snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/zulip/templates/cron.template.erb

@@ -0,0 +1,15 @@
+MAILTO=zulip
+PATH=/usr/local/bin:/usr/bin:/bin
+SHELL=/bin/bash
+USER=<%= @user %>
+RUNNING_UNDER_CRON=1
+<% if @proxy != '' -%>
+HTTP_proxy="<%= @proxy %>"
+HTTPS_proxy="<%= @proxy %>"
+<% end -%>
+<% if @dsn != '' -%>
+SENTRY_DSN=<%= @dsn %>
+<% end -%>
+
+<%= @minute %> <%= @hour %> * * <%= @dow %>    <%= @user %>    <%= @run %>
+

puppet/zulip/templates/logrotate/nginx.template.erb

@@ -0,0 +1,18 @@
+/var/log/nginx/*.log {
+	daily
+	missingok
+	rotate <%= @access_log_retention_days %>
+	compress
+	delaycompress
+	notifempty
+	create 0640 zulip adm
+	sharedscripts
+	prerotate
+		if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
+			run-parts /etc/logrotate.d/httpd-prerotate; \
+		fi \
+	endscript
+	postrotate
+		invoke-rc.d nginx rotate >/dev/null 2>&1
+	endscript
+}

puppet/zulip/templates/logrotate/zulip.template.erb

@@ -0,0 +1,58 @@
+# Logfiles generated by Django understand logrotate's standard
+# "create" functionality, via logging.handlers.WatchedFileHandler
+
+/var/log/zulip/analytics.log
+/var/log/zulip/auth.log
+/var/log/zulip/digest.log
+/var/log/zulip/email_deliverer.log
+/var/log/zulip/email_content.log
+/var/log/zulip/email_mirror.log
+/var/log/zulip/errors.log
+/var/log/zulip/ldap.log
+/var/log/zulip/manage.log
+/var/log/zulip/message_retention.log
+/var/log/zulip/deliver_scheduled_messages.log
+/var/log/zulip/send_email.log
+/var/log/zulip/slow_queries.log
+/var/log/zulip/soft_deactivation.log
+/var/log/zulip/sync_ldap_user_data.log
+/var/log/zulip/webhooks_errors.log
+/var/log/zulip/webhooks_unsupported_events.log
+/var/log/zulip/workers.log
+/var/log/zulip/registration.log
+{
+    missingok
+    rotate 3
+    size 25M
+    compress
+    delaycompress
+    notifempty
+    create 644 zulip zulip
+}
+
+/var/log/zulip/server.log
+{
+    missingok
+    rotate <%= @access_log_retention_days %>
+    daily
+    compress
+    delaycompress
+    notifempty
+    create 644 zulip zulip
+}
+
+# Logfiles generated from supervisor _do not_ understand logrotate,
+# and thus must use copytruncate.  They also must not use supervisor's
+# built-in log rotation.
+/var/log/zulip/tornado-*.log
+/var/log/zulip/tornado.log
+/var/log/zulip/tusd.log
+{
+    missingok
+    rotate <%= @access_log_retention_days %>
+    daily
+    compress
+    delaycompress
+    notifempty
+    copytruncate
+}

puppet/zulip/templates/memcached.conf.template.erb

@@ -0,0 +1,61 @@
+# memcached default config file
+# 2003 - Jay Bonci <jaybonci@debian.org>
+# This configuration file is read by the start-memcached script provided as
+# part of the Debian GNU/Linux distribution.
+
+# Run memcached as a daemon. This command is implied, and is not needed for the
+# daemon to run. See the README.Debian that comes with this package for more
+# information.
+-d
+
+# Log memcached's output to /var/log/memcached
+logfile /var/log/memcached.log
+
+# Be verbose
+# -v
+
+# Be even more verbose (print client commands as well)
+# -vv
+
+# Start with a cap of 64 megs of memory. It's reasonable, and the daemon default
+# Note that the daemon will grow to this size, but does not start out holding this much
+# memory
+-m <%= @memcached_memory %>
+
+# Default connection port is 11211
+-p 11211
+
+# Run the daemon as root. The start-memcached will default to running as root if no
+# -u command is present in this config file
+-u memcache
+
+# Specify which IP address to listen on. The default is to listen on all IP addresses
+# This parameter is one of the only security measures that memcached has, so make sure
+# it's listening on a firewalled interface.
+-l 127.0.0.1
+
+# Limit the number of simultaneous incoming connections. The daemon default is 1024
+# -c 1024
+
+# Lock down all paged memory. Consult with the README and homepage before you do this
+# -k
+
+# Return error when memory is exhausted (rather than removing items)
+# -M
+
+# Maximize core file limit
+# -r
+
+# Use a pidfile
+-P /var/run/memcached/memcached.pid
+
+# Enable SASL authentication
+-S
+<% if @memcached_max_item_size != '1m' %>
+# Larger max-item-size
+-I <%= @memcached_max_item_size %>
+<% end -%>
+<%- if @memcached_size_reporting %>
+# Enable `stats sizes` (see https://github.com/memcached/memcached/blob/master/doc/protocol.txt)
+-o track_sizes
+<% end -%>

puppet/zulip/templates/nginx.conf.template.erb

@@ -0,0 +1,69 @@
+user zulip;
+
+worker_processes <%= @worker_processes %>;
+pid /var/run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+worker_rlimit_nofile 1000000;
+events {
+    worker_connections <%= @worker_connections %>;
+
+    use epoll;
+
+    multi_accept on;
+}
+
+http {
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    client_max_body_size 25m;
+
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    log_format combined_with_host_and_time '$trusted_remote_addr - $remote_user [$time_local] '
+                                           '"$request" $status $body_bytes_sent '
+                                           '"$http_referer" "$http_user_agent" $host $request_time';
+    access_log /var/log/nginx/access.log combined_with_host_and_time;
+    error_log /var/log/nginx/error.log;
+
+    reset_timedout_connection on;
+
+    gzip on;
+    gzip_proxied any;
+    gzip_comp_level 3;
+    gzip_types
+      application/javascript
+      application/json
+      application/xml
+      application/x-javascript
+      image/svg+xml
+      text/css
+      text/javascript
+      text/plain;
+    gzip_vary on;
+
+    # https://wiki.mozilla.org/Security/Server_Side_TLS intermediate profile
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_tickets off;
+    ssl_dhparam /etc/nginx/dhparam.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    ssl_trusted_certificate <%= @ca_crt %>;
+
+
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*;
+
+    map $host $help_alias {
+        zulip.com /home/zulip/deployments/current/starlight_help/dist_no_relative_links/;
+        default   /home/zulip/deployments/current/starlight_help/dist/;
+    }
+}

puppet/zulip/templates/nginx/healthcheck.conf.template.erb

@@ -0,0 +1,21 @@
+location /health {
+    allow 127.0.0.1;
+    allow ::1;
+
+<% @loadbalancers.each do |host| -%>
+    allow <%= host %>;
+<% end -%>
+
+    deny all;
+
+    include uwsgi_params;
+
+    # Healthchecks may not supply a Host header; but also nothing in
+    # the response is host-specific, as the Django processes
+    # themselves are what are being healthchecked.  we hardcode a Host
+    # that we know is in ALLOWED_HOSTS.  The alternative is injecting
+    # a new Django middleware before
+    # `django.middleware.security.SecurityMiddleware` which only kicks
+    # in for this one specific path.
+    uwsgi_param HTTP_HOST "127.0.0.1";
+}

puppet/zulip/templates/nginx/s3-cache.template.erb

@@ -0,0 +1,26 @@
+# nginx does its own DNS resolution, which is necessary here to
+# resolve the IP of the S3 server.  Point it at whatever is configured
+# first in /etc/resolv.conf.  The validity duration is set to match
+# S3's DNS validity.
+resolver <%= @nginx_resolver_ip %> valid=300s;
+resolver_timeout 10s;
+
+# This cache is only used if S3 file storage is configured.
+proxy_cache_path /srv/zulip-uploaded-files-cache
+    levels=1:2
+    keys_zone=uploads:<%= @s3_memory_cache_size %>
+    inactive=<%= @s3_cache_inactive_time %>
+    max_size=<%= @s3_disk_cache_size %>;
+
+# This is used when proxying requests to S3; we wish to know if the
+# proxied request is asking to override the Content-Disposition in its
+# response, so we can adjust our cache key.  Unfortunately, $arg_foo
+# style variables pre-parsed from query parameters don't work with
+# query parameters with dashes, so we parse it out by hand.  Despite
+# needing to be declared at the 'http' level,. nginx applies maps like
+# this lazily, so this only affects internal S3 proxied requests.
+
+map $args $s3_disposition_cache_key {
+    default "";
+    "~(^|&)(?<param>response-content-disposition=[^&]+)" "?$param";
+}

