9d3e6a
remote_storage.provider=SafeSpring
remote_storage.endpoint=s3.sto2.safedc.net
remote_storage.credentials=/config/remote-storage-credentials.properties

IDPType=GenericOIDC
IDPIssuerURL=https://login.example.com
IDPClientId=ex4mpl3-client-id
IDPName=My IDP
OAuthClientSecret.path=/config/oauth-client-secret
AutoCreateIDPUsers=true

username=smtp-user@example.com
password=secret

accessKey=EXMPL1234567890ABCD
secretKey=ExAmPlEsEcReTkEy1234567890abcdefghijkl

ExAmPlEcLiEnTsEcReT1234567890abcdefgh

API component

ApplicationInstance=ex4mpl32-3a7f-4e1c-b8d5-2c9e4f7a1b3d

world=world.example.com
organization=example.com
ClientScope=SynkzoneSSI
StorageFileDirectory=/storage
ApplicationDataDirectory=/appdata

Web component

ApplicationInstance=ex4mpl33-6b1e-4d8c-a5f2-9e3c7b4d2f1a

world=world.example.com
organization=example.com
ClientScope=SynkzoneWeb
ApplicationDataDirectory=/appdata
StorageFileDirectory=/storage

SCIM component

com.synkzone.ssi.api.token=EXMPLscimApiToken1234567890abcdef
com.synkzone.azure.token=EXMPLazureSharedSecret1234567890
com.synkzone.preferred.language.code=en
# UPN domain used to classify users as internal (matched against user's UPN)
com.synkzone.organization.name.internal.users=customer.onmicrosoft.com
com.synkzone.organization.name.case.sensitive=false
com.synkzone.allow.creation.internal.users=true
com.synkzone.allow.creation.external.users=true
# Organization email domain — used with the use_left_side_of_upn email strategy
com.synkzone.organization.email=example.com
com.synkzone.email.strategy.internal=use_scim_email
com.synkzone.email.strategy.external=use_scim_email

Reverse Proxy

An example nginx setup satisfying the Reverse Proxy requirements.

# Routes by SNI on port 443
stream {
    map_hash_bucket_size 128;
    map $ssl_preread_server_name $backend {
        default "";
        synkzone.example.com    https_web;
        szex4mpl318d4f4c9ba2e37f5c1b9d3e6a.world.example.com  sz_service;
    }
    upstream https_web  { server 127.0.0.1:8443; }
    upstream sz_service { server 127.0.0.1:38443; }
    server {
        listen 443;
        ssl_preread on;
        proxy_pass $backend;
    }
}



# Terminates TLS and routes by path
server {
    if ($host = synkzone.example.com) {
        return 301 https://$host$request_uri;
    }
    listen 80;
    server_name synkzone.example.com;
    return 404;
}
server {
    listen 8443 ssl;
    server_name synkzone.example.com;
    client_max_body_size 1000M;
    ssl_certificate     /etc/letsencrypt/live/synkzone.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/synkzone.example.com/privkey.pem;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    location /         { proxy_pass http://127.0.0.1:8082; }
    location /api/     { proxy_pass http://127.0.0.1:8080/api/; }
    location /bff/api/ { proxy_pass http://127.0.0.1:8081/api/; }
    location /scim/    { proxy_pass http://127.0.0.1:8083; }
}