# synapse — Matrix homeserver (ana-docker)

Canonical copy of the stack running at `/opt/docker/compose/synapse/` on
**ana-docker** (`10.250.50.70`). Serves `matrix.phasefinal.com` and
`chat.phasefinal.com` through Traefik.

Deep documentation — current versions, the upgrade procedure, the appservice
namespace decision, conventions, and the push-notification findings — lives in
[`docs/pfi/vm-102-matrix-synapse.md`](../../docs/pfi/vm-102-matrix-synapse.md).
This file covers only what is specific to deploying the stack.

## ⚠ The password is NOT in this copy

The live compose carries `POSTGRES_PASSWORD` **inline in plaintext**. This
tracked copy replaces it with `${POSTGRES_PASSWORD:?set in .env}` so the secret
is not committed.

**They have therefore diverged**, and `deploy-stack.sh` would push the
placeholder over a working literal and break the database on next recreate.
Do not deploy this stack from the repo until the live file has been converted
to read from a `.env` — which is the right fix and is not done yet.

Until then: **edit the live file on the host, then re-mirror to here.**

## /_synapse/admin is LAN-only

Synapse mounts its admin API on the same vhost as the client API, so publishing
`matrix.phasefinal.com` published the admin surface with it — it answered 200
from the open internet until 2026-09-01.

A higher-priority router now scopes `PathPrefix(/_synapse/admin)` behind an
`ipallowlist`. Verified from a genuinely external vantage (the NH3 residential
egress proxy, not a fleet host): admin **403**, client API **200**, Element
unaffected.

⚠ The `10.0.0.0/8` entry currently matches nothing, deliberately. The hostname
resolves publicly, so fleet hosts hairpin out their own WAN and arrive as a
public address — a request from nh3-dev measured as `70.230.226.88`. The rule is
effectively **deny-all through Traefik**, which is intended: admin work is done
with `docker exec synapse` against `localhost:8008`, which never touches
Traefik. Allow-listing the sites' WAN addresses was rejected — they are dynamic,
and a stale entry either locks us out or hands admin to whoever inherits the
address.

## Upgrades

**Take a verified `pg_dump` first.** Schema migrations are one-way; an older
Synapse will not start against a newer database, so rollback is restore, not
revert. Full procedure in the docs link above.