puppet/zulip/templates/nginx/tornado-upstreams.conf.template.erb

@@ -0,0 +1,24 @@
+<% if @tornado_ports.length > 1 -%>
+<% @tornado_ports.each do |port| -%>
+upstream tornado<%= port %> {
+    server 127.0.0.1:<%= port %>;
+    keepalive 10000;
+}
+<% end -%>
+<% @tornado_groups.each do |group| -%>
+<% if group.length > 1 -%>
+upstream tornado<%= group.join('_') %> {
+    random;
+<% group.each do |port| -%>
+    server 127.0.0.1:<%= port %>;
+<% end -%>
+    keepalive 10000;
+}
+<% end -%>
+<% end -%>
+<% else -%>
+upstream tornado {
+    server 127.0.0.1:9800;
+    keepalive 10000;
+}
+<% end -%>

puppet/zulip/templates/nginx/trusted-ip.template.erb

@@ -0,0 +1,54 @@
+<% if @loadbalancers.any? %>
+  # Configuration for making Zulip app frontends accept the
+  # X-Forwarded-For header used by proxies.  The trusted IP addresses
+  # here are set by `loadbalancer.ips` in /etc/zulip/zulip.conf.
+  #
+  # This causes us to update $remote_addr, which we use in logging, and
+  # also pass down to Zulip as X-Real-Ip.
+  real_ip_header X-Forwarded-For;
+  real_ip_recursive on;
+  <% @loadbalancers.each do |host| -%>
+  set_real_ip_from <%= host %>;
+  <% end -%>
+
+  <% if @true_client_header == '' %>
+    # real_ip has done the work of updating $remote_addr based
+    # on the trusted @loadbalancers
+    map $remote_addr $trusted_remote_addr {
+      default $remote_addr;
+    }
+  <% else %>
+    <% if @true_client_header_from.any? %>
+      # We have a separate set of post-X-Forwarded-For IPs we
+      # trust with $http_<%= @true_client_header %>
+      geo $remote_addr $do_trust_<%= @true_client_header %> {
+        default 0;
+        <% @true_client_header_from.each do |host| %>
+        <%= host %> 1;
+        <%- end %>
+      }
+    <% else %>
+      # If our most recent hop came from a trusted source, we
+      # trust $http_<%= @true_client_header %>
+      geo $realip_remote_addr $do_trust_<%= @true_client_header %> {
+        default 0;
+        <% @loadbalancers.each do |host| %>
+        <%= host %> 1;
+        <%- end %>
+      }
+    <% end %>
+
+    # This is done in two steps because geo handles CIDRs,
+    # and map handles interpolation.
+    map "$do_trust_<%= @true_client_header %>:$http_<%= @true_client_header %>" $trusted_remote_addr {
+      "~^0:"  $remote_addr;
+      "~^1:$" $remote_addr;
+      "~^1:"  $http_<%= @true_client_header %>;
+    }
+  <% end %>
+<% else %>
+  # No remote proxies -- the remote_addr is what it is
+  map $remote_addr $trusted_remote_addr {
+    default $remote_addr;
+  }
+<% end %>

puppet/zulip/templates/nginx/trusted-proto.template.erb

@@ -0,0 +1,50 @@
+<% if @loadbalancers.empty? %>
+# "set" is not supported at the server level, so use a map:
+map $remote_addr $trusted_x_forwarded_proto {
+    default $scheme;
+}
+map "$scheme:$http_x_forwarded_for" $x_proxy_misconfiguration {
+    "~^https?:." "No proxies configured in Zulip, but reverse proxy headers were detected from $remote_addr; Zulip must be configured with the IP addresses of reverse proxies to trust.  See https://zulip.readthedocs.io/en/latest/production/reverse-proxies.html";
+    "~^http:$" "Request came in over HTTP, with no proxy headers; if HTTPS is disabled in Zulip, it must be behind a proxy which does TLS termination.  See https://zulip.readthedocs.io/en/latest/production/reverse-proxies.html";
+    default "";
+}
+<% else %>
+# Check if the request's original `REMOTE_ADDR` header was from a
+# trusted host -- that is, the request did bounce through a proxy and
+# we should trust `X-Forwarded-Proto`
+geo $realip_remote_addr $is_x_forwarded_proto_trusted {
+    default 0;
+<% @loadbalancers.each do |host| -%>
+    <%= host %> 1;
+<% end -%>
+}
+
+# Check if the IP address that we resolved the request as coming
+# (after looking at X-Forwarded-For, if any) from is actually the proxy
+# itself.
+geo $remote_addr $is_from_proxy {
+    default 0;
+<% @loadbalancers.each do |host| -%>
+    <%= host %> 1;
+<% end -%>
+}
+
+# We set $trusted_x_forwarded_proto in two steps because `geo` does
+# not support variable interpolation in the value, but does support
+# CIDR notation, which the loadbalancer list may use.
+map "$is_x_forwarded_proto_trusted:$http_x_forwarded_proto" $trusted_x_forwarded_proto {
+    "~^0:" $scheme;
+<%- if @lb_rejects_http_requests -%>
+    "~^1:$" "https";
+<% end -%>
+    "~^1:" $http_x_forwarded_proto;
+}
+
+map "$is_from_proxy:$is_x_forwarded_proto_trusted:$http_x_forwarded_proto" $x_proxy_misconfiguration {
+    "~^0:0:" "Incorrect reverse proxy IPs set in Zulip (try $remote_addr?); see https://zulip.readthedocs.io/en/latest/production/reverse-proxies.html";
+<%- if not @lb_rejects_http_requests -%>
+    "~^0:1:$" "No X-Forwarded-Proto header sent from trusted proxy $realip_remote_addr; see example configurations in https://zulip.readthedocs.io/en/latest/production/reverse-proxies.html";
+<% end -%>
+    default "";
+}
+<% end %>

puppet/zulip/templates/nginx/zulip-enterprise.template.erb

@@ -0,0 +1,54 @@
+# For local IPC -- tusd to Django, or Django to Tornado
+server {
+<% if @nginx_http_only -%>
+    listen 127.0.0.1:<%= @nginx_listen_port %>;
+<% else -%>
+    listen 127.0.0.1:80;
+<% end -%>
+    include /etc/nginx/zulip-include/app;
+    include /etc/nginx/zulip-include/localhost.d/*.conf;
+}
+
+
+<% if @nginx_http_only -%>
+<% else -%>
+server {
+    listen 80;
+    listen [::]:80;
+<% if @nginx_server_name != '' -%>
+    server_name <%= @nginx_server_name %>;
+<% end -%>
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    include /etc/nginx/zulip-include/certbot;
+}
+<% end -%>
+
+include /etc/nginx/zulip-include/trusted-ip;
+include /etc/nginx/zulip-include/trusted-proto;
+include /etc/nginx/zulip-include/s3-cache;
+include /etc/nginx/zulip-include/upstreams;
+include /etc/zulip/nginx_sharding_map.conf;
+
+
+server {
+<% if @nginx_http_only -%>
+    listen <%= @nginx_listen_port %>;
+    listen [::]:<%= @nginx_listen_port %>;
+<% else -%>
+    listen <%= @nginx_listen_port %> ssl http2;
+    listen [::]:<%= @nginx_listen_port %> ssl http2;
+
+    ssl_certificate <%= @ssl_dir %>/certs/zulip.combined-chain.crt;
+    ssl_certificate_key <%= @ssl_dir %>/private/zulip.key;
+<% end -%>
+<% if @nginx_server_name != '' -%>
+    server_name <%= @nginx_server_name %>;
+<% end -%>
+
+    include /etc/nginx/zulip-include/certbot;
+    include /etc/nginx/zulip-include/app;
+}

