echo6-docs/docs/matrix/synapse.md

Synapse Deployment Reference

Generated: 2026-04-09 (Phase 1)

Install Method

• Docker Compose at /opt/matrix/docker-compose.yml
• Four containers on matrix-net bridge network:
  • matrix-synapse (matrixdotorg/synapse:latest) → 127.0.0.1:8008
  • matrix-mas (ghcr.io/element-hq/matrix-authentication-service:latest) → 127.0.0.1:8085
  • matrix-postgres (postgres:16-alpine) → internal 5432
  • matrix-element (vectorim/element-web:latest) → 127.0.0.1:8088

Synapse Version

• 1.147.1 (confirmed via admin API and docker exec)

Key Config Values (from homeserver.yaml)

• server_name: echo6.co
• public_baseurl: https://matrix.echo6.co/
• listeners: port 8008, HTTP, x_forwarded=true, bind 0.0.0.0, resources=[client, federation]
• database: psycopg2 → matrix-postgres:5432, db=synapse, user=synapse
• media_store_path: /data/media_store (95 MB used)
• registration_shared_secret: PRESENT (not redacted here — see synapse_homeserver.yaml.sanitized)
• signing_key_path: /data/echo6.co.signing.key
• enable_registration: false
• url_preview_enabled: true
• report_stats: false
• app_service_config_files: NOT PRESENT (no appservices currently registered)
• encryption_enabled_by_default_for_room_type: NOT SET (default=off)
• MAS delegation: enabled, endpoint=http://matrix-mas:8080/, shared secret present

MAS (Matrix Authentication Service)

• Version: v1.12.0
• Listen: 8080 (web), 8081 (internal/health)
• Database: postgresql://mas:***@matrix-postgres:5432/mas
• Upstream OAuth2: Authentik (auth.echo6.co) via OIDC
  • Client ID: 93kCoZkBlnJyD9EcAm7E4btKflecOcBm9DGONB5T
  • Issuer: https://auth.echo6.co/application/o/matrix/
• Matrix integration: kind=synapse, homeserver=echo6.co, endpoint=http://matrix-synapse:8008/
• Passwords: enabled (bcrypt v1 + argon2id v2)
• Email transport: blackhole (not sending)

Database (PostgreSQL)

• Version: 16.12 (Alpine)
• Host: matrix-postgres container on matrix-net
• Databases: synapse (owner: synapse), mas (owner: mas), postgres, template0, template1
• Users: synapse (Superuser, Create role, Create DB), mas (regular)
• Auth: password from .env file (POSTGRES_PASSWORD)
• New DB/user can be created without collision — synapse user has Superuser/Create role privileges

Reverse Proxy (Caddy on Contabo)

• matrix.echo6.co routes:
  • /_matrix/client/*/login|logout|refresh|auth_metadata → MAS (127.0.0.1:8085)
  • /_matrix/* → Synapse (127.0.0.1:8008)
  • /_synapse/* → Synapse (127.0.0.1:8008)
  • Everything else → MAS (127.0.0.1:8085)
• element.echo6.co → 127.0.0.1:8088

Federation

• Well-known served from echo6.co (utility Caddy, NOT matrix.echo6.co)
  • /.well-known/matrix/server: {"m.server": "matrix.echo6.co:443"}
  • /.well-known/matrix/client: base_url=https://matrix.echo6.co, issuer=https://matrix.echo6.co/
• Federation tester: AllChecksOK=true, TLS 1.3, valid Ed25519 key, valid certificates
• Port 8448 exposed in container but NOT used externally (federation via 443 + well-known)

Existing Appservices

• NONE — no app_service_config_files in homeserver.yaml, no registration files in /opt/matrix/synapse/

Backup

• Cron: daily at 3 AM via /opt/matrix/scripts/pg_backup.sh
• Backs up synapse DB only (NOT mas DB)
• Retention: 14 days
• Location: /opt/matrix/backups/

Ports in 29xxx Range

• NONE in use — confirmed via ss -tlnp

MSC4190 Support

• Synapse 1.147.1 supports MSC4190 (merged in 1.121.0)
• Requires io.element.msc4190: true in appservice registration file
• Also requires experimental_features.msc3202_transaction_extensions: true in homeserver.yaml