Package: matrix-synapse
Synapse is an open-sourceMatrixhomeserver written and
maintained by the Matrix.org Foundation. We began rapid development in 2014,
reaching v1.0.0 in 2019. Development on Synapse and the Matrix protocol itself continues
in earnest today.Briefly, Matrix is an open standard for communications on the internet, supporting
federation, encryption and VoIP. Matrix.org has more to say about thegoals of the
Matrix project, and theformal specificationdescribes the technical details.ContentsInstalling and configurationUsing a reverse proxy with SynapseUpgrading an existing SynapsePlatform dependenciesSecurity noteTesting a new installationRegistering a new user from a clientTroubleshooting and supportIdentity ServersDevelopmentInstalling and configurationThe Synapse documentation describeshow to install Synapse. We recommend usingDocker imagesorDebian packages from Matrix.org.Synapse has a variety ofconfig optionswhich can be used to customise its behaviour after installation.
There are additional details on how toconfigure Synapse for federation here.Using a reverse proxy with SynapseIt is recommended to put a reverse proxy such asnginx,Apache,Caddy,HAProxyorrelaydin front of Synapse. One advantage of
doing so is that it means that you can expose the default https port (443) to
Matrix clients without needing to run Synapse with root privileges.
For information on configuring one, seethe reverse proxy docs.Upgrading an existing SynapseThe instructions for upgrading Synapse are inthe upgrade notes.
Please check these instructions as upgrading may require extra steps for some
versions of Synapse.Platform dependenciesSynapse uses a number of platform dependencies such as Python and PostgreSQL,
and aims to follow supported upstream versions. See thedeprecation policyfor more details.Security noteMatrix serves raw, user-supplied data in some APIs – specifically thecontent
repository endpoints.Whilst we make a reasonable effort to mitigate against XSS attacks (for
instance, by usingCSP), a Matrix homeserver should not be hosted on a
domain hosting other web applications. This especially applies to sharing
the domain with Matrix web clients and other sensitive applications like
webmail. Seehttps://developer.github.com/changes/2014-04-25-user-content-securityfor more
information.Ideally, the homeserver should not simply be on a different subdomain, but on
a completely differentregistered domain(also known as top-level site or
eTLD+1). This is becausesome attacksare still possible as long as the two
applications share the same registered domain.To illustrate this with an example, if your Element Web or other sensitive web
application is hosted onA.example1.com, you should ideally host Synapse onexample2.com. Some amount of protection is offered by hosting onB.example1.cominstead, so this is also acceptable in some scenarios.
However, you shouldnothost your Synapse onA.example1.com.Note that all of the above refers exclusively to the domain used in Synapse’spublic_baseurlsetting. In particular, it has no bearing on the domain
mentioned in MXIDs hosted on that server.Following this advice ensures that even if an XSS is found in Synapse, the
impact to other applications will be minimal.Testing a new installationThe easiest way to try out your new Synapse installation is by connecting to it
from a web client.Unless you are running a test instance of Synapse on your local machine, in
general, you will need to enable TLS support before you can successfully
connect from a client: seeTLS certificates.An easy way to get started is to login or register via Element athttps://app.element.io/#/loginorhttps://app.element.io/#/registerrespectively.
You will need to change the server you are logging into frommatrix.organd instead specify a Homeserver URL ofhttps://<server_name>:8448(or justhttps://<server_name>if you are using a reverse proxy).
If you prefer to use another client, refer to ourclient breakdown.If all goes well you should at least be able to log in, create a room, and
start sending messages.Registering a new user from a clientBy default, registration of new users via Matrix clients is disabled. To enable
it:In theregistration config sectionsetenable_registration: trueinhomeserver.yaml.Theneither:set up aCAPTCHA, orsetenable_registration_without_verification: trueinhomeserver.yaml.Westronglyrecommend using a CAPTCHA, particularly if your homeserver is exposed to
the public internet. Without it, anyone can freely register accounts on your homeserver.
This can be exploited by attackers to create spambots targetting the rest of the Matrix
federation.Your new user name will be formed partly from theserver_name, and partly
from a localpart you specify when you create the account. Your name will take
the form of:@localpart:my.domain.name(pronounced “at localpart on my dot domain dot name”).As when logging in, you will need to specify a “Custom server”.  Specify your
desiredlocalpartin the ‘User name’ box.Troubleshooting and supportTheAdmin FAQincludes tips on dealing with some common problems. For more details, seeSynapse’s wider documentation.For additional support installing or managing Synapse, please ask in the community
support room#synapse:matrix.org(from a matrix.org account if necessary). We do not use GitHub
issues for support requests, only for bug reports and feature requests.Identity ServersIdentity servers have the job of mapping email addresses and other 3rd Party
IDs (3PIDs) to Matrix user IDs, as well as verifying the ownership of 3PIDs
before creating that mapping.They are not where accounts or credentials are stored - these live on home
servers. Identity Servers are just for mapping 3rd party IDs to matrix IDs.This process is very security-sensitive, as there is obvious risk of spam if it
is too easy to sign up for Matrix accounts or harvest 3PID data. In the longer
term, we hope to create a decentralised system to manage it (matrix-doc #712), but in the meantime,
the role of managing trusted identity in the Matrix ecosystem is farmed out to
a cluster of known trusted ecosystem partners, who run ‘Matrix Identity
Servers’ such asSydent, whose role
is purely to authenticate and track 3PID logins and publish end-user public
keys.You can host your own copy of Sydent, but this will prevent you reaching other
users in the Matrix ecosystem via their email address, and prevent them finding
you. We therefore recommend that you use one of the centralised identity servers
athttps://matrix.orgorhttps://vector.imfor now.To reiterate: the Identity server will only be used if you choose to associate
an email address with your account, or send an invite to another user via their
email address.DevelopmentWe welcome contributions to Synapse from the community!
The best place to get started is ourguide for contributors.
This is part of our largerdocumentation, which includesinformation for Synapse developers as well as Synapse administrators.
Developers might be particularly interested in:Synapse’s database schema,notes on Synapse’s implementation details, andhow we use git.Alongside all that, join our developer community on Matrix:#synapse-dev:matrix.org, featuring real humans!