puppet/zulip/templates/postgresql/14/postgresql.conf.template.erb

@@ -0,0 +1,883 @@
+# -----------------------------
+# PostgreSQL configuration file
+# -----------------------------
+#
+# This file consists of lines of the form:
+#
+#   name = value
+#
+# (The "=" is optional.)  Whitespace may be used.  Comments are introduced with
+# "#" anywhere on a line.  The complete list of parameter names and allowed
+# values can be found in the PostgreSQL documentation.
+#
+# The commented-out settings shown in this file represent the default values.
+# Re-commenting a setting is NOT sufficient to revert it to the default value;
+# you need to reload the server.
+#
+# This file is read on server startup and when the server receives a SIGHUP
+# signal.  If you edit the file on a running system, you have to SIGHUP the
+# server for the changes to take effect, run "pg_ctl reload", or execute
+# "SELECT pg_reload_conf()".  Some parameters, which are marked below,
+# require a server shutdown and restart to take effect.
+#
+# Any parameter can also be given as a command-line option to the server, e.g.,
+# "postgres -c log_connections=on".  Some parameters can be changed at run time
+# with the "SET" SQL command.
+#
+# Memory units:  B  = bytes            Time units:  us  = microseconds
+#                kB = kilobytes                     ms  = milliseconds
+#                MB = megabytes                     s   = seconds
+#                GB = gigabytes                     min = minutes
+#                TB = terabytes                     h   = hours
+#                                                   d   = days
+
+
+#------------------------------------------------------------------------------
+# FILE LOCATIONS
+#------------------------------------------------------------------------------
+
+# The default values of these variables are driven from the -D command-line
+# option or PGDATA environment variable, represented here as ConfigDir.
+
+data_directory = '<%= scope["zulip::postgresql_base::postgresql_datadir"] %>'		# use data in another directory
+					# (change requires restart)
+hba_file = '<%= scope["zulip::postgresql_base::postgresql_confdir"] %>/pg_hba.conf'	# host-based authentication file
+					# (change requires restart)
+ident_file = '<%= scope["zulip::postgresql_base::postgresql_confdir"] %>/pg_ident.conf'	# ident configuration file
+					# (change requires restart)
+
+# If external_pid_file is not explicitly set, no extra PID file is written.
+external_pid_file = '/var/run/postgresql/<%= scope["zulip::postgresql_common::version"] %>-main.pid'			# write an extra PID file
+					# (change requires restart)
+
+
+#------------------------------------------------------------------------------
+# CONNECTIONS AND AUTHENTICATION
+#------------------------------------------------------------------------------
+
+# - Connection Settings -
+
+#listen_addresses = 'localhost'		# what IP address(es) to listen on;
+					# comma-separated list of addresses;
+					# defaults to 'localhost'; use '*' for all
+					# (change requires restart)
+port = 5432				# (change requires restart)
+max_connections = 100			# (change requires restart)
+#superuser_reserved_connections = 3	# (change requires restart)
+unix_socket_directories = '/var/run/postgresql'	# comma-separated list of directories
+					# (change requires restart)
+#unix_socket_group = ''			# (change requires restart)
+#unix_socket_permissions = 0777		# begin with 0 to use octal notation
+					# (change requires restart)
+#bonjour = off				# advertise server via Bonjour
+					# (change requires restart)
+#bonjour_name = ''			# defaults to the computer name
+					# (change requires restart)
+
+# - TCP settings -
+# see "man tcp" for details
+
+#tcp_keepalives_idle = 0		# TCP_KEEPIDLE, in seconds;
+					# 0 selects the system default
+#tcp_keepalives_interval = 0		# TCP_KEEPINTVL, in seconds;
+					# 0 selects the system default
+#tcp_keepalives_count = 0		# TCP_KEEPCNT;
+					# 0 selects the system default
+#tcp_user_timeout = 0			# TCP_USER_TIMEOUT, in milliseconds;
+					# 0 selects the system default
+
+#client_connection_check_interval = 0	# time between checks for client
+					# disconnection while running queries;
+					# 0 for never
+
+# - Authentication -
+
+#authentication_timeout = 1min		# 1s-600s
+#password_encryption = scram-sha-256	# scram-sha-256 or md5
+#db_user_namespace = off
+
+# GSSAPI using Kerberos
+#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
+#krb_caseins_users = off
+
+# - SSL -
+
+ssl = on
+#ssl_ca_file = ''
+ssl_cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem'
+#ssl_crl_file = ''
+#ssl_crl_dir = ''
+ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'
+#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
+#ssl_prefer_server_ciphers = on
+#ssl_ecdh_curve = 'prime256v1'
+#ssl_min_protocol_version = 'TLSv1.2'
+#ssl_max_protocol_version = ''
+#ssl_dh_params_file = ''
+#ssl_passphrase_command = ''
+#ssl_passphrase_command_supports_reload = off
+
+
+#------------------------------------------------------------------------------
+# RESOURCE USAGE (except WAL)
+#------------------------------------------------------------------------------
+
+# - Memory -
+
+shared_buffers = 128MB			# min 128kB
+					# (change requires restart)
+#huge_pages = try			# on, off, or try
+					# (change requires restart)
+#huge_page_size = 0			# zero for system default
+					# (change requires restart)
+#temp_buffers = 8MB			# min 800kB
+#max_prepared_transactions = 0		# zero disables the feature
+					# (change requires restart)
+# Caution: it is not advisable to set max_prepared_transactions nonzero unless
+# you actively intend to use prepared transactions.
+#work_mem = 4MB				# min 64kB
+#hash_mem_multiplier = 1.0		# 1-1000.0 multiplier on hash table work_mem
+#maintenance_work_mem = 64MB		# min 1MB
+#autovacuum_work_mem = -1		# min 1MB, or -1 to use maintenance_work_mem
+#logical_decoding_work_mem = 64MB	# min 64kB
+#max_stack_depth = 2MB			# min 100kB
+#shared_memory_type = mmap		# the default is the first option
+					# supported by the operating system:
+					#   mmap
+					#   sysv
+					#   windows
+					# (change requires restart)
+dynamic_shared_memory_type = posix	# the default is the first option
+					# supported by the operating system:
+					#   posix
+					#   sysv
+					#   windows
+					#   mmap
+					# (change requires restart)
+#min_dynamic_shared_memory = 0MB	# (change requires restart)
+
+# - Disk -
+
+#temp_file_limit = -1			# limits per-process temp file space
+					# in kilobytes, or -1 for no limit
+
+# - Kernel Resources -
+
+#max_files_per_process = 1000		# min 64
+					# (change requires restart)
+
+# - Cost-Based Vacuum Delay -
+
+#vacuum_cost_delay = 0			# 0-100 milliseconds (0 disables)
+#vacuum_cost_page_hit = 1		# 0-10000 credits
+#vacuum_cost_page_miss = 2		# 0-10000 credits
+#vacuum_cost_page_dirty = 20		# 0-10000 credits
+#vacuum_cost_limit = 200		# 1-10000 credits
+
+# - Background Writer -
+
+#bgwriter_delay = 200ms			# 10-10000ms between rounds
+#bgwriter_lru_maxpages = 100		# max buffers written/round, 0 disables
+#bgwriter_lru_multiplier = 2.0		# 0-10.0 multiplier on buffers scanned/round
+#bgwriter_flush_after = 512kB		# measured in pages, 0 disables
+
+# - Asynchronous Behavior -
+
+#backend_flush_after = 0		# measured in pages, 0 disables
+#effective_io_concurrency = 1		# 1-1000; 0 disables prefetching
+#maintenance_io_concurrency = 10	# 1-1000; 0 disables prefetching
+#max_worker_processes = 8		# (change requires restart)
+#max_parallel_workers_per_gather = 2	# taken from max_parallel_workers
+#max_parallel_maintenance_workers = 2	# taken from max_parallel_workers
+#max_parallel_workers = 8		# maximum number of max_worker_processes that
+					# can be used in parallel operations
+#parallel_leader_participation = on
+#old_snapshot_threshold = -1		# 1min-60d; -1 disables; 0 is immediate
+					# (change requires restart)
+
+
+#------------------------------------------------------------------------------
+# WRITE-AHEAD LOG
+#------------------------------------------------------------------------------
+
+# - Settings -
+
+#wal_level = replica			# minimal, replica, or logical
+					# (change requires restart)
