79 lines
3.5 KiB
Text
79 lines
3.5 KiB
Text
|
# Synapse Deployment Reference
|
||
|
|
# Generated: 2026-04-09 (Phase 1)
|
||
|
|
|
||
|
|
## Install Method
|
||
|
|
- Docker Compose at /opt/matrix/docker-compose.yml
|
||
|
|
- Four containers on `matrix-net` bridge network:
|
||
|
|
- matrix-synapse (matrixdotorg/synapse:latest) → 127.0.0.1:8008
|
||
|
|
- matrix-mas (ghcr.io/element-hq/matrix-authentication-service:latest) → 127.0.0.1:8085
|
||
|
|
- matrix-postgres (postgres:16-alpine) → internal 5432
|
||
|
|
- matrix-element (vectorim/element-web:latest) → 127.0.0.1:8088
|
||
|
|
|
||
|
|
## Synapse Version
|
||
|
|
- 1.147.1 (confirmed via admin API and docker exec)
|
||
|
|
|
||
|
|
## Key Config Values (from homeserver.yaml)
|
||
|
|
- server_name: echo6.co
|
||
|
|
- public_baseurl: https://matrix.echo6.co/
|
||
|
|
- listeners: port 8008, HTTP, x_forwarded=true, bind 0.0.0.0, resources=[client, federation]
|
||
|
|
- database: psycopg2 → matrix-postgres:5432, db=synapse, user=synapse
|
||
|
|
- media_store_path: /data/media_store (95 MB used)
|
||
|
|
- registration_shared_secret: PRESENT (not redacted here — see synapse_homeserver.yaml.sanitized)
|
||
|
|
- signing_key_path: /data/echo6.co.signing.key
|
||
|
|
- enable_registration: false
|
||
|
|
- url_preview_enabled: true
|
||
|
|
- report_stats: false
|
||
|
|
- app_service_config_files: NOT PRESENT (no appservices currently registered)
|
||
|
|
- encryption_enabled_by_default_for_room_type: NOT SET (default=off)
|
||
|
|
- MAS delegation: enabled, endpoint=http://matrix-mas:8080/, shared secret present
|
||
|
|
|
||
|
|
## MAS (Matrix Authentication Service)
|
||
|
|
- Version: v1.12.0
|
||
|
|
- Listen: 8080 (web), 8081 (internal/health)
|
||
|
|
- Database: postgresql://mas:***@matrix-postgres:5432/mas
|
||
|
|
- Upstream OAuth2: Authentik (auth.echo6.co) via OIDC
|
||
|
|
- Client ID: 93kCoZkBlnJyD9EcAm7E4btKflecOcBm9DGONB5T
|
||
|
|
- Issuer: https://auth.echo6.co/application/o/matrix/
|
||
|
|
- Matrix integration: kind=synapse, homeserver=echo6.co, endpoint=http://matrix-synapse:8008/
|
||
|
|
- Passwords: enabled (bcrypt v1 + argon2id v2)
|
||
|
|
- Email transport: blackhole (not sending)
|
||
|
|
|
||
|
|
## Database (PostgreSQL)
|
||
|
|
- Version: 16.12 (Alpine)
|
||
|
|
- Host: matrix-postgres container on matrix-net
|
||
|
|
- Databases: synapse (owner: synapse), mas (owner: mas), postgres, template0, template1
|
||
|
|
- Users: synapse (Superuser, Create role, Create DB), mas (regular)
|
||
|
|
- Auth: password from .env file (POSTGRES_PASSWORD)
|
||
|
|
- New DB/user can be created without collision — synapse user has Superuser/Create role privileges
|
||
|
|
|
||
|
|
## Reverse Proxy (Caddy on Contabo)
|
||
|
|
- matrix.echo6.co routes:
|
||
|
|
- /_matrix/client/*/login|logout|refresh|auth_metadata → MAS (127.0.0.1:8085)
|
||
|
|
- /_matrix/* → Synapse (127.0.0.1:8008)
|
||
|
|
- /_synapse/* → Synapse (127.0.0.1:8008)
|
||
|
|
- Everything else → MAS (127.0.0.1:8085)
|
||
|
|
- element.echo6.co → 127.0.0.1:8088
|
||
|
|
|
||
|
|
## Federation
|
||
|
|
- Well-known served from echo6.co (utility Caddy, NOT matrix.echo6.co)
|
||
|
|
- /.well-known/matrix/server: {"m.server": "matrix.echo6.co:443"}
|
||
|
|
- /.well-known/matrix/client: base_url=https://matrix.echo6.co, issuer=https://matrix.echo6.co/
|
||
|
|
- Federation tester: AllChecksOK=true, TLS 1.3, valid Ed25519 key, valid certificates
|
||
|
|
- Port 8448 exposed in container but NOT used externally (federation via 443 + well-known)
|
||
|
|
|
||
|
|
## Existing Appservices
|
||
|
|
- NONE — no app_service_config_files in homeserver.yaml, no registration files in /opt/matrix/synapse/
|
||
|
|
|
||
|
|
## Backup
|
||
|
|
- Cron: daily at 3 AM via /opt/matrix/scripts/pg_backup.sh
|
||
|
|
- Backs up synapse DB only (NOT mas DB)
|
||
|
|
- Retention: 14 days
|
||
|
|
- Location: /opt/matrix/backups/
|
||
|
|
|
||
|
|
## Ports in 29xxx Range
|
||
|
|
- NONE in use — confirmed via ss -tlnp
|
||
|
|
|
||
|
|
## MSC4190 Support
|
||
|
|
- Synapse 1.147.1 supports MSC4190 (merged in 1.121.0)
|
||
|
|
- Requires io.element.msc4190: true in appservice registration file
|
||
|
|
- Also requires experimental_features.msc3202_transaction_extensions: true in homeserver.yaml
|