+#fsync = on				# flush data to disk for crash safety
+					# (turning this off can cause
+					# unrecoverable data corruption)
+#synchronous_commit = on		# synchronization level;
+					# off, local, remote_write, remote_apply, or on
+#wal_sync_method = fsync		# the default is the first option
+					# supported by the operating system:
+					#   open_datasync
+					#   fdatasync (default on Linux and FreeBSD)
+					#   fsync
+					#   fsync_writethrough
+					#   open_sync
+#full_page_writes = on			# recover from partial page writes
+#wal_log_hints = off			# also do full page writes of non-critical updates
+					# (change requires restart)
+#wal_compression = off			# enable compression of full-page writes
+#wal_init_zero = on			# zero-fill new WAL files
+#wal_recycle = on			# recycle WAL files
+#wal_buffers = -1			# min 32kB, -1 sets based on shared_buffers
+					# (change requires restart)
+#wal_writer_delay = 200ms		# 1-10000 milliseconds
+#wal_writer_flush_after = 1MB		# measured in pages, 0 disables
+#wal_skip_threshold = 2MB
+
+#commit_delay = 0			# range 0-100000, in microseconds
+#commit_siblings = 5			# range 1-1000
+
+# - Checkpoints -
+
+#checkpoint_timeout = 5min		# range 30s-1d
+#checkpoint_completion_target = 0.9	# checkpoint target duration, 0.0 - 1.0
+#checkpoint_flush_after = 256kB		# measured in pages, 0 disables
+#checkpoint_warning = 30s		# 0 disables
+max_wal_size = 1GB
+min_wal_size = 80MB
+
+# - Archiving -
+
+#archive_mode = off		# enables archiving; off, on, or always
+				# (change requires restart)
+#archive_command = ''		# command to use to archive a logfile segment
+				# placeholders: %p = path of file to archive
+				#               %f = file name only
+				# e.g. 'test ! -f /mnt/server/archivedir/%f && cp %p /mnt/server/archivedir/%f'
+#archive_timeout = 0		# force a logfile segment switch after this
+				# number of seconds; 0 disables
+
+# - Archive Recovery -
+
+# These are only used in recovery mode.
+
+#restore_command = ''		# command to use to restore an archived logfile segment
+				# placeholders: %p = path of file to restore
+				#               %f = file name only
+				# e.g. 'cp /mnt/server/archivedir/%f %p'
+#archive_cleanup_command = ''	# command to execute at every restartpoint
+#recovery_end_command = ''	# command to execute at completion of recovery
+
+# - Recovery Target -
+
+# Set these only when performing a targeted recovery.
+
+#recovery_target = ''		# 'immediate' to end recovery as soon as a
+                                # consistent state is reached
+				# (change requires restart)
+#recovery_target_name = ''	# the named restore point to which recovery will proceed
+				# (change requires restart)
+#recovery_target_time = ''	# the time stamp up to which recovery will proceed
+				# (change requires restart)
+#recovery_target_xid = ''	# the transaction ID up to which recovery will proceed
+				# (change requires restart)
+#recovery_target_lsn = ''	# the WAL LSN up to which recovery will proceed
+				# (change requires restart)
+#recovery_target_inclusive = on # Specifies whether to stop:
+				# just after the specified recovery target (on)
+				# just before the recovery target (off)
+				# (change requires restart)
+#recovery_target_timeline = 'latest'	# 'current', 'latest', or timeline ID
+				# (change requires restart)
+#recovery_target_action = 'pause'	# 'pause', 'promote', 'shutdown'
+				# (change requires restart)
+
+
+#------------------------------------------------------------------------------
+# REPLICATION
+#------------------------------------------------------------------------------
+
+# - Sending Servers -
+
+# Set these on the primary and on any standby that will send replication data.
+
+#max_wal_senders = 10		# max number of walsender processes
+				# (change requires restart)
+#max_replication_slots = 10	# max number of replication slots
+				# (change requires restart)
+#wal_keep_size = 0		# in megabytes; 0 disables
+#max_slot_wal_keep_size = -1	# in megabytes; -1 disables
+#wal_sender_timeout = 60s	# in milliseconds; 0 disables
+#track_commit_timestamp = off	# collect timestamp of transaction commit
+				# (change requires restart)
+
+# - Primary Server -
+
+# These settings are ignored on a standby server.
+
+#synchronous_standby_names = ''	# standby servers that provide sync rep
+				# method to choose sync standbys, number of sync standbys,
+				# and comma-separated list of application_name
+				# from standby(s); '*' = all
+#vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
+
+# - Standby Servers -
+
+# These settings are ignored on a primary server.
+
+#primary_conninfo = ''			# connection string to sending server
+#primary_slot_name = ''			# replication slot on sending server
+#promote_trigger_file = ''		# file name whose presence ends recovery
+#hot_standby = on			# "off" disallows queries during recovery
+					# (change requires restart)
+#max_standby_archive_delay = 30s	# max delay before canceling queries
+					# when reading WAL from archive;
+					# -1 allows indefinite delay
+#max_standby_streaming_delay = 30s	# max delay before canceling queries
+					# when reading streaming WAL;
+					# -1 allows indefinite delay
+#wal_receiver_create_temp_slot = off	# create temp slot if primary_slot_name
+					# is not set
+#wal_receiver_status_interval = 10s	# send replies at least this often
+					# 0 disables
+#hot_standby_feedback = off		# send info from standby to prevent
+					# query conflicts
+#wal_receiver_timeout = 60s		# time that receiver waits for
+					# communication from primary
+					# in milliseconds; 0 disables
+#wal_retrieve_retry_interval = 5s	# time to wait before retrying to
+					# retrieve WAL after a failed attempt
+#recovery_min_apply_delay = 0		# minimum delay for applying changes during recovery
+
+# - Subscribers -
+
+# These settings are ignored on a publisher.
+
+#max_logical_replication_workers = 4	# taken from max_worker_processes
+					# (change requires restart)
+#max_sync_workers_per_subscription = 2	# taken from max_logical_replication_workers
+
+
+#------------------------------------------------------------------------------
+# QUERY TUNING
+#------------------------------------------------------------------------------
+
+# - Planner Method Configuration -
+
+#enable_async_append = on
+#enable_bitmapscan = on
+#enable_gathermerge = on
+#enable_hashagg = on
+#enable_hashjoin = on
+#enable_incremental_sort = on
+#enable_indexscan = on
+#enable_indexonlyscan = on
+#enable_material = on
+#enable_memoize = on
+#enable_mergejoin = on
+#enable_nestloop = on
+#enable_parallel_append = on
+#enable_parallel_hash = on
+#enable_partition_pruning = on
+#enable_partitionwise_join = off
+#enable_partitionwise_aggregate = off
+#enable_seqscan = on
+#enable_sort = on
+#enable_tidscan = on
+
+# - Planner Cost Constants -
+
+#seq_page_cost = 1.0			# measured on an arbitrary scale
+#random_page_cost = 4.0			# same scale as above
+#cpu_tuple_cost = 0.01			# same scale as above
+#cpu_index_tuple_cost = 0.005		# same scale as above
+#cpu_operator_cost = 0.0025		# same scale as above
+#parallel_setup_cost = 1000.0	# same scale as above
+#parallel_tuple_cost = 0.1		# same scale as above
+#min_parallel_table_scan_size = 8MB
+#min_parallel_index_scan_size = 512kB
+#effective_cache_size = 4GB
+
+#jit_above_cost = 100000		# perform JIT compilation if available
+					# and query more expensive than this;
+					# -1 disables
+#jit_inline_above_cost = 500000		# inline small functions if query is
+					# more expensive than this; -1 disables
+#jit_optimize_above_cost = 500000	# use expensive JIT optimizations if
+					# query is more expensive than this;
+					# -1 disables
+
+# - Genetic Query Optimizer -
+
+#geqo = on
+#geqo_threshold = 12
+#geqo_effort = 5			# range 1-10
+#geqo_pool_size = 0			# selects default based on effort
+#geqo_generations = 0			# selects default based on effort
+#geqo_selection_bias = 2.0		# range 1.5-2.0
+#geqo_seed = 0.0			# range 0.0-1.0
+
+# - Other Planner Options -
+
+#default_statistics_target = 100	# range 1-10000
+#constraint_exclusion = partition	# on, off, or partition
+#cursor_tuple_fraction = 0.1		# range 0.0-1.0
+#from_collapse_limit = 8
+#jit = on				# allow JIT compilation
+#join_collapse_limit = 8		# 1 disables collapsing of explicit
+					# JOIN clauses
+#plan_cache_mode = auto			# auto, force_generic_plan or
+					# force_custom_plan
+
+
+#------------------------------------------------------------------------------
+# REPORTING AND LOGGING
+#------------------------------------------------------------------------------
+
+# - Where to Log -
+
+#log_destination = 'stderr'		# Valid values are combinations of
+					# stderr, csvlog, syslog, and eventlog,
+					# depending on platform.  csvlog
+					# requires logging_collector to be on.
+
+# This is used when logging to stderr:
+#logging_collector = off		# Enable capturing of stderr and csvlog
+					# into log files. Required to be on for
+					# csvlogs.
+					# (change requires restart)
+
+# These are only used if logging_collector is on:
+#log_directory = 'log'			# directory where log files are written,
+					# can be absolute or relative to PGDATA
+#log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'	# log file name pattern,
+					# can include strftime() escapes
+#log_file_mode = 0600			# creation mode for log files,
+					# begin with 0 to use octal notation
+#log_rotation_age = 1d			# Automatic rotation of logfiles will
+					# happen after that time.  0 disables.
+#log_rotation_size = 10MB		# Automatic rotation of logfiles will
+					# happen after that much log output.
+					# 0 disables.
+#log_truncate_on_rotation = off		# If on, an existing log file with the
+					# same name as the new log file will be
+					# truncated rather than appended to.
+					# But such truncation only occurs on
+					# time-driven rotation, not on restarts
+					# or size-driven rotation.  Default is
+					# off, meaning append to existing files
+					# in all cases.
+
+# These are relevant when logging to syslog:
+#syslog_facility = 'LOCAL0'
+#syslog_ident = 'postgres'
+#syslog_sequence_numbers = on
+#syslog_split_messages = on
+
+# This is only relevant when logging to eventlog (Windows):
+# (change requires restart)
+#event_source = 'PostgreSQL'
+
+# - When to Log -
+
+#log_min_messages = warning		# values in order of decreasing detail:
+					#   debug5
+					#   debug4
+					#   debug3
+					#   debug2
+					#   debug1
+					#   info
+					#   notice
+					#   warning
+					#   error
+					#   log
+					#   fatal
+					#   panic
+
+#log_min_error_statement = error	# values in order of decreasing detail:
+					#   debug5
+					#   debug4
+					#   debug3
+					#   debug2
+					#   debug1
+					#   info
+					#   notice
+					#   warning
+					#   error
+					#   log
+					#   fatal
+					#   panic (effectively off)
+
+#log_min_duration_statement = -1	# -1 is disabled, 0 logs all statements
+					# and their durations, > 0 logs only
+					# statements running at least this number
+					# of milliseconds
+
+#log_min_duration_sample = -1		# -1 is disabled, 0 logs a sample of statements
+					# and their durations, > 0 logs only a sample of
+					# statements running at least this number
+					# of milliseconds;
+					# sample fraction is determined by log_statement_sample_rate
+
+#log_statement_sample_rate = 1.0	# fraction of logged statements exceeding
+					# log_min_duration_sample to be logged;
+					# 1.0 logs all such statements, 0.0 never logs
+
+
+#log_transaction_sample_rate = 0.0	# fraction of transactions whose statements
+					# are logged regardless of their duration; 1.0 logs all
+					# statements from all transactions, 0.0 never logs
+
+# - What to Log -
+
+#debug_print_parse = off
+#debug_print_rewritten = off
+#debug_print_plan = off
+#debug_pretty_print = on
+#log_autovacuum_min_duration = -1	# log autovacuum activity;
+					# -1 disables, 0 logs all actions and
+					# their durations, > 0 logs only
+					# actions running at least this number
+					# of milliseconds.
+#log_checkpoints = off
+#log_connections = off
+#log_disconnections = off
+#log_duration = off
+#log_error_verbosity = default		# terse, default, or verbose messages
+#log_hostname = off
+log_line_prefix = '%m [%p] %q%u@%d '		# special values:
+					#   %a = application name
+					#   %u = user name
+					#   %d = database name
+					#   %r = remote host and port
+					#   %h = remote host
+					#   %b = backend type
+					#   %p = process ID
+					#   %P = process ID of parallel group leader
+					#   %t = timestamp without milliseconds
+					#   %m = timestamp with milliseconds
+					#   %n = timestamp with milliseconds (as a Unix epoch)
+					#   %Q = query ID (0 if none or not computed)
+					#   %i = command tag
+					#   %e = SQL state
+					#   %c = session ID
+					#   %l = session line number
+					#   %s = session start timestamp
+					#   %v = virtual transaction ID
+					#   %x = transaction ID (0 if none)
+					#   %q = stop here in non-session
+					#        processes
+					#   %% = '%'
+					# e.g. '<%%u%%%d> '
+#log_lock_waits = off			# log lock waits >= deadlock_timeout
+#log_recovery_conflict_waits = off	# log standby recovery conflict waits
+					# >= deadlock_timeout
+#log_parameter_max_length = -1		# when logging statements, limit logged
+					# bind-parameter values to N bytes;
+					# -1 means print in full, 0 disables
+#log_parameter_max_length_on_error = 0	# when logging an error, limit logged
+					# bind-parameter values to N bytes;
+					# -1 means print in full, 0 disables
+#log_statement = 'none'			# none, ddl, mod, all
+#log_replication_commands = off
+#log_temp_files = -1			# log temporary files equal or larger
+					# than the specified size in kilobytes;
+					# -1 disables, 0 logs all temp files
+log_timezone = 'Etc/UTC'
+
+
+#------------------------------------------------------------------------------
+# PROCESS TITLE
+#------------------------------------------------------------------------------
+
+cluster_name = '<%= scope["zulip::postgresql_common::version"] %>/main'			# added to process titles if nonempty
+					# (change requires restart)
+#update_process_title = on
+
+
+#------------------------------------------------------------------------------
+# STATISTICS
+#------------------------------------------------------------------------------
+
+# - Query and Index Statistics Collector -
+
+#track_activities = on
+#track_activity_query_size = 1024	# (change requires restart)
+#track_counts = on
+#track_io_timing = off
+#track_wal_io_timing = off
+#track_functions = none			# none, pl, all
+stats_temp_directory = '/var/run/postgresql/<%= scope["zulip::postgresql_common::version"] %>-main.pg_stat_tmp'
+
+
+# - Monitoring -
+
+#compute_query_id = auto
+#log_statement_stats = off
+#log_parser_stats = off
+#log_planner_stats = off
+#log_executor_stats = off
+
+
+#------------------------------------------------------------------------------
+# AUTOVACUUM
+#------------------------------------------------------------------------------
+
+#autovacuum = on			# Enable autovacuum subprocess?  'on'
+					# requires track_counts to also be on.
+#autovacuum_max_workers = 3		# max number of autovacuum subprocesses
+					# (change requires restart)
+#autovacuum_naptime = 1min		# time between autovacuum runs
+#autovacuum_vacuum_threshold = 50	# min number of row updates before
+					# vacuum
+#autovacuum_vacuum_insert_threshold = 1000	# min number of row inserts
+					# before vacuum; -1 disables insert
+					# vacuums
+#autovacuum_analyze_threshold = 50	# min number of row updates before
+					# analyze
+#autovacuum_vacuum_scale_factor = 0.2	# fraction of table size before vacuum
+#autovacuum_vacuum_insert_scale_factor = 0.2	# fraction of inserts over table
+					# size before insert vacuum
+#autovacuum_analyze_scale_factor = 0.1	# fraction of table size before analyze
+#autovacuum_freeze_max_age = 200000000	# maximum XID age before forced vacuum
+					# (change requires restart)
+#autovacuum_multixact_freeze_max_age = 400000000	# maximum multixact age
+					# before forced vacuum
+					# (change requires restart)
+#autovacuum_vacuum_cost_delay = 2ms	# default vacuum cost delay for
+					# autovacuum, in milliseconds;
+					# -1 means use vacuum_cost_delay
+#autovacuum_vacuum_cost_limit = -1	# default vacuum cost limit for
+					# autovacuum, -1 means use
+					# vacuum_cost_limit
+
+
+#------------------------------------------------------------------------------
+# CLIENT CONNECTION DEFAULTS
+#------------------------------------------------------------------------------
+
+# - Statement Behavior -
+
+#client_min_messages = notice		# values in order of decreasing detail:
+					#   debug5
+					#   debug4
+					#   debug3
+					#   debug2
+					#   debug1
+					#   log
+					#   notice
+					#   warning
+					#   error
+#search_path = '"$user", public'	# schema names
+#row_security = on
+#default_table_access_method = 'heap'
+#default_tablespace = ''		# a tablespace name, '' uses the default
+#default_toast_compression = 'pglz'	# 'pglz' or 'lz4'
+#temp_tablespaces = ''			# a list of tablespace names, '' uses
+					# only default tablespace
+#check_function_bodies = on
+#default_transaction_isolation = 'read committed'
+#default_transaction_read_only = off
+#default_transaction_deferrable = off
+#session_replication_role = 'origin'
+#statement_timeout = 0			# in milliseconds, 0 is disabled
+#lock_timeout = 0			# in milliseconds, 0 is disabled
+#idle_in_transaction_session_timeout = 0	# in milliseconds, 0 is disabled
+#idle_session_timeout = 0		# in milliseconds, 0 is disabled
+#vacuum_freeze_table_age = 150000000
+#vacuum_freeze_min_age = 50000000
+#vacuum_failsafe_age = 1600000000
+#vacuum_multixact_freeze_table_age = 150000000
+#vacuum_multixact_freeze_min_age = 5000000
+#vacuum_multixact_failsafe_age = 1600000000
+#bytea_output = 'hex'			# hex, escape
+#xmlbinary = 'base64'
+#xmloption = 'content'
+#gin_pending_list_limit = 4MB
+
+# - Locale and Formatting -
+
+datestyle = 'iso, mdy'
+#intervalstyle = 'postgres'
+timezone = 'Etc/UTC'
+#timezone_abbreviations = 'Default'     # Select the set of available time zone
+					# abbreviations.  Currently, there are
+					#   Default
+					#   Australia (historical usage)
+					#   India
+					# You can create your own file in
+					# share/timezonesets/.
+#extra_float_digits = 1			# min -15, max 3; any value >0 actually
+					# selects precise output mode
+#client_encoding = sql_ascii		# actually, defaults to database
+					# encoding
+
+# These settings are initialized by initdb, but they can be changed.
+lc_messages = 'en_US.UTF-8'			# locale for system error message
+					# strings
+lc_monetary = 'en_US.UTF-8'			# locale for monetary formatting
+lc_numeric = 'en_US.UTF-8'			# locale for number formatting
+lc_time = 'en_US.UTF-8'				# locale for time formatting
+
+# default configuration for text search
+default_text_search_config = 'pg_catalog.english'
+
+# - Shared Library Preloading -
+
+#local_preload_libraries = ''
+#session_preload_libraries = ''
+#shared_preload_libraries = ''	# (change requires restart)
+#jit_provider = 'llvmjit'		# JIT library to use
+
+# - Other Defaults -
+
+#dynamic_library_path = '$libdir'
+#extension_destdir = ''			# prepend path when loading extensions
+					# and shared objects (added by Debian)
+#gin_fuzzy_search_limit = 0
+
+
+#------------------------------------------------------------------------------
+# LOCK MANAGEMENT
+#------------------------------------------------------------------------------
+
+#deadlock_timeout = 1s
+#max_locks_per_transaction = 64		# min 10
+					# (change requires restart)
+#max_pred_locks_per_transaction = 64	# min 10
+					# (change requires restart)
+#max_pred_locks_per_relation = -2	# negative values mean
+					# (max_pred_locks_per_transaction
+					#  / -max_pred_locks_per_relation) - 1
+#max_pred_locks_per_page = 2            # min 0
+
+
+#------------------------------------------------------------------------------
+# VERSION AND PLATFORM COMPATIBILITY
+#------------------------------------------------------------------------------
+
+# - Previous PostgreSQL Versions -
+
+#array_nulls = on
+#backslash_quote = safe_encoding	# on, off, or safe_encoding
+#escape_string_warning = on
+#lo_compat_privileges = off
+#quote_all_identifiers = off
+#standard_conforming_strings = on
+#synchronize_seqscans = on
+
+# - Other Platforms and Clients -
+
+#transform_null_equals = off
+
+
+#------------------------------------------------------------------------------
+# ERROR HANDLING
+#------------------------------------------------------------------------------
+
+#exit_on_error = off			# terminate session on any error?
+#restart_after_crash = on		# reinitialize after backend crash?
+#data_sync_retry = off			# retry or panic on failure to fsync
+					# data?
+					# (change requires restart)
+#recovery_init_sync_method = fsync	# fsync, syncfs (Linux 5.8+)
+
+
+#------------------------------------------------------------------------------
+# CONFIG FILE INCLUDES
+#------------------------------------------------------------------------------
+
+# These options allow settings to be loaded from files other than the
+# default postgresql.conf.  Note that these are directives, not variable
+# assignments, so they can usefully be given more than once.
+
+include_dir = 'conf.d'			# include files ending in '.conf' from
+					# a directory, e.g., 'conf.d'
+#include_if_exists = '...'		# include file only if it exists
+#include = '...'			# include file
+
+
+#------------------------------------------------------------------------------
+# CUSTOMIZED OPTIONS
+#------------------------------------------------------------------------------
+
+lc_messages = 'C.UTF-8'		# locale for system error message strings
+lc_monetary = 'C.UTF-8'		# locale for monetary formatting
+lc_numeric = 'C.UTF-8'			# locale for number formatting
+lc_time = 'C.UTF-8'			# locale for time formatting
+
+timezone = 'UTC'
+default_text_search_config = 'zulip.english_us_search'
+
+log_destination = 'stderr'
+logging_collector = on
+log_directory = '/var/log/postgresql'
+log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
+log_rotation_age = 7d
+log_rotation_size = 100MB
+log_min_duration_statement = 500
+log_line_prefix = '%m [%c]: [%l-1] '
+log_checkpoints = on
+log_lock_waits = on
+log_temp_files = 0
+log_autovacuum_min_duration = 100
+
+autovacuum_freeze_max_age = 2000000000
+vacuum_freeze_min_age     = 1000000000
+vacuum_freeze_table_age   = 1800000000
+
+# Performance settings
+max_connections = 1000
+maintenance_work_mem = <%= @maintenance_work_mem %>
+effective_cache_size = <%= @effective_cache_size %>
+work_mem = <%= @work_mem %>
+shared_buffers = <%= @shared_buffers %>
+<% unless @wal_buffers.nil? -%>
+wal_buffers = <%= @wal_buffers %>
+<% end -%>
+<% unless @min_wal_size.nil? -%>
+min_wal_size = <%= @min_wal_size %>
+<% end -%>
+<% unless @max_wal_size.nil? -%>
+max_wal_size = <%= @max_wal_size %>
+<% end -%>
+<% unless @random_page_cost.nil? -%>
+random_page_cost = <%= @random_page_cost %>
+<% end -%>
+<% unless @effective_io_concurrency.nil? -%>
+effective_io_concurrency = <%= @effective_io_concurrency %>
+<% end -%>
+<% unless @max_worker_processes.nil? -%>
+max_worker_processes = <%= @max_worker_processes %>
+<% end -%>
+<% unless @max_parallel_workers_per_gather.nil? -%>
+max_parallel_workers_per_gather = <%= @max_parallel_workers_per_gather %>
+<% end -%>
+<% unless @max_parallel_workers.nil? -%>
+max_parallel_workers = <%= @max_parallel_workers %>
+<% end -%>
+<% unless @max_parallel_maintenance_workers.nil? -%>
+max_parallel_maintenance_workers = <%= @max_parallel_maintenance_workers %>
+<% end -%>
+
+<% unless @listen_addresses.nil? -%>
+listen_addresses = <%= @listen_addresses %>
+<% end -%>
+
+<% if @s3_backups_bucket != '' -%>
+# WAL backups to S3 (may also be used for replication)
+archive_mode = on
+archive_command = '/usr/bin/timeout 10m /usr/local/bin/env-wal-g wal-push %p'
+restore_command = '/usr/local/bin/env-wal-g wal-fetch "%f" "%p"'
+<% end -%>
+<% unless @replication_primary.nil? || @replication_user.nil? -%>
+# Streaming replication
+primary_conninfo = 'host=<%= @replication_primary %> user=<%= @replication_user -%>
+<% if @replication_password != '' %> password=<%= @replication_password %><% end -%>
+<% unless @ssl_mode.nil? %> sslmode=<%= @ssl_mode %><% end -%>
+'
+<% end -%>
+
+<% unless @ssl_cert_file.nil? -%>
+ssl_cert_file = '<%= @ssl_cert_file %>'
+<% end -%>
+<% unless @ssl_key_file.nil? -%>
+ssl_key_file = '<%= @ssl_key_file %>'
+<% end -%>
+<% unless @ssl_ca_file.nil? -%>
+ssl_ca_file = '<%= @ssl_ca_file %>'
+<% end -%>

puppet/zulip/templates/postgresql/zulip.conf.template.erb

@@ -0,0 +1,86 @@
+<% unless @listen_addresses.nil? -%>
+# Bind to specific address
+listen_addresses = <%= @listen_addresses %>
+<% end -%>
+
+# This has an improved set of stopwords.
+default_text_search_config = 'zulip.english_us_search'
+
+# Provide more comprehensive on-disk logs
+logging_collector = on
+log_directory = '/var/log/postgresql'
+log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
+log_rotation_age = 7d
+log_rotation_size = 100MB
+log_min_duration_statement = 500
+log_line_prefix = '%m [%c]: [%l-1] '
+log_checkpoints = on
+log_lock_waits = on
+log_temp_files = 0
+log_autovacuum_min_duration = 100
+
+# Adjust autovacuum for having many mostly-append-only tables
+autovacuum_freeze_max_age = 2000000000
+vacuum_freeze_min_age     = 1000000000
+vacuum_freeze_table_age   = 1800000000
+
+# Performance settings
+max_connections = 1000
+maintenance_work_mem = <%= @maintenance_work_mem %>
+effective_cache_size = <%= @effective_cache_size %>
+work_mem = <%= @work_mem %>
+shared_buffers = <%= @shared_buffers %>
+<% unless @wal_buffers.nil? -%>
+wal_buffers = <%= @wal_buffers %>
+<% end -%>
+<% unless @min_wal_size.nil? -%>
+min_wal_size = <%= @min_wal_size %>
+<% end -%>
+<% unless @max_wal_size.nil? -%>
+max_wal_size = <%= @max_wal_size %>
+<% end -%>
+<% unless @random_page_cost.nil? -%>
+random_page_cost = <%= @random_page_cost %>
+<% end -%>
+<% if @version.to_i >= 18 && @io_uring_available -%>
+io_method = io_uring
+<% end -%>
+<% unless @effective_io_concurrency.nil? -%>
+effective_io_concurrency = <%= @effective_io_concurrency %>
+<% end -%>
+<% unless @max_worker_processes.nil? -%>
+max_worker_processes = <%= @max_worker_processes %>
+<% end -%>
+<% unless @max_parallel_workers_per_gather.nil? -%>
+max_parallel_workers_per_gather = <%= @max_parallel_workers_per_gather %>
+<% end -%>
+<% unless @max_parallel_workers.nil? -%>
+max_parallel_workers = <%= @max_parallel_workers %>
+<% end -%>
+<% unless @max_parallel_maintenance_workers.nil? -%>
+max_parallel_maintenance_workers = <%= @max_parallel_maintenance_workers %>
+<% end -%>
+
+<% if @s3_backups_bucket != '' -%>
+# WAL backups to S3 (may also be used for replication)
+archive_mode = on
+archive_command = '/usr/bin/timeout 10m /usr/local/bin/env-wal-g wal-push %p'
+restore_command = '/usr/local/bin/env-wal-g wal-fetch "%f" "%p"'
+<% end -%>
+<% unless @replication_primary.nil? || @replication_user.nil? -%>
+# Streaming replication
+primary_conninfo = 'host=<%= @replication_primary %> user=<%= @replication_user -%>
+<% if @replication_password != '' %> password=<%= @replication_password %><% end -%>
+<% unless @ssl_mode.nil? %> sslmode=<%= @ssl_mode %><% end -%>
+'
+<% end -%>
+
+<% unless @ssl_cert_file.nil? -%>
+ssl_cert_file = '<%= @ssl_cert_file %>'
+<% end -%>
+<% unless @ssl_key_file.nil? -%>
+ssl_key_file = '<%= @ssl_key_file %>'
+<% end -%>
+<% unless @ssl_ca_file.nil? -%>
+ssl_ca_file = '<%= @ssl_ca_file %>'
+<% end -%>

puppet/zulip/templates/supervisor/email-mirror.conf.template.erb

@@ -0,0 +1,16 @@
+[program:zulip-email-server]
+<%# supervisor expands the command as a format string, so percent signs
+    in the address (e.g. an IPv6 zone id) must be doubled. -%>
+command=nice -n15 /home/zulip/deployments/current/manage.py email_server --user zulip --group zulip<% if @listen != '' %> --listen <%= @listen.gsub('%', '%%') %><% end %>
+environment=HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"
+priority=350                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=TERM                ; signal used to kill process (default TERM)
+topwaitsecs=30                 ; max num secs to wait b4 SIGKILL (default 10)
+user=root                      ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/email_server.log         ; stdout log path, NONE for none; default AUTO
+stdout_logfile_maxbytes=20MB   ; max # logfile bytes b4 rotation (default 50MB)
+stdout_logfile_backups=3     ; # of stdout logfile backups (default 10)
+directory=/home/zulip/deployments/current/

puppet/zulip/templates/supervisor/go-camo.conf.erb

@@ -0,0 +1,9 @@
+[program:go-camo]
+command=/usr/local/bin/secret-env-wrapper GOCAMO_HMAC=camo_key <%= @bin %> --listen=<%= @listen_address %>:9292 -H "Strict-Transport-Security: max-age=31536000; includeSubdomains; preload" -H "X-Frame-Options: DENY" --metrics --verbose --allow-content-video --user-agent "Zulip-Server/<%= @zulip_version %> (<%= @external_uri %>/) go-camo/<%= @version %>" --server-name "go-camo/<%= @version %>"
+environment=HTTP_PROXY="<%= @proxy %>",HTTPS_PROXY="<%= @proxy %>"
+priority=15
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/camo.log

puppet/zulip/templates/supervisor/smokescreen.conf.erb

@@ -0,0 +1,25 @@
+<%
+
+acls = []
+acls.concat(@allow_addresses.map {|a| "--allow-address #{a}"})
+acls.concat(@allow_ranges.map {|a| "--allow-range #{a}"})
+acls.concat(@deny_addresses.map {|a| "--deny-address #{a}"})
+acls.concat(@deny_ranges.map {|a| "--deny-range #{a}"})
+
+if acls.empty?
+  acl = ""
+else
+  acl = " " + acls.join(" ")
+end
+
+-%>
+[program:smokescreen]
+command=<%= @bin %> --listen-ip <%= @listen_address %> --expose-prometheus-metrics --prometheus-listen-ip 127.0.0.1 --prometheus-port 4760<%= acl %>
+priority=15
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/smokescreen.log
+stdout_logfile_maxbytes=0
+stdout_logfile_backups=0

puppet/zulip/templates/supervisor/supervisord.conf.erb

@@ -0,0 +1,30 @@
+; supervisor config file
+
+[unix_http_server]
+file=/var/run/supervisor.sock   ; (the path to the socket file)
+chmod=0700                       ; socket file mode (default 0700)
+chown=zulip:zulip
+
+[supervisord]
+logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log)
+pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
+childlogdir=/var/log/supervisor            ; ('AUTO' child log dir, default $TEMP)
+minfds=<%= @file_descriptor_limit %> ; file descriptor limit for children
+
+; the below section must remain in the config file for RPC
+; (supervisorctl/web interface) to work, additional interfaces may be
+; added by defining them in separate rpcinterface: sections
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+
+[supervisorctl]
+serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL  for a unix socket
+
+; The [include] section can just contain the "files" setting.  This
+; setting can list multiple files (separated by whitespace or
+; newlines).  It can also contain wildcards.  The filenames are
+; interpreted as relative to this file.  Included files *cannot*
+; include files themselves.
+
+[include]
+files = <%= @system_conf_dir %>/*.conf <%= @conf_dir %>/*.conf

puppet/zulip/templates/supervisor/zulip-once.conf.template.erb

@@ -0,0 +1,29 @@
+[program:zulip_deliver_scheduled_emails]
+command=nice -n15 /home/zulip/deployments/current/manage.py deliver_scheduled_emails --skip-checks
+environment=HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"
+priority=350                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=TERM                ; signal used to kill process (default TERM)
+topwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+user=zulip                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/events_deliver_scheduled_emails.log         ; stdout log path, NONE for none; default AUTO
+stdout_logfile_maxbytes=20MB   ; max # logfile bytes b4 rotation (default 50MB)
+stdout_logfile_backups=3     ; # of stdout logfile backups (default 10)
+directory=/home/zulip/deployments/current/
+
+[program:zulip_deliver_scheduled_messages]
+command=nice -n15 /home/zulip/deployments/current/manage.py deliver_scheduled_messages --skip-checks
+environment=HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"
+priority=350                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=TERM                ; signal used to kill process (default TERM)
+topwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+user=zulip                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/events_deliver_scheduled_messages.log         ; stdout log path, NONE for none; default AUTO
+stdout_logfile_maxbytes=20MB   ; max # logfile bytes b4 rotation (default 50MB)
+stdout_logfile_backups=3     ; # of stdout logfile backups (default 10)
+directory=/home/zulip/deployments/current/

puppet/zulip/templates/supervisor/zulip.conf.template.erb

@@ -0,0 +1,174 @@
+; Supervisor config file.
+; on Debian squeeze, place me in /etc/supervisor/conf.d/zulip.conf
+;
+; For more information on the config file, please see:
+; http://supervisord.org/configuration.html
+;
+; Note: shell expansion ("~" or "$HOME") is not supported.  Environment
+; variables can be expanded using this syntax: "%(ENV_HOME)s".
+
+[program:zulip-django]
+command=nice -n5 uv run --no-sync uwsgi --ini /etc/zulip/uwsgi.ini
+environment=HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"<%= @ca_bundle %>
+priority=100                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=INT                 ; signal used to kill process (default TERM)
+stopwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+user=zulip                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/django.log        ; stdout log path, NONE for none; default AUTO
+stdout_logfile_maxbytes=100MB   ; max # logfile bytes b4 rotation (default 50MB)
+stdout_logfile_backups=10     ; # of stdout logfile backups (default 10)
+stopasgroup=true              ; Without this, we leak processes every restart
+killasgroup=true              ; Without this, we leak processes every restart
+directory=/home/zulip/deployments/current/
+
+[program:zulip-tus]
+command=nice -n5 /home/zulip/deployments/current/manage.py runtusd <%= @tusd_server_listen %>:9900
+environment=HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"<%= @ca_bundle %>
+priority=100                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=INT                 ; signal used to kill process (default TERM)
+stopwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+user=zulip                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/tusd.log        ; stdout log path, NONE for none; default AUTO
+stdout_logfile_maxbytes=0     ; Rotated by logrotate
+stdout_logfile_backups=0
+stopasgroup=true              ; Without this, we leak processes every restart
+killasgroup=true              ; Without this, we leak processes every restart
+directory=/home/zulip/deployments/current/
+
+<% if @tornado_ports.length > 1 -%>
+[program:zulip-tornado]
+command=/home/zulip/deployments/current/manage.py runtornado 127.0.0.1:98%(process_num)02d --skip-checks
+process_name=zulip-tornado-port-98%(process_num)02d
+environment=PYTHONUNBUFFERED=1,HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"<%= @ca_bundle %>
+priority=200                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=TERM                 ; signal used to kill process (default TERM)
+stopwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+user=zulip                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/tornado-98%(process_num)02d.log         ; stdout log path, NONE for none; default AUTO
+stdout_logfile_maxbytes=0     ; Rotated by logrotate
+stdout_logfile_backups=0
+directory=/home/zulip/deployments/current/
+numprocs=<%= @tornado_ports.length %>
+<% else -%>
+[program:zulip-tornado]
+command=/home/zulip/deployments/current/manage.py runtornado 127.0.0.1:9800 --skip-checks
+environment=PYTHONUNBUFFERED=1,HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"<%= @ca_bundle %>
+priority=200                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=TERM                 ; signal used to kill process (default TERM)
+stopwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+user=zulip                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/tornado.log         ; stdout log path, NONE for none; default AUTO
+stdout_logfile_maxbytes=0     ; Rotated by logrotate
+stdout_logfile_backups=0
+directory=/home/zulip/deployments/current/
+<% end -%>
+
+<% if @queues_multiprocess %>
+<% @queues.each do |queue| -%>
+[program:zulip_events_<%= queue %>]
+<%-
+  numprocs = 1
+  term = "worker"
+  if queue == "missedmessage_mobile_notifications"
+    numprocs = @mobile_notification_shards
+    term = "shard"
+  elsif queue == "user_activity"
+    numprocs = @user_activity_shards
+    term = "shard"
+  elsif @worker_counts.has_key?(queue)
+    numprocs = @worker_counts[queue]
+  end -%>
+<%- if numprocs > 1 -%>
+process_name=zulip_events_<%= queue %>_<%= term %>%(process_num)s
+command=nice -n10 /home/zulip/deployments/current/manage.py process_queue --queue_name=<%= queue %> --skip-checks --worker_num %(process_num)s
+stdout_logfile=/var/log/zulip/events_<%= queue %>_<%= term %>%(process_num)s.log         ; stdout log path, NONE for none; default AUTO
+numprocs=<%= numprocs %>
+numprocs_start=1
+<% else -%>
+command=nice -n10 /home/zulip/deployments/current/manage.py process_queue --queue_name=<%= queue %> --skip-checks
+stdout_logfile=/var/log/zulip/events_<%= queue %>.log         ; stdout log path, NONE for none; default AUTO
+<%end -%>
+environment=HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"<%= @ca_bundle %>
+priority=300                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=TERM                 ; signal used to kill process (default TERM)
+stopwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+user=zulip                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile_maxbytes=20MB   ; max # logfile bytes b4 rotation (default 50MB)
+stdout_logfile_backups=3     ; # of stdout logfile backups (default 10)
+directory=/home/zulip/deployments/current/
+<% end -%>
+<% else %>
+[program:zulip_events]
+command=nice -n10 /home/zulip/deployments/current/manage.py process_queue --multi_threaded <%= @queues.join(' ') %> --skip-checks
+environment=HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"<%= @ca_bundle %>
+priority=300                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=TERM                 ; signal used to kill process (default TERM)
+stopwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+user=zulip                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/events.log         ; stdout log path, NONE for none; default AUTO
+stdout_logfile_maxbytes=20MB   ; max # logfile bytes b4 rotation (default 50MB)
+stdout_logfile_backups=3     ; # of stdout logfile backups (default 10)
+directory=/home/zulip/deployments/current/
+stopasgroup=true              ; Without this, we leak processes every restart
+killasgroup=true              ; Without this, we leak processes every restart
+<% end %>
+
+; The below sample group section shows all possible group values,
+; create one or more 'real' group: sections to create "heterogeneous"
+; process groups.
+
+[group:zulip-workers]
+<% if @queues_multiprocess %>
+; each refers to 'x' in [program:x] definitions
+programs=<% @queues.each_with_index do |queue, i| -%>zulip_events_<%= queue %><%= ',' if i < (@queues.size - 1) %> <% end -%>
+<% else %>
+programs=zulip_events
+<% end %>
+
+<% if @katex_server %>
+[program:zulip-katex]
+command=/usr/local/bin/secret-env-wrapper SHARED_SECRET=shared_secret /srv/zulip-node/bin/node /home/zulip/prod-static/webpack-bundles/katex_server.js <%= @katex_server_port %>
+environment=NODE_ENV=production
+priority=200                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=TERM                 ; signal used to kill process (default TERM)
+stopwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+user=zulip                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/katex.log         ; stdout log path, NONE for none; default AUTO
+stdout_logfile_maxbytes=20MB   ; max # logfile bytes b4 rotation (default 50MB)
+stdout_logfile_backups=3     ; # of stdout logfile backups (default 10)
+directory=/home/zulip/deployments/current/
+<% end %>
+
+; The [include] section can just contain the "files" setting.  This
+; setting can list multiple files (separated by whitespace or
+; newlines).  It can also contain wildcards.  The filenames are
+; interpreted as relative to this file.  Included files *cannot*
+; include files themselves.
+
+;[include]
+;files = relative/directory/*.ini
+
+;enable server restarts without requiring superuser access. This assumes that this is the only service being controlled by supervisord on this machine.
+[unix_http_server]
+chown=zulip:zulip

puppet/zulip/templates/uwsgi.ini.template.erb

@@ -0,0 +1,72 @@
+[uwsgi]
+# Catch typos in configuration options
+strict=true
+
+# Basic environment
+env=LANG=C.UTF-8
+uid=zulip
+gid=zulip
+
+# We run the main process in /, and chdir to the current "current"
+# directory in each forked process
+chdir=/
+hook-post-fork=chdir:/home/zulip/deployments/current
+
+# lazy-apps means that the application is loaded after forking (and
+# thus chdir'ing).  This lets us do rolling restarts into new
+# versions.
+# https://uwsgi-docs.readthedocs.io/en/latest/articles/TheArtOfGracefulReloading.html#preforking-vs-lazy-apps-vs-lazy
+lazy-apps=true
+
+# Entrypoint of the application
+module=zproject.wsgi:application
+
+
+
+
+# Start a master process listening on this socket
+master=true
+chmod-socket=700
+chown-socket=zulip:zulip
+socket=/home/zulip/deployments/uwsgi-socket
+listen=<%= @uwsgi_listen_backlog_limit %>
+
+# Create a control socket, allowing rolling restarts ("chain reloading").
+master-fifo=/home/zulip/deployments/uwsgi-control
+
+
+# Let threads run when processes aren't responding to requests;
+# required for Sentry background worker
+enable-threads=true
+
+# How many serving processes to fork
+processes=<%= @uwsgi_processes %>
+
+# Give the processes short process names
+auto-procname=true
+procname-prefix-spaced=zulip-django
+
+# Longest response allowed, in seconds, before killing the worker
+harakiri=55
+
+
+
+# Default buffer for client HTTP headers is 4k, and nginx gets a 502
+# if the client sends more.  Set this high; nginx limits headers to
+# 32k, and will 400 requests with more than that.
+buffer-size=65535
+
+# The master process will buffer requests with bodies longer than 4096
+# bytes, freeing up workers from hanging around waiting to read them.
+post-buffering=4096
+
+
+
+# Create a socket to serve very basic UWSGI stats
+stats=/home/zulip/deployments/uwsgi-stats
+
+
+# Silence warnings from clients closing their connection early
+ignore-sigpipe = true
+ignore-write-errors = true
+disable-write-exception = true

puppet/zulip/templates/zulip-redis.template.erb

@@ -0,0 +1,9 @@
+# Zulip custom redis configuration
+
+# Disable saving to disk to optimize performance
+save ""
+
+<% if @redis_password != '' -%>
+# Set a Redis password based on zulip-secrets.conf
+requirepass '<%= @redis_password %>'
+<% end